No OneTemporary
Actions

Size

4 MB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	Index: head/security/vuxml/vuln.xml
	===================================================================
	--- head/security/vuxml/vuln.xml (revision 488401)
	+++ head/security/vuxml/vuln.xml (revision 488402)
	@@ -1,118420 +1,118420 @@
	<?xml version="1.0" encoding="utf-8"?>
	<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd">
	<!--
	Copyright 2003-2018 Jacques Vidrine and contributors

	Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
	HTML, PDF, PostScript, RTF and so forth) with or without modification,
	are permitted provided that the following conditions are met:
	1. Redistributions of source code (VuXML) must retain the above
	copyright notice, this list of conditions and the following
	disclaimer as the first lines of this file unmodified.
	2. Redistributions in compiled form (transformed to other DTDs,
	published online in any format, converted to PDF, PostScript,
	RTF and other formats) must reproduce the above copyright
	notice, this list of conditions and the following disclaimer
	in the documentation and/or other materials provided with the
	distribution.

	THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
	AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
	THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
	BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
	OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
	BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
	WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
	OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
	EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

	$FreeBSD$


	QUICK GUIDE TO ADDING A NEW ENTRY

	1. run 'make newentry' to add a template to the top of the document
	2. fill in the template
	3. use 'make validate' to verify syntax correctness (you might need to install
	textproc/libxml2 for parser, and this port for catalogs)
	4. fix any errors
	5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
	6. profit!

	Additional tests can be done this way:
	$ pkg audit -f ./vuln.xml py26-django-1.6
	$ pkg audit -f ./vuln.xml py27-django-1.6.1

	Extensive documentation of the format and help with writing and verifying
	a new entry is available in The Porter's Handbook at:

	http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html

	Help is also available from ports-security@freebsd.org.

	Notes:

	* Please add new entries to the beginning of this file.
	* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
	-->
	<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
	<vuln vid="70b774a8-05bc-11e9-87ad-001b217b3468">
	<topic>Gitlab -- Arbitrary File read in Gitlab project import</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.5</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.12</lt></range>
	<range><ge>8.9.0</ge><lt>11.3.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released">
	<p>Arbitrary File read in Gitlab project import</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/</url>
	<cvename>CVE-2018-20229</cvename>
	</references>
	<dates>
	<discovery>2018-12-20</discovery>
	<entry>2018-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="4f8665d0-0465-11e9-b77a-6cc21735f730">
	<topic>shibboleth-sp -- crashes on malformed date/time content</topic>
	<affects>
	<package>
	<name>shibboleth-sp</name>
	<range><ge>3.0.0</ge><lt>3.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Shibboleth Consortium reports:</p>
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20181219a.txt">
	<p>SAML messages, assertions, and metadata all commonly contain
	date/time information in a standard XML format.</p>
	<p>Invalid formatted data in such fields cause an exception of a type
	that was not handled properly in the V3 software and causes a crash
	(usually to the shibd daemon process, but possibly to Apache in rare
	cases). Note that the crash occurs prior to evaluation of a message's
	authenticity, so can be exploited by an untrusted attacker.</p>
	<p>The problem is believed to be specific to the V3 software and would
	not cause a crash in the older, now unsupported, V2 software.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://shibboleth.net/community/advisories/secadv_20181219a.txt</url>
	</references>
	<dates>
	<discovery>2018-12-19</discovery>
	<entry>2018-12-20</entry>
	</dates>
	</vuln>

	<vuln vid="1999a215-fc6b-11e8-8a95-ac1f6b67e138">
	<topic>couchdb -- administrator privilege escalation</topic>
	<affects>
	<package>
	<name>couchdb</name>
	<range><lt>2.3.0,2</lt></range>
	</package>
	<package>
	<name>couchdb2</name>
	<range><lt>2.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache CouchDB PMC reports:</p>
	<blockquote cite="https://lists.apache.org/thread.html/...">
	<p>Database Administrator could achieve privilege escalation to
	the account that CouchDB runs under, by abusing insufficient validation
	in the HTTP API, escaping security controls implemented in previous
	releases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://docs.couchdb.org/en/stable/cve/2018-17188.html</url>
	<cvename>CVE-2018-17188</cvename>
	</references>
	<dates>
	<discovery>2018-12-01</discovery>
	<entry>2018-12-13</entry>
	</dates>
	</vuln>

	<vuln vid="b80f039d-579e-4b82-95ad-b534a709f220">
	<topic>bro -- "Magellan" remote code execution vulnerability in bundled sqlite</topic>
	<affects>
	<package>
	<name>bro</name>
	<range><lt>2.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bro Network security Monitor reports:</p>
	<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
	<p>Bro 2.6.1 updates the embedded SQLite to version 3.26.0
	to address the "Magellan" remote code execution vulnerability.
	The stock Bro configuration/scripts don't use SQLite by
	default, but custom user scripts/packages may.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.bro.org/download/NEWS.bro.html</url>
	</references>
	<dates>
	<discovery>2018-12-01</discovery>
	<entry>2018-12-20</entry>
	</dates>
	</vuln>

	<vuln vid="fa6a4a69-03d1-11e9-be12-a4badb2f4699">
	<topic>FreeBSD -- bootpd buffer overflow</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_1</lt></range>
	<range><ge>11.2</ge><lt>11.2_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to insufficient validation of network-provided data
	it may be possible for a malicious attacker to craft a bootp
	packet which could cause a stack buffer overflow.</p>
	<h1>Impact:</h1>
	<p>It is possible that the buffer overflow could lead to a
	Denial of Service or remote code execution.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1716</cvename>
	<freebsdsa>SA-18:15.bootpd</freebsdsa>
	</references>
	<dates>
	<discovery>2018-12-19</discovery>
	<entry>2018-12-19</entry>
	</dates>
	</vuln>

	<vuln vid="4b98613c-0078-11e9-b05b-00e04c1ea73d">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.0.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpress developers reports:</p>
	<blockquote cite="https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/">
	<p>WordPress versions 5.0 and earlier are affected by the following bugs, which are
	fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are
	also available, for users who have not yet updated to 5.0.</p>
	<p>Karim El Ouerghemmi discovered that authors could alter meta data to delete files
	that they weren’t authorized to.</p>
	<p>Simon Scannell of RIPS Technologies discovered that authors could create posts of
	unauthorized post types with specially crafted input.</p>
	<p>Sam Thomas discovered that contributors could craft meta data in a way that resulted
	in PHP object injection.</p>
	<p>Tim Coen discovered that contributors could edit new comments from higher-privileged
	users, potentially leading to a cross-site scripting vulnerability.</p>
	<p>Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site
	scripting vulnerability in some circumstances. WordPress itself was not affected,
	but plugins could be in some situations.</p>
	<p>Team Yoast discovered that the user activation screen could be indexed by search
	engines in some uncommon configurations, leading to exposure of email addresses,
	and in some rare cases, default generated passwords.</p>
	<p>Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload
	specifically crafted files that bypass MIME verification, leading to a cross-site
	scripting vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/</url>
	</references>
	<dates>
	<discovery>2018-12-13</discovery>
	<entry>2018-12-15</entry>
	</dates>
	</vuln>

	<vuln vid="293f40a0-ffa1-11e8-b258-0011d823eebd">
	<topic>Mbed TLS -- Local timing attack on RSA decryption</topic>
	<affects>
	<package>
	<name>mbedtls</name>
	<range><lt>2.14.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Janos Follath reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03">
	<p>An attacker who can run code on the same machine that is
	performing an RSA decryption can potentially recover the plaintext
	through a Bleichenbacher-like oracle.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03</url>
	<cvename>CVE-2018-19608</cvename>
	</references>
	<dates>
	<discovery>2018-11-28</discovery>
	<entry>2018-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="bab29816-ff93-11e8-b05b-00e04c1ea73d">
	<topic>typo3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>typo3-8</name>
	<range><lt>8.7.21</lt></range>
	</package>
	<package>
	<name>typo3-9</name>
	<range><lt>9.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo3 core team reports:</p>
	<blockquote cite="https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/">
	<p>CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr.
	The vulnerability stemmed from the fact that it was possible to execute XSS inside
	the CKEditor source area after persuading the victim to: (i) switch CKEditor to
	source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker,
	into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.
	Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.</p>
	<p>Failing to properly encode user input, online media asset rendering
	(.youtube and .vimeo files) is vulnerable to cross-site scripting. A valid backend user
	account or write access on the server system (e.g. SFTP) is needed in order to exploit this
	vulnerability.</p>
	<p>Failing to properly encode user input, notifications shown in modal windows in the TYPO3
	backend are vulnerable to cross-site scripting. A valid backend user account is needed in
	order to exploit this vulnerability.</p>
	<p>Failing to properly encode user input, login status display is vulnerable to cross-site
	scripting in the website frontend. A valid user account is needed in order to exploit this
	vulnerability - either a backend user or a frontend user having the possibility to modify
	their user profile.</p>
	<p>Template patterns that are affected are:</p>
	<ul>
	<li>###FEUSER_[fieldName]### using system extension felogin</li>
	<li><!--###USERNAME###--> for regular frontend rendering
	(pattern can be defined individually using TypoScript setting
	config.USERNAME_substToken)</li>
	</ul>
	<p>It has been discovered that cookies created in the Install Tool are not hardened to be
	submitted only via HTTP. In combination with other vulnerabilities such as cross-site
	scripting it can lead to hijacking an active and valid session in the Install Tool.</p>
	<p>The Install Tool exposes the current TYPO3 version number to non-authenticated users.</p>
	<p>Online Media Asset Handling (.youtube and .vimeo files) in the TYPO3 backend is vulnerable
	to denial of service. Putting large files with according file extensions results in high
	consumption of system resources. This can lead to exceeding limits of the current PHP process
	which results in a dysfunctional backend component. A valid backend user account or write
	access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.</p>
	<p>TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs
	URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous
	user sessions are valid, attackers can use this vulnerability in order to create an arbitrary
	amount of individual session-data records in the database.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/</url>
	</references>
	<dates>
	<discovery>2018-12-11</discovery>
	<entry>2018-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="757e6ee8-ff91-11e8-a148-001b217b3468">
	<topic>Gitlab -- Arbitrary File read in GitLab project import with Git LFS</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.4</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.11</lt></range>
	<range><ge>11.0.0</ge><lt>11.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/">
	<p>Arbitrary File read in GitLab project import with Git LFS</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/</url>
	<cvename>CVE-2018-20144</cvename>
	</references>
	<dates>
	<discovery>2018-12-13</discovery>
	<entry>2018-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="ed10ed3f-fddc-11e8-94cf-6805ca0b3d42">
	<topic>phpMyAdmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php56</name>
	<name>phpMyAdmin-php70</name>
	<name>phpMyAdmin-php71</name>
	<name>phpMyAdmin-php72</name>
	<range><lt>4.8.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-6/">
	<h3>Summary</h3>
	<p>Local file inclusion through transformation feature</p>
	<h3>Description</h3>
	<p>A flaw has been found where an attacker can exploit
	phpMyAdmin to leak the contents of a local file. The
	attacker must have access to the phpMyAdmin Configuration
	Storage tables, although these can easily be created in any
	database to which the attacker has access. An attacker must
	have valid credentials to log in to phpMyAdmin; this
	vulnerability does not allow an attacker to circumvent the
	login system.</p>
	<h3>Severity</h3>
	<p>We consider this vulnerability to be severe.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-7/">
	<h3>Summary</h3>
	<p>XSRF/CSRF vulnerability in phpMyAdmin</p>
	<h3>Description</h3>
	<p>By deceiving a user to click on a crafted URL, it is
	possible to perform harmful SQL operations such as renaming
	databases, creating new tables/routines, deleting designer
	pages, adding/deleting users, updating user passwords,
	killing SQL processes, etc.</p>
	<h3>Severity</h3>
	<p>We consider this vulnerability to be of moderate severity.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-8/">
	<h3>Summary</h3>
	<p>XSS vulnerability in navigation tree</p>
	<h3>Description</h3>
	<p>A Cross-Site Scripting vulnerability was found in the
	navigation tree, where an attacker can deliver a payload to
	a user through a specially-crafted database/table name.</p>
	<h3>Severity</h3>
	<p>We consider this attack to be of moderate severity.</p>
	<h3>Mitigation factor</h3>
	<p>The stored XSS vulnerabilities can be triggered only by
	someone who logged in to phpMyAdmin, as the usual token
	protection prevents non-logged-in users from accessing the
	required forms.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-6/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-7/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-8/</url>
	</references>
	<dates>
	<discovery>2018-12-11</discovery>
	<entry>2018-12-12</entry>
	</dates>
	</vuln>

	<vuln vid="d10b49b2-8d02-49e8-afde-0844626317af">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>64.0_3,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.2.6</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.5</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>60.4.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>60.4.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/">
	<p>CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module</p>
	<p>CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11</p>
	<p>CVE-2018-18492: Use-after-free with select element</p>
	<p>CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia</p>
	<p>CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs</p>
	<p>CVE-2018-18495: WebExtension content scripts can be loaded in about: pages</p>
	<p>CVE-2018-18496: Embedded feed preview page can be abused for clickjacking</p>
	<p>CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators</p>
	<p>CVE-2018-18498: Integer overflow when calculating buffer sizes for images</p>
	<p>CVE-2018-12406: Memory safety bugs fixed in Firefox 64</p>
	<p>CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-12405</cvename>
	<cvename>CVE-2018-12406</cvename>
	<cvename>CVE-2018-12407</cvename>
	<cvename>CVE-2018-17466</cvename>
	<cvename>CVE-2018-18492</cvename>
	<cvename>CVE-2018-18493</cvename>
	<cvename>CVE-2018-18494</cvename>
	<cvename>CVE-2018-18495</cvename>
	<cvename>CVE-2018-18496</cvename>
	<cvename>CVE-2018-18497</cvename>
	<cvename>CVE-2018-18498</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/</url>
	</references>
	<dates>
	<discovery>2018-12-11</discovery>
	<entry>2018-12-11</entry>
	</dates>
	</vuln>

	<vuln vid="32498c8f-fc84-11e8-be12-a4badb2f4699">
	<topic>FreeBSD -- Insufficient bounds checking in bhyve(8) device model</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.2</ge><lt>11.2_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Insufficient bounds checking in one of the device models
	provided by bhyve(8) can permit a guest operating system
	to overwrite memory in the bhyve(8) processing possibly
	permitting arbitary code execution.</p>
	<h1>Impact:</h1>
	<p>A guest OS using a firmware image can cause the bhyve
	process to crash, or possibly execute arbitrary code on the
	host as root.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1716</cvename>
	<freebsdsa>SA-18:14.bhyve</freebsdsa>
	</references>
	<dates>
	<discovery>2018-12-04</discovery>
	<entry>2018-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="268a4289-fc84-11e8-be12-a4badb2f4699">
	<topic>FreeBSD -- Multiple vulnerabilities in NFS server code</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.2</ge><lt>11.2_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Insufficient and improper checking in the NFS server
	code could cause a denial of service or possibly remote
	code execution via a specially crafted network packet.</p>
	<h1>Impact:</h1>
	<p>A remote attacker could cause the NFS server to crash,
	resulting in a denial of service, or possibly execute
	arbitrary code on the server.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1715</cvename>
	<freebsdsa>SA-18:13.nfs</freebsdsa>
	</references>
	<dates>
	<discovery>2018-11-27</discovery>
	<entry>2018-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="2a86f45a-fc3c-11e8-a414-00155d006b02">
	<topic>node.js -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node6</name>
	<range><lt>6.15.0</lt></range>
	</package>
	<package>
	<name>node8</name>
	<range><lt>8.14.0</lt></range>
	</package>
	<package>
	<name>node10</name>
	<range><lt>10.14.0</lt></range>
	</package>
	<package>
	<name>node</name>
	<range><lt>11.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js reports:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/">
	<p>Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.</p>
	<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
	<h1>Debugger port 5858 listens on any interface by default (CVE-2018-12120)</h1>
	<p>All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with <code>node --debug</code> or <code>node debug</code>, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as <code>node --debug=localhost</code>. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.</p>
	<h1>Denial of Service with large HTTP headers (CVE-2018-12121)</h1>
	<p>All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
	<p>The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.</p>
	<h1>"Slowloris" HTTP Denial of Service (CVE-2018-12122)</h1>
	<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
	<p>A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with <code>server.headersTimeout</code>. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with <code>server.setTimeout()</code>, this aids in protecting against excessive resource retention and possible Denial of Service.</p>
	<h1>Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)</h1>
	<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using <code>url.parse()</code> to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.</p>
	<h1>HTTP request splitting (CVE-2018-12116)</h1>
	<p>Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the <code>path</code> option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.</p>
	<h1>OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)</h1>
	<p>The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
	<h1>OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)</h1>
	<p>The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
	<h1>OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)</h1>
	<p>OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/</url>
	<cvename>CVE-2018-12120</cvename>
	<cvename>CVE-2018-12121</cvename>
	<cvename>CVE-2018-12122</cvename>
	<cvename>CVE-2018-12123</cvename>
	<cvename>CVE-2018-12116</cvename>
	<cvename>CVE-2018-0735</cvename>
	<cvename>CVE-2018-0734</cvename>
	<cvename>CVE-2018-5407</cvename>
	</references>
	<dates>
	<discovery>2018-11-27</discovery>
	<entry>2018-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="f6d6308a-f2ec-11e8-b005-6805ca2fa271">
	<topic>powerdns-recursor -- Crafted query can cause a denial of service</topic>
	<affects>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>4.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>powerdns Team reports:</p>
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
	<p>CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
	<cvename>CVE-2018-16855</cvename>
	</references>
	<dates>
	<discovery>2018-11-26</discovery>
	<entry>2018-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="0e8f496a-b498-11e8-bdcf-74d435e60b7c">
	<topic>py-asyncssh -- Allows bypass of authentication</topic>
	<affects>
	<package>
	<name>py-asyncssh</name>
	<range><lt>1.12.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mitre.org Reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749">
	<p>The SSH server implementation of AsyncSSH before 1.12.1 does not properly check
	whether authentication is completed before processing other requests
	A customized SSH client can simply skip the authentication step.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749</url>
	</references>
	<dates>
	<discovery>2018-03-07</discovery>
	<entry>2018-12-08</entry>
	</dates>
	</vuln>

	<vuln vid="9d3428d4-f98c-11e8-a148-001b217b3468">
	<topic>Gitlab -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.3</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.10</lt></range>
	<range><ge>8.11.0</ge><lt>11.3.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released">
	<p>Directory Traversal in Templates API</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/</url>
	<cvename>CVE-2018-19856</cvename>
	</references>
	<dates>
	<discovery>2018-12-06</discovery>
	<entry>2018-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="49cbe200-f92a-11e8-a89d-d43d7ef03aa6">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.101</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-42.html">
	<ul>
	<li>This update resolves a use-after-free vulnerability that
	could lead to arbitrary code execution (CVE-2018-15982).</li>
	<li>This update resolves an insecure library loading vulnerability that
	could lead to privilege escalation (CVE-2018-15983).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15982</cvename>
	<cvename>CVE-2018-15983</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-42.html</url>
	</references>
	<dates>
	<discovery>2018-12-05</discovery>
	<entry>2018-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="3aa27226-f86f-11e8-a085-3497f683cb16">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.154</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.138.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-12-05/">
	<h1>Description</h1>
	<h5>(Critical) SECURITY-595</h5>
	<p>Code execution through crafted URLs</p>
	<h5>(Medium) SECURITY-904</h5>
	<p>Forced migration of user records</p>
	<h5>(Medium) SECURITY-1072</h5>
	<p>Workspace browser allowed accessing files outside the workspace</p>
	<h5>(Medium) SECURITY-1193</h5>
	<p>Potential denial of service through cron expression form validation</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2018-12-05/</url>
	</references>
	<dates>
	<discovery>2018-12-05</discovery>
	<entry>2018-12-05</entry>
	</dates>
	</vuln>

	<vuln vid="889e35f4-f6a0-11e8-82dc-fcaa147e860e">
	<topic>moodle -- Login CSRF vulnerability</topic>
	<affects>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.15</lt></range>
	</package>
	<package>
	<name>moodle33</name>
	<range><lt>3.3.9</lt></range>
	</package>
	<package>
	<name>moodle34</name>
	<range><lt>3.4.6</lt></range>
	</package>
	<package>
	<name>moodle35</name>
	<range><lt>3.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>moodle reports:</p>
	<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=378731">
	<p>The login form is not protected by a token to prevent login cross-site
	request forgery.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-16854</cvename>
	<url>https://moodle.org/mod/forum/discuss.php?d=378731</url>
	</references>
	<dates>
	<discovery>2018-11-06</discovery>
	<entry>2018-12-03</entry>
	</dates>
	</vuln>

	<vuln vid="f96044a2-7df9-414b-9f6b-6e5b85d06c86">
	<topic>Rails -- Active Job vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-activejob4</name>
	<range><lt>4.2.11</lt></range>
	</package>
	<package>
	<name>rubygem-activejob5</name>
	<range><lt>5.1.6.1</lt></range>
	</package>
	<package>
	<name>rubygem-activejob50</name>
	<range><lt>5.0.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails blog:</p>
	<blockquote cite="https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/">
	<p>Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These
	contain the following important security fixes, and it is recommended
	that users upgrade as soon as possible</p>
	<p>CVE-2018-16476 Broken Access Control vulnerability in Active Job:
	Carefully crafted user input can cause Active Job to deserialize it
	using GlobalId and allow an attacker to have access to information that
	they should not have.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/</url>
	<cvename>CVE-2018-16476</cvename>
	</references>
	<dates>
	<discovery>2018-11-27</discovery>
	<entry>2018-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="3563fae5-f60c-11e8-b513-5404a68ad561">
	<topic>uriparser -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>uriparser</name>
	<range><lt>0.9.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The upstream project reports:</p>
	<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog">
	<p>* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx*
	Commit 864f5d4c127def386dd5cc926ad96934b297f04e
	Thanks to Google Autofuzz team for the report!</p>
	<p>* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
	Commit f76275d4a91b28d687250525d3a0c5509bbd666f
	Thanks to Google Autofuzz team for the report!</p>
	<p>* Fixed: Protect uriResetUri* against acting on NULL input
	Commit f58c25069cf4a986fe17a80c5b38687e31feb539</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-19198</cvename>
	<cvename>CVE-2018-19199</cvename>
	<cvename>CVE-2018-19200</cvename>
	<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog</url>
	</references>
	<dates>
	<discovery>2018-10-27</discovery>
	<entry>2018-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="c7b1af20-f34f-11e8-9cde-e0d55e2a8bf9">
	<topic>messagelib -- HTML email can open browser window automatically</topic>
	<affects>
	<package>
	<name>messagelib</name>
	<range><lt>18.08.3_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Astals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20181128-1.txt">
	<p>messagelib is the library used by KMail to display emails.</p>
	<p>messagelib by default displays emails as plain text, but gives the user
	an option to "Prefer HTML to plain text" in the settings and if that option
	is not enabled there is way to enable HTML display when an email contains HTML.</p>
	<p>Some HTML emails can trick messagelib into opening a new browser window when
	displaying said email as HTML.</p>
	<p>This happens even if the option to allow the HTML emails to access
	remote servers is disabled in KMail settings.</p>
	<p>This means that the owners of the servers referred in the email can see
	in their access logs your IP address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-19516</cvename>
	<url>https://www.kde.org/info/security/advisory-20181128-1.txt</url>
	</references>
	<dates>
	<discovery>2018-11-28</discovery>
	<entry>2018-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="93f8e0ff-f33d-11e8-be46-0019dbb15b3f">
	<topic>payara -- Default typing issue in Jackson Databind</topic>
	<affects>
	<package>
	<name>payara</name>
	<range><eq>4.1.2.181.3</eq></range>
	<range><eq>4.1.2.182</eq></range>
	<range><eq>5.181.3</eq></range>
	<range><eq>5.182</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489">
	<p>FasterXML jackson-databind before 2.8.11.1 and 2.9.x before
	2.9.5 allows unauthenticated remote code execution because of
	an incomplete fix for the CVE-2017-7525 deserialization flaw.
	This is exploitable by sending maliciously crafted JSON input
	to the readValue method of the ObjectMapper, bypassing a
	blacklist that is ineffective if the c3p0 libraries are
	available in the classpath.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489</url>
	<cvename>CVE-2018-7489</cvename>
	</references>
	<dates>
	<discovery>2018-02-26</discovery>
	<entry>2018-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="22bc5327-f33f-11e8-be46-0019dbb15b3f">
	<topic>payara -- Code execution via crafted PUT requests to JSPs</topic>
	<affects>
	<package>
	<name>payara</name>
	<range><eq>4.1.2.174</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615">
	<p>When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP
	PUTs enabled (e.g. via setting the readonly initialisation
	parameter of the Default to false) it was possible to upload a
	JSP file to the server via a specially crafted request. This
	JSP could then be requested and any code it contained would be
	executed by the server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615</url>
	<cvename>CVE-2017-12615</cvename>
	</references>
	<dates>
	<discovery>2017-08-07</discovery>
	<entry>2018-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="d70c9e18-f340-11e8-be46-0019dbb15b3f">
	<topic>payara -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>payara</name>
	<range><eq>4.1.2.173</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031">
	<p>Apache Commons FileUpload before 1.3.3
	DiskFileItem File Manipulation Remote Code Execution.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239">
	<p>Vulnerability in the Oracle GlassFish Server component of
	Oracle Fusion Middleware (subcomponent: Administration).
	Supported versions that are affected are 3.0.1 and 3.1.2.
	Easily exploitable vulnerability allows low privileged attacker
	with logon to the infrastructure where Oracle GlassFish Server
	executes to compromise Oracle GlassFish Server. Successful
	attacks of this vulnerability can result in unauthorized read
	access to a subset of Oracle GlassFish Server accessible data.
	CVSS v3.0 Base Score 3.3 (Confidentiality impacts).</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247">
	<p>Vulnerability in the Oracle GlassFish Server component of Oracle
	Fusion Middleware (subcomponent: Core). Supported versions that
	are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
	vulnerability allows unauthenticated attacker with network access
	via SMTP to compromise Oracle GlassFish Server. Successful
	attacks require human interaction from a person other than the
	attacker. Successful attacks of this vulnerability can result in
	unauthorized update, insert or delete access to some of Oracle
	GlassFish Server accessible data. CVSS v3.0 Base Score 4.3
	(Integrity impacts).</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249">
	<p>Vulnerability in the Oracle GlassFish Server component of
	Oracle Fusion Middleware (subcomponent: Security). Supported
	versions that are affected are 2.1.1, 3.0.1 and 3.1.2.
	Easily exploitable vulnerability allows unauthenticated attacker
	with network access via LDAP to compromise Oracle GlassFish Server.
	Successful attacks of this vulnerability can result in unauthorized
	update, insert or delete access to some of Oracle GlassFish Server
	accessible data as well as unauthorized read access to a subset of
	Oracle GlassFish Server accessible data and unauthorized ability
	to cause a partial denial of service (partial DOS) of Oracle
	GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality,
	Integrity and Availability impacts).</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250">
	<p>Vulnerability in the Oracle GlassFish Server component of Oracle
	Fusion Middleware (subcomponent: Security). Supported versions that
	are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
	vulnerability allows unauthenticated attacker with network access
	via HTTP to compromise Oracle GlassFish Server. Successful attacks
	of this vulnerability can result in unauthorized update, insert or
	delete access to some of Oracle GlassFish Server accessible data as
	well as unauthorized read access to a subset of Oracle GlassFish
	Server accessible data and unauthorized ability to cause a partial
	denial of service (partial DOS) of Oracle GlassFish Server.
	CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and
	Availability impacts).</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528">
	<p>Vulnerability in the Oracle GlassFish Server component of Oracle
	Fusion Middleware (subcomponent: Security). Supported versions that
	are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit
	vulnerability allows unauthenticated attacker with network access
	via multiple protocols to compromise Oracle GlassFish Server. While
	the vulnerability is in Oracle GlassFish Server, attacks may
	significantly impact additional products. Successful attacks of this
	vulnerability can result in takeover of Oracle GlassFish Server.
	CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and
	Availability impacts).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031</url>
	<cvename>CVE-2016-1000031</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239</url>
	<cvename>CVE-2017-3239</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247</url>
	<cvename>CVE-2017-3247</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249</url>
	<cvename>CVE-2017-3249</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250</url>
	<cvename>CVE-2017-3250</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528</url>
	<cvename>CVE-2016-5528</cvename>
	</references>
	<dates>
	<discovery>2016-06-16</discovery>
	<entry>2018-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="8a4aba2d-f33e-11e8-9416-001b217b3468">
	<topic>Gitlab -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.1</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.8</lt></range>
	<range><ge>0</ge><lt>11.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released">
	<p>View Names of Private Groups</p>
	<p>Persistent XSS in Environments</p>
	<p>SSRF in Prometheus integration</p>
	<p>Unauthorized Promotion of Milestones</p>
	<p>Exposure of Confidential Issue Title</p>
	<p>Persisent XSS in Markdown Fields via Mermaid Script</p>
	<p>Persistent XSS in Markdown Fields via Unrecognized HTML Tags</p>
	<p>Symlink Race Condition in Pages</p>
	<p>Unauthorized Changes by Guest User in Issues</p>
	<p>Unauthorized Comments on Locked Issues</p>
	<p>Improper Enforcement of Token Scope</p>
	<p>CRLF Injection in Project Mirroring</p>
	<p>XSS in OAuth Authorization</p>
	<p>SSRF in Webhooks</p>
	<p>Send Email on Email Address Change</p>
	<p>Workhorse Logs Contained Tokens</p>
	<p>Unauthorized Publishing of Draft Comments</p>
	<p>Guest Can Set Weight of a New Issue</p>
	<p>Disclosure of Private Group's Members and Milestones</p>
	<p>Persisent XSS in Operations</p>
	<p>Reporter Can View Operations Page</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/</url>
	<cvename>CVE-2018-19494</cvename>
	<cvename>CVE-2018-19493</cvename>
	<cvename>CVE-2018-19495</cvename>
	<cvename>CVE-2018-19496</cvename>
	<cvename>CVE-2018-19577</cvename>
	<cvename>CVE-2018-19573</cvename>
	<cvename>CVE-2018-19570</cvename>
	<cvename>CVE-2018-19572</cvename>
	<cvename>CVE-2018-19576</cvename>
	<cvename>CVE-2018-19575</cvename>
	<cvename>CVE-2018-19569</cvename>
	<cvename>CVE-2018-19585</cvename>
	<cvename>CVE-2018-19574</cvename>
	<cvename>CVE-2018-19571</cvename>
	<cvename>CVE-2018-19580</cvename>
	<cvename>CVE-2018-19583</cvename>
	<cvename>CVE-2018-19582</cvename>
	<cvename>CVE-2018-19581</cvename>
	<cvename>CVE-2018-19584</cvename>
	<cvename>CVE-2018-19579</cvename>
	<cvename>CVE-2018-19578</cvename>
	</references>
	<dates>
	<discovery>2018-11-28</discovery>
	<entry>2018-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="54976998-f248-11e8-81e2-005056a311d1">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba46</name>
	<range><le>4.6.16</le></range>
	</package>
	<package>
	<name>samba47</name>
	<range><lt>4.7.12</lt></range>
	</package>
	<package>
	<name>samba48</name>
	<range><lt>4.8.7</lt></range>
	</package>
	<package>
	<name>samba49</name>
	<range><lt>4.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The samba project reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-14629.html">
	<p>All versions of Samba from 4.0.0 onwards are vulnerable to infinite
	query recursion caused by CNAME loops. Any dns record can be added via
	ldap by an unprivileged user using the ldbadd tool, so this is a
	security issue.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16841.html">
	<p>When configured to accept smart-card authentication, Samba's KDC will call
	talloc_free() twice on the same memory if the principal in a validly signed
	certificate does not match the principal in the AS-REQ.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16851.html">
	<p>During the processing of an LDAP search before Samba's AD DC returns
	the LDAP entries to the client, the entries are cached in a single
	memory object with a maximum size of 256MB. When this size is
	reached, the Samba process providing the LDAP service will follow the
	NULL pointer, terminating the process.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16852.html">
	<p>During the processing of an DNS zone in the DNS management DCE/RPC server,
	the internal DNS server or the Samba DLZ plugin for BIND9, if the
	DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS
	property is set, the server will follow a NULL pointer and terminate</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16853.html">
	<p>A user in a Samba AD domain can crash the KDC when Samba is built in the
	non-default MIT Kerberos configuration.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16857.html">
	<p>AD DC Configurations watching for bad passwords (to restrict brute forcing
	of passwords) in a window of more than 3 minutes may not watch for bad
	passwords at all.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.samba.org/samba/security/CVE-2018-14629.html</url>
	<cvename>CVE-2018-14629</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-16841.html</url>
	<cvename>CVE-2018-16841</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-16851.html</url>
	<cvename>CVE-2018-16851</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-16852.html</url>
	<cvename>CVE-2018-16852</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-16853.html</url>
	<cvename>CVE-2018-16853</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-16857.html</url>
	<cvename>CVE-2018-16857</cvename>
	</references>
	<dates>
	<discovery>2018-08-14</discovery>
	<entry>2018-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="ec49f6b5-ee39-11e8-b2f4-74d435b63d51">
	<topic>php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter</topic>
	<affects>
	<package>
	<name>php56-imap</name>
	<range><lt>5.6.38_1</lt></range>
	</package>
	<package>
	<name>php70-imap</name>
	<range><lt>*</lt></range>
	</package>
	<package>
	<name>php71-imap</name>
	<range><lt>*</lt></range>
	</package>
	<package>
	<name>php72-imap</name>
	<range><lt>*</lt></range>
	</package>
	<package>
	<name>php73-imap</name>
	<range><lt>*</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP team reports:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=77153">
	<p>imap_open allows to run arbitrary shell commands via mailbox parameter.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=77153</url>
	</references>
	<dates>
	<discovery>2018-10-23</discovery>
	<entry>2018-11-22</entry>
	<modified>2018-11-22</modified>
	</dates>
	</vuln>

	<vuln vid="b036faba-edd8-11e8-b3b7-00e04c1ea73d">
	<topic>phpmailer -- Multiple vulnerability</topic>
	<affects>
	<package>
	<name>phpmailer</name>
	<range><lt>5.2.27</lt></range>
	</package>
	<package>
	<name>phpmailer6</name>
	<range><lt>6.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SO-AND-SO reports:</p>
	<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6">
	<p>CVE-2018-19296:Fix potential object injection vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27</url>
	<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6</url>
	<cvename>CVE-2018-19296</cvename>
	</references>
	<dates>
	<discovery>2018-11-16</discovery>
	<entry>2018-11-21</entry>
	<modified>2018-11-23</modified>
	</dates>
	</vuln>

	<vuln vid="8f128c72-ecf9-11e8-aa00-6451062f0f7a">
	<topic>Flash Player -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>31.0.0.153</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-44.html">
	<ul>
	<li>This update resolves a type confusion vulnerability that
	could lead to arbitrary code execution (CVE-2018-15981).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15981</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-44.html</url>
	</references>
	<dates>
	<discovery>2018-11-20</discovery>
	<entry>2018-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="d889d32c-ecd9-11e8-9416-001b217b3468">
	<topic>Gitlab -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.4.0</ge><lt>11.4.6</lt></range>
	<range><ge>8.9.0</ge><lt>11.3.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/">
	<p>Persistent XSS Autocompletion</p>
	<p>Unauthorized service template creation</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/</url>
	<cvename>CVE-2018-18643</cvename>
	<cvename>CVE-2018-19359</cvename>
	</references>
	<dates>
	<discovery>2018-11-19</discovery>
	<entry>2018-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="0aee2f13-ec1d-11e8-8c92-6805ca2fa271">
	<topic>powerdns -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>powerdns</name>
	<range><lt>4.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS Team reports:</p>
	<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html">
	<p>CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing
	an authorized user to cause a memory leak by inserting a specially crafted record
	in a zone under their control, then sending a DNS query for that record. The issue
	is due to the fact that some memory is allocated before the parsing and is not
	always properly released if the record is malformed. When the PowerDNS
	Authoritative Server is run inside the guardian (--guardian), or inside a
	supervisor like supervisord or systemd, an out-of-memory crash will lead to an
	automatic restart, limiting the impact to a somewhat degraded service.</p>
	<p>CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing
	a remote user to craft a DNS query that will cause an answer without DNSSEC
	records to be inserted into the packet cache and be returned to clients asking for
	DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname
	and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients
	will consider the answer to be bogus until it expires from the packet cache,
	leading to a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://doc.powerdns.com/authoritative/changelog/4.1.html</url>
	<cvename>CVE-2018-10851</cvename>
	<cvename>CVE-2018-14626</cvename>
	</references>
	<dates>
	<discovery>2018-11-06</discovery>
	<entry>2018-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="e9aa0e4c-ea8b-11e8-a5b7-00e04c1ea73d">
	<topic>powerdns-recursor -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>4.1.7</lt></range>
	</package>
	<package>
	<name>powerdns-recursor40</name>
	<range><lt>4.0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>powerdns Team reports:</p>
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
	<p>CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing
	a malicious authoritative server to cause a memory leak by sending specially
	crafted records. The issue is due to the fact that some memory is allocated
	before the parsing and is not always properly released if the record is malformed.
	When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd,
	an out-of-memory crash will lead to an automatic restart, limiting the impact to
	a somewhat degraded service.</p>
	<p>CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote
	user to craft a DNS query that will cause an answer without DNSSEC records to be
	inserted into the packet cache and be returned to clients asking for DNSSEC
	records, thus hiding the presence of DNSSEC signatures for a specific qname and
	qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC
	validation by themselves might consider the answer to be bogus until it expires
	from the packet cache, leading to a denial of service.</p>
	<p>CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker
	sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached
	as failing DNSSEC validation. It only arises if the parent zone is signed, and all
	the authoritative servers for that parent zone answer with FORMERR to a query for at
	least one of the meta-types. As a result, subsequent queries from clients requesting
	DNSSEC validation will be answered with a ServFail.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
	<cvename>CVE-2018-10851</cvename>
	<cvename>CVE-2018-14626</cvename>
	<cvename>CVE-2018-14644</cvename>
	</references>
	<dates>
	<discovery>2018-11-06</discovery>
	<entry>2018-11-17</entry>
	<modified>2018-11-19</modified>
	</dates>
	</vuln>

	<vuln vid="c6fb2734-e835-11e8-b14b-001999f8d30b">
	<topic>asterisk -- Remote crash vulnerability DNS SRV and NAPTR lookups</topic>
	<affects>
	<package>
	<name>asterisk15</name>
	<range><lt>15.6.1</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><lt>16.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>There is a buffer overflow vulnerability in dns_srv
	and dns_naptr functions of Asterisk that allows an attacker
	to crash Asterisk via a specially crafted DNS SRV or NAPTR
	response. The attackers request causes Asterisk to segfault
	and crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-010.html</url>
	</references>
	<dates>
	<discovery>2018-10-23</discovery>
	<entry>2018-11-14</entry>
	</dates>
	</vuln>

	<vuln vid="b69292e8-e798-11e8-ae07-6451062f0f7a">
	<topic>Flash Player -- information disclosure</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>31.0.0.148</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-39.html">
	<ul>
	<li>This update resolves a out-of-bounds vulnerability that
	could lead to information disclosure (CVE-2018-15978).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15978</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-39.html</url>
	</references>
	<dates>
	<discovery>2018-11-13</discovery>
	<entry>2018-11-13</entry>
	</dates>
	</vuln>

	<vuln vid="6f170cf2-e6b7-11e8-a9a8-b499baebfeaf">
	<topic>OpenSSL -- timing vulnerability</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2p_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20181112.txt">
	<p>Microarchitecture timing vulnerability in ECC scalar
	multiplication. Severity: Low<br/>
	OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has
	been shown to be vulnerable to a microarchitecture timing side channel
	attack. An attacker with sufficient access to mount local timing
	attacks during ECDSA signature generation could recover the private
	key.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20181112.txt</url>
	<cvename>CVE-2018-5407</cvename>
	</references>
	<dates>
	<discovery>2018-11-12</discovery>
	<entry>2018-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="1460aa25-e6ab-11e8-a733-e0d55e2a8bf9">
	<topic>kio-extras -- HTML Thumbnailer automatic remote file access</topic>
	<affects>
	<package>
	<name>kio-extras</name>
	<range><lt>18.08.3_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Astals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20181012-1.txt">
	<p>Various KDE applications share a plugin system to create thumbnails
	of various file types for displaying in file managers, file dialogs, etc.
	kio-extras contains a thumbnailer plugin for HTML files.
	</p>
	<p>
	The HTML thumbnailer was incorrectly accessing some content of
	remote URLs listed in HTML files. This meant that the owners of the servers
	referred in HTML files in your system could have seen in their access logs
	your IP address every time the thumbnailer tried to create the thumbnail.
	</p>
	<p>
	The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0
	because it was actually not creating thumbnails for files at all.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-19120</cvename>
	<url>https://www.kde.org/info/security/advisory-20181012-1.txt</url>
	</references>
	<dates>
	<discovery>2018-11-12</discovery>
	<entry>2018-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="791841a3-d484-4878-8909-92ef9ce424f4">
	<topic>patch -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>patch</name>
	<range><lt>2.7.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6951">
	<p>An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6952">
	<p>A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000156">
	<p>GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6951</cvename>
	<cvename>CVE-2018-6952</cvename>
	<cvename>CVE-2018-1000156</cvename>
	<url>https://savannah.gnu.org/bugs/?53132</url>
	<url>https://savannah.gnu.org/bugs/?53133</url>
	<url>https://savannah.gnu.org/bugs/?53566</url>
	</references>
	<dates>
	<discovery>2018-04-16</discovery>
	<entry>2018-11-11</entry>
	<modified>2018-11-11</modified>
	</dates>
	</vuln>

	<vuln vid="92a6efd0-e40d-11e8-ada4-408d5cf35399">
	<topic>lighttpd - use-after-free vulnerabilities</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.51</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Lighttpd Project reports:</p>
	<blockquote cite="https://www.lighttpd.net/2018/10/14/1.4.51/">
	<p>Security fixes for Lighttpd:</p>
	<ul>
	<li><p>security: process headers after combining folded headers</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.lighttpd.net/2018/10/14/1.4.51/</url>
	<freebsdpr>ports/232278</freebsdpr>
	</references>
	<dates>
	<discovery>2018-08-26</discovery>
	<entry>2018-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="1c27a706-e3aa-11e8-b77a-6cc21735f730">
	<topic>PostgreSQL -- SQL injection in pg_upgrade and pg_dump</topic>
	<affects>
	<package>
	<name>postgresql10-server</name>
	<range><lt>10.6</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><lt>9.6.11</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><lt>9.5.15</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><lt>9.4.20</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><lt>9.3.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/1878/">
	<p>CVE-2018-16850: SQL injection in pg_upgrade and pg_dump,
	via CREATE TRIGGER ... REFERENCING.</p>
	<p>Using a purpose-crafted trigger definition, an attacker can run
	arbitrary SQL statements with superuser privileges when a superuser
	runs pg_upgrade on the database or during a pg_dump dump/restore
	cycle. This attack requires a CREATE privilege on some non-temporary
	schema or a TRIGGER privilege on a table. This is exploitable in the
	default PostgreSQL configuration, where all users have CREATE
	privilege on public schema.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.postgresql.org/about/news/1905/</url>
	<cvename>CVE-2018-16850</cvename>
	</references>
	<dates>
	<discovery>2018-11-08</discovery>
	<entry>2018-11-08</entry>
	</dates>
	</vuln>

	<vuln vid="84ca56be-e1de-11e8-bcfd-00e04c1ea73d">
	<topic>NGINX -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><lt>1.14.1</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><lt>1.15.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NGINX Team reports:</p>
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	<p>Two security issues were identified in nginx HTTP/2 implementation,
	which might cause excessive memory consumption (CVE-2018-16843)
	and CPU usage (CVE-2018-16844).</p>
	<p>The issues affect nginx compiled with the ngx_http_v2_module (not
	compiled by default) if the "http2" option of the "listen" directive is
	used in a configuration file.</p>
	<p>A security issue was identified in the ngx_http_mp4_module, which might
	allow an attacker to cause infinite loop in a worker process, cause a
	worker process crash, or might result in worker process memory
	isclosure by using a specially crafted mp4 file (CVE-2018-16845).</p>
	<p>The issue only affects nginx if it is built with the ngx_http_mp4_module
	(the module is not built by default) and the "mp4" directive is used in
	the configuration file. Further, the attack is only possible if an
	attacker is able to trigger processing of a specially crafted mp4 file
	with the ngx_http_mp4_module. </p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://nginx.org/en/security_advisories.html</url>
	<cvename>CVE-2018-16843</cvename>
	<cvename>CVE-2018-16844</cvename>
	<cvename>CVE-2018-16845</cvename>
	</references>
	<dates>
	<discovery>2018-11-06</discovery>
	<entry>2018-11-06</entry>
	</dates>
	</vuln>

	<vuln vid="deb4f633-de1d-11e8-a9fb-080027f43a02">
	<topic>gitea -- remote code exeution</topic>
	<affects>
	<package>
	<name>gitea</name>
	<range><lt>1.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Gitea project reports:</p>
	<blockquote cite="https://blog.gitea.io/2018/10/gitea-1.5.3-is-released/">
	<p>[This release] contains crit[i]cal security fix for vulnerability
	that could potentially allow for authorized users to do remote code
	ex[e]cution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/go-gitea/gitea/pull/5177</url>
	<url>https://github.com/go-gitea/gitea/pull/5196</url>
	<url>https://github.com/go-macaron/session/commit/084f1e5c1071f585902a7552b483cee04bc00a14</url>
	</references>
	<dates>
	<discovery>2018-10-25</discovery>
	<entry>2018-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="e0ab1773-07c1-46c6-9170-4c5e81c00927">
	<topic>curl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.14.1</ge><lt>7.60.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>curl security problems:</p>
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	<p>CVE-2018-16839: SASL password overflow via integer overflow</p>
	<p>libcurl contains a buffer overrun in the SASL authentication code.</p>
	<p>The internal function Curl_auth_create_plain_message fails to
	correctly verify that the passed in lengths for name and password
	aren't too long, then calculates a buffer size to allocate.</p>
	<p>On systems with a 32 bit size_t, the math to calculate the buffer size
	triggers an integer overflow when the user name length exceeds 2GB
	(2^31 bytes). This integer overflow usually causes a very small buffer
	to actually get allocated instead of the intended very huge one, making
	the use of that buffer end up in a heap buffer overflow.</p>
	<p>This bug is very similar to CVE-2017-14618.</p>
	<p>It affects curl 7.33.0 to 7.61.1.</p>
	<p>CVE-2018-16840: use-after-free in handle close</p>
	<p>libcurl contains a heap use-after-free flaw in code related to closing
	an easy handle.</p>
	<p>When closing and cleaning up an "easy" handle in the Curl_close()
	function, the library code first frees a struct (without nulling the
	pointer) and might then subsequently erroneously write to a struct
	field within that already freed struct.</p>
	<p>It affects curl 7.59.0 to 7.61.1.</p>
	<p>CVE-2018-16842: warning message out-of-buffer read</p>
	<p>curl contains a heap out of buffer read vulnerability.</p>
	<p>The command line tool has a generic function for displaying warning
	and informational messages to stderr for various situations. For
	example if an unknown command line argument is used, or passed to it in
	a "config" file.</p>
	<p>This display function formats the output to wrap at 80 columns. The
	wrap logic is however flawed, so if a single word in the message is
	itself longer than 80 bytes the buffer arithmetic calculates the
	remainder wrong and will end up reading behind the end of the buffer.
	This could lead to information disclosure or crash.</p>
	<p>This vulnerability could lead to a security issue if used in this or
	similar situations:</p>
	<p>1. a server somewhere uses the curl command line to run something</p>
	<p>2. if it fails, it shows stderr to the user</p>
	<p>3. the server takes user input for parts of its command line input</p>
	<p>4. user provides something overly long that triggers this crash</p>
	<p>5. the stderr output may now contain user memory contents that wasn't
	meant to be available</p>
	<p>It affects curl 7.14.1 to 7.61.1.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/security.html</url>
	<url>https://curl.haxx.se/docs/CVE-2018-16839.html</url>
	<url>https://curl.haxx.se/docs/CVE-2018-16840.html</url>
	<url>https://curl.haxx.se/docs/CVE-2018-16842.html</url>
	<cvename>CVE-2018-16839</cvename>
	<cvename>CVE-2018-16840</cvename>
	<cvename>CVE-2018-16842</cvename>
	</references>
	<dates>
	<discovery>2018-10-31</discovery>
	<entry>2018-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="b51d9e83-de08-11e8-9416-001b217b3468">
	<topic>Gitlab -- SSRF in Kubernetes integration</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.4.0</ge><lt>11.4.4</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.9</lt></range>
	<range><ge>11.0.0</ge><lt>11.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SO-AND-SO reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/">
	<p>SSRF in Kubernetes integration</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/</url>
	<cvename>CVE-2018-18843</cvename>
	</references>
	<dates>
	<discovery>2018-11-01</discovery>
	<entry>2018-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="36a2a89e-7ee1-4ea4-ae22-7ca38019c8d0">
	<topic>Loofah -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-loofah</name>
	<range><lt>2.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitHub issue:</p>
	<blockquote cite="https://github.com/flavorjones/loofah/issues/154">
	<p>This issue has been created for public disclosure of an XSS
	vulnerability that was responsibly reported (independently) by Shubham
	Pathak and @yasinS (Yasin Soliman).</p>
	<p>In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
	sanitized output when a crafted SVG element is republished.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/flavorjones/loofah/releases</url>
	<url>https://github.com/flavorjones/loofah/issues/154</url>
	<cvename>CVE-2018-16468</cvename>
	</references>
	<dates>
	<discovery>2018-10-30</discovery>
	<entry>2018-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="b9591212-dba7-11e8-9416-001b217b3468">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.4.0</ge><lt>11.4.3</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.8</lt></range>
	<range><ge>5.3.0</ge><lt>11.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/">
	<p>RCE in Gitlab Wiki API</p>
	<p>SSRF in Hipchat integration</p>
	<p>Cleartext storage of personal access tokens</p>
	<p>Information exposure through stack trace error message</p>
	<p>Persistent XSS autocomplete</p>
	<p>Information exposure in stored browser history</p>
	<p>Information exposure when replying to issues through email</p>
	<p>Persistent XSS in License Management and Security Reports</p>
	<p>Metrics information disclosure in Prometheus integration</p>
	<p>Unauthorized changes to a protected branch's access levels</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/</url>
	<cvename>CVE-2018-18649</cvename>
	<cvename>CVE-2018-18646</cvename>
	<cvename>CVE-2018-18641</cvename>
	<cvename>CVE-2018-18648</cvename>
	<cvename>CVE-2018-18643</cvename>
	<cvename>CVE-2018-18640</cvename>
	<cvename>CVE-2018-18645</cvename>
	<cvename>CVE-2018-18642</cvename>
	<cvename>CVE-2018-18644</cvename>
	<cvename>CVE-2018-18647</cvename>
	</references>
	<dates>
	<discovery>2018-10-29</discovery>
	<entry>2018-10-29</entry>
	</dates>
	</vuln>

	<vuln vid="238ae7de-dba2-11e8-b713-b499baebfeaf">
	<topic>OpenSSL -- Multiple vulnerabilities in 1.1 branch</topic>
	<affects>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0i_1</lt></range>
	</package>
	<package>
	<name>openssl111</name>
	<range><lt>1.1.1_2</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
	</package>
	<package>
	<name>libressl-devel</name>
	<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20181029.txt">
	<p>Timing vulnerability in ECDSA signature generation
	(CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been
	shown to be vulnerable to a timing side channel attack. An
	attacker could use variations in the signing algorithm to
	recover the private key (Low).</p>
	<p>Timing vulnerability in DSA signature generation (CVE-2018-0734):
	Avoid a timing attack that leaks information via a side channel
	that triggers when a BN is resized. Increasing the size of the
	BNs prior to doing anything with them suppresses the attack (Low).
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20181029.txt</url>
	<url>https://github.com/openssl/openssl/commit/8abfe72e</url>
	<cvename>CVE-2018-0735</cvename>
	<cvename>CVE-2018-0734</cvename>
	</references>
	<dates>
	<discovery>2018-10-29</discovery>
	<entry>2018-10-29</entry>
	<modified>2018-11-10</modified>
	</dates>
	</vuln>

	<vuln vid="fa194483-dabd-11e8-bf39-5404a68ad561">
	<topic>liveMedia -- potential remote code execution</topic>
	<affects>
	<package>
	<name>liveMedia</name>
	<range><lt>2018.10.17,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos reports:</p>
	<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684">
	<p>An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality
	of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer
	overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4013</cvename>
	<url>https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684</url>
	<url>http://lists.live555.com/pipermail/live-devel/2018-October/021071.html</url>
	</references>
	<dates>
	<discovery>2018-10-18</discovery>
	<entry>2018-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="33c384f3-5af6-4662-9741-0acb21c7e499">
	<topic>mini_httpd -- disclose arbitrary files is some circumstances</topic>
	<affects>
	<package>
	<name>mini_httpd</name>
	<range><lt>1.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jef Poskanzer reports:</p>
	<blockquote cite="http://acme.com/updates/archive/211.html">
	<p>Prior versions allowed remote users to read arbitrary files in some circumstances.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://acme.com/updates/archive/211.html</url>
	</references>
	<dates>
	<discovery>2018-10-26</discovery>
	<entry>2018-10-26</entry>
	</dates>
	</vuln>

	<vuln vid="4f7c6af3-6a2c-4ead-8453-04e509688d45">
	<topic>salt -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<name>py37-salt</name>
	<range><lt>2017.7.8</lt></range>
	<range><ge>2018.3.0</ge><lt>2018.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SaltStack reports:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html">
	<p>Remote command execution and incorrect access control when using
	salt-api.</p>
	<p>Directory traversal vulnerability when using salt-api. Allows an
	attacker to determine what files exist on a server when querying
	/run or /events.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15751</cvename>
	<cvename>CVE-2018-15750</cvename>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html</url>
	<url>https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html</url>
	</references>
	<dates>
	<discovery>2018-10-24</discovery>
	<entry>2018-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="7c3a02b9-3273-4426-a0ba-f90fad2ff72e">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>63.0_1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.2.5</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.5</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>60.3.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>60.3.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/">
	<p>CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin</p>
	<p>CVE-2018-12392: Crash with nested event loops</p>
	<p>CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript</p>
	<p>CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting</p>
	<p>CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts</p>
	<p>CVE-2018-12397:</p>
	<p>CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs</p>
	<p>CVE-2018-12399: Spoofing of protocol registration notification bar</p>
	<p>CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android</p>
	<p>CVE-2018-12401: DOS attack through special resource URI parsing</p>
	<p>CVE-2018-12402: SameSite cookies leak when pages are explicitly saved</p>
	<p>CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP</p>
	<p>CVE-2018-12388: Memory safety bugs fixed in Firefox 63</p>
	<p>CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-12388</cvename>
	<cvename>CVE-2018-12390</cvename>
	<cvename>CVE-2018-12391</cvename>
	<cvename>CVE-2018-12392</cvename>
	<cvename>CVE-2018-12393</cvename>
	<cvename>CVE-2018-12395</cvename>
	<cvename>CVE-2018-12396</cvename>
	<cvename>CVE-2018-12397</cvename>
	<cvename>CVE-2018-12398</cvename>
	<cvename>CVE-2018-12399</cvename>
	<cvename>CVE-2018-12400</cvename>
	<cvename>CVE-2018-12401</cvename>
	<cvename>CVE-2018-12402</cvename>
	<cvename>CVE-2018-12403</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/</url>
	</references>
	<dates>
	<discovery>2018-10-23</discovery>
	<entry>2018-10-23</entry>
	</dates>
	</vuln>

	<vuln vid="140a14b5-d615-11e8-b3cb-00e04c1ea73d">
	<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.60</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><lt>8.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2018-006">
	<p>he path module allows users with the 'administer paths' to create pretty URLs
	for content. In certain circumstances the user can enter a particular path that
	triggers an open redirect to a malicious url.The issue is mitigated by the fact
	that the user needs the administer paths permission to exploit.</p>
	<p>When sending email some variables were not being sanitized for shell arguments,
	which could lead to remote code execution. </p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.drupal.org/SA-CORE-2018-006</url>
	</references>
	<dates>
	<discovery>2018-10-17</discovery>
	<entry>2018-10-22</entry>
	<modified>2018-11-04</modified>
	</dates>
	</vuln>

	<vuln vid="afc60484-0652-440e-b01a-5ef814747f06">
	<topic>ruby -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>2.3.0,1</ge><lt>2.3.8,1</lt></range>
	<range><ge>2.4.0,1</ge><lt>2.4.5,1</lt></range>
	<range><ge>2.5.0,1</ge><lt>2.5.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby news:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/">
	<p>CVE-2018-16395: OpenSSL::X509::Name equality check does not work
	correctly</p>
	<p>An instance of OpenSSL::X509::Name contains entities such as CN, C and
	so on. Some two instances of OpenSSL::X509::Name are equal only when
	all entities are exactly equal. However, there is a bug that the
	equality check is not correct if the value of an entity of the
	argument (right-hand side) starts with the value of the receiver
	(left-hand side). So, if a malicious X.509 certificate is passed to
	compare with an existing certificate, there is a possibility to be
	judged incorrectly that they are equal.</p>
	<p>CVE-2018-16396: Tainted flags are not propagated in Array#pack and
	String#unpack with some directives</p>
	<p>Array#pack method converts the receiver's contents into a string with
	specified format. If the receiver contains some tainted objects, the
	returned string also should be tainted. String#unpack method which
	converts the receiver into an array also should propagate its tainted
	flag to the objects contained in the returned array. But, with B, b, H
	and h directives, the tainted flags are not propagated. So, if a script
	processes unreliable inputs by Array#pack and/or String#unpack with
	these directives and checks the reliability with tainted flags, the
	check might be wrong.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/</url>
	<url>https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/</url>
	<url>https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/</url>
	<cvename>CVE-2018-16395</cvename>
	<cvename>CVE-2018-16396</cvename>
	</references>
	<dates>
	<discovery>2018-10-17</discovery>
	<entry>2018-10-20</entry>
	</dates>
	</vuln>

	<vuln vid="ec5072b0-d43a-11e8-a6d2-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.62</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.37</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.37</lt></range>
	</package>
	<package>
	<name>mariadb102-server</name>
	<range><lt>10.2.19</lt></range>
	</package>
	<package>
	<name>mariadb103-server</name>
	<range><lt>10.3.11</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.62</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.42</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.24</lt></range>
	</package>
	<package>
	<name>mysql80-server</name>
	<range><lt>8.0.13</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.62</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.42</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL</url>
	<cvename>CVE-2016-9843</cvename>
	<cvename>CVE-2018-3155</cvename>
	<cvename>CVE-2018-3143</cvename>
	<cvename>CVE-2018-3156</cvename>
	<cvename>CVE-2018-3251</cvename>
	<cvename>CVE-2018-3182</cvename>
	<cvename>CVE-2018-3137</cvename>
	<cvename>CVE-2018-3203</cvename>
	<cvename>CVE-2018-3133</cvename>
	<cvename>CVE-2018-3145</cvename>
	<cvename>CVE-2018-3144</cvename>
	<cvename>CVE-2018-3185</cvename>
	<cvename>CVE-2018-3195</cvename>
	<cvename>CVE-2018-3247</cvename>
	<cvename>CVE-2018-3187</cvename>
	<cvename>CVE-2018-3174</cvename>
	<cvename>CVE-2018-3171</cvename>
	<cvename>CVE-2018-3277</cvename>
	<cvename>CVE-2018-3162</cvename>
	<cvename>CVE-2018-3173</cvename>
	<cvename>CVE-2018-3200</cvename>
	<cvename>CVE-2018-3170</cvename>
	<cvename>CVE-2018-3212</cvename>
	<cvename>CVE-2018-3280</cvename>
	<cvename>CVE-2018-3186</cvename>
	<cvename>CVE-2018-3161</cvename>
	<cvename>CVE-2018-3278</cvename>
	<cvename>CVE-2018-3279</cvename>
	<cvename>CVE-2018-3282</cvename>
	<cvename>CVE-2018-3284</cvename>
	<cvename>CVE-2018-3283</cvename>
	<cvename>CVE-2018-3286</cvename>
	</references>
	<dates>
	<discovery>2018-10-16</discovery>
	<entry>2018-10-20</entry>
	<modified>2018-11-08</modified>
	</dates>
	</vuln>

	<vuln vid="44864c84-d3b8-11e8-b3cb-00e04c1ea73d">
	<topic>matomo -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>matomo</name>
	<range><lt>3.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matomo reports:</p>
	<blockquote cite="https://matomo.org/changelog/matomo-3-6-1/">
	<p>Several XSS issues have been fixed thanks to the great work of security
	researchers who responsible disclosed issues to us.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://matomo.org/changelog/matomo-3-6-1/</url>
	</references>
	<dates>
	<discovery>2018-10-18</discovery>
	<entry>2018-10-19</entry>
	</dates>
	</vuln>

	<vuln vid="2383767c-d224-11e8-9623-a4badb2f4699">
	<topic>libssh -- authentication bypass vulnerability</topic>
	<affects>
	<package>
	<name>libssh</name>
	<range><ge>0.6</ge><lt>0.7.6</lt></range>
	<range><ge>0.8</ge><lt>0.8.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>gladiac reports:</p>
	<blockquote cite="https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/">
	<p>libssh versions 0.6 and above have an authentication bypass
	vulnerability in the server code. By presenting the server an
	SSH2_MSG_USERAUTH_SUCCESS message in place of the
	SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
	initiate authentication, the attacker could successfully authentciate
	without any credentials.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/</url>
	<cvename>CVE-2018-10933</cvename>
	</references>
	<dates>
	<discovery>2018-10-16</discovery>
	<entry>2018-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="8c08ab4c-d06c-11e8-b35c-001b217b3468">
	<topic>Libgit2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libgit2</name>
	<range><lt>0.27.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Git community reports:</p>
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.5">
	<p>Multiple vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.5</url>
	<cvename>CVE-2018-17456</cvename>
	</references>
	<dates>
	<discovery>2018-10-05</discovery>
	<entry>2018-10-15</entry>
	</dates>
	</vuln>

	<vuln vid="4c11b51e-cd8d-11e8-b0cb-a0f3c100ae18">
	<topic>Memory leak bug in Toxcore</topic>
	<affects>
	<package>
	<name>toxcore</name>
	<range><lt>0.2.8,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tox project blog reports:</p>
	<blockquote cite="https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/">
	<p>A memory leak bug was discovered in Toxcore that can be triggered remotely to
	exhaust one’s system memory, resulting in a denial of service attack.
	The bug is present in the TCP Server module of Toxcore and therefore it
	affects mostly bootstrap nodes. Regular Tox clients generally have the
	TCP Server functionality disabled by default, leaving them unaffected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/</url>
	</references>
	<dates>
	<discovery>2018-09-29</discovery>
	<entry>2018-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="cb539d4e-cd68-11e8-8819-00e04c1ea73d">
	<topic>gitea -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitea</name>
	<range><lt>1.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitea project reports:</p>
	<blockquote cite="https://github.com/go-gitea/gitea/issues/4357">
	<p>CSRF Vulnerability on API.</p>
	<p>Enforce token on api routes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/go-gitea/gitea/issues/4357</url>
	<url>ttps://github.com/go-gitea/gitea/pull/4840</url>
	</references>
	<dates>
	<discovery>2018-10-01</discovery>
	<entry>2018-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="3350275d-cd5a-11e8-a7be-3497f683cb16">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.146</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.138.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-10-10/">
	<h1>Description</h1>
	<h5>(Low) SECURITY-867</h5>
	<p>Path traversal vulnerability in Stapler allowed accessing internal data</p>
	<h5>(Medium) SECURITY-1074</h5>
	<p>Arbitrary file write vulnerability using file parameter definitions</p>
	<h5>(Medium) SECURITY-1129</h5>
	<p>Reflected XSS vulnerability</p>
	<h5>(Medium) SECURITY-1162</h5>
	<p>Ephemeral user record was created on some invalid authentication attempts</p>
	<h5>(Medium) SECURITY-1128</h5>
	<p>Ephemeral user record creation</p>
	<h5>(Medium) SECURITY-1158</h5>
	<p>Session fixation vulnerability on user signup</p>
	<h5>(Medium) SECURITY-765</h5>
	<p>Failures to process form submission data could result in secrets being displayed or written to logs</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2018-10-10/</url>
	</references>
	<dates>
	<discovery>2018-10-10</discovery>
	<entry>2018-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="a4eb38ea-cc06-11e8-ada4-408d5cf35399">
	<topic>tinc -- Buffer overflow</topic>
	<affects>
	<package>
	<name>tinc</name>
	<range><lt>1.0.35</lt></range>
	</package>
	<package>
	<name>tinc-devel</name>
	<range><lt>1.1pre17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>tinc-vpn.org reports:</p>
	<blockquote cite="http://www.tinc-vpn.org/news/">
	<p>The authentication protocol allows an oracle attack that could
	potentially be exploited.</p>
	<p>If a man-in-the-middle has intercepted the TCP connection it
	might be able to force plaintext UDP packets between two nodes for up to
	a PingInterval period.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a</url>
	<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=e97943b7cc9c851ae36f5a41e2b6102faa74193f</url>
	<cvename>CVE-2018-16737</cvename>
	<cvename>CVE-2018-16738</cvename>
	<cvename>CVE-2018-16758</cvename>
	</references>
	<dates>
	<discovery>2018-10-08</discovery>
	<entry>2018-10-09</entry>
	</dates>
	</vuln>

	<vuln vid="23413442-c8ea-11e8-b35c-001b217b3468">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.3.0</ge><lt>11.3.4</lt></range>
	<range><ge>11.2.0</ge><lt>11.2.5</lt></range>
	<range><ge>10.2.0</ge><lt>11.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/">
	<p>Merge request information disclosure</p>
	<p>Private project namespace information disclosure</p>
	<p>Gitlab Flavored Markdown API information disclosure</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/</url>
	<cvename>CVE-2018-17939</cvename>
	<cvename>CVE-2018-17976</cvename>
	<cvename>CVE-2018-17975</cvename>
	</references>
	<dates>
	<discovery>2018-10-05</discovery>
	<entry>2018-10-05</entry>
	</dates>
	</vuln>

	<vuln vid="8b812395-c739-11e8-ab5b-9c5c8e75236a">
	<topic>clamav -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.100.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> Joel Esler reports:</p>
	<blockquote cite="https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html">
	<ul>
	<li>CVE-2018-15378:
	<ul>
	<li>Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.</li>
	<li>Reported by Secunia Research at Flexera.</li>
	</ul>
	</li>
	<li>Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code.
	<ul>
	<li>Reported by Alex Gaynor.</li>
	</ul>
	</li>
	<li>CVE-2018-14680:
	<ul>
	<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.</li>
	</ul>
	</li>
	<li>CVE-2018-14681:
	<ul>
	<li>An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.</li>
	</ul>
	</li>
	<li>CVE-2018-14682:
	<ul>
	<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.</li>
	</ul>
	</li>
	</ul>
	<p>.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html</url>
	<cvename>CVE-2018-15378</cvename>
	<cvename>CVE-2018-14680</cvename>
	<cvename>CVE-2018-14681</cvename>
	<cvename>CVE-2018-14682</cvename>
	</references>
	<dates>
	<discovery>2018-10-03</discovery>
	<entry>2018-10-03</entry>
	</dates>
	</vuln>

	<vuln vid="004d8c23-c710-11e8-98c7-000c29434208">
	<topic>Django -- password hash disclosure</topic>
	<affects>
	<package>
	<name>py34-django21</name>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<range><lt>2.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django release notes:</p>
	<blockquote cite="https://docs.djangoproject.com/en/2.1/releases/2.1.2/">
	<p>CVE-2018-16984: Password hash disclosure to "view only" admin users</p>
	<p>If an admin user has the change permission to the user model, only part
	of the password hash is displayed in the change form. Admin users with the
	view (but not change) permission to the user model were displayed the entire
	hash. While it's typically infeasible to reverse a strong password hash, if
	your site uses weaker password hashing algorithms such as MD5 or SHA1, it
	could be a problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://docs.djangoproject.com/en/2.1/releases/2.1.2/</url>
	<cvename>CVE-2018-16984</cvename>
	</references>
	<dates>
	<discovery>2018-10-02</discovery>
	<entry>2018-10-03</entry>
	</dates>
	</vuln>

	<vuln vid="c4f39920-781f-4aeb-b6af-17ed566c4272">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>62.0.3,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.2.4</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.5</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>60.2.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>60.2.2,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/">
	<h1>CVE-2018-12386: Type confusion in JavaScript</h1>
	<p>A vulnerability in register allocation in JavaScript can
	lead to type confusion, allowing for an arbitrary read and
	write. This leads to remote code execution inside the
	sandboxed content process when triggered.</p>
	<h1>CVE-2018-12387: </h1>
	<p>A vulnerability where the JavaScript JIT compiler inlines
	Array.prototype.push with multiple arguments that results
	in the stack pointer being off by 8 bytes after a
	bailout. This leaks a memory address to the calling
	function which can be used as part of an exploit inside
	the sandboxed content process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-12386</cvename>
	<cvename>CVE-2018-12387</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/</url>
	</references>
	<dates>
	<discovery>2018-10-02</discovery>
	<entry>2018-10-02</entry>
	</dates>
	</vuln>

	<vuln vid="065b3b72-c5ab-11e8-9ae2-001b217b3468">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.3.0</ge><lt>11.3.1</lt></range>
	<range><ge>11.2.0</ge><lt>11.2.4</lt></range>
	<range><ge>7.6.0</ge><lt>11.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/">
	<p>SSRF GCP access token disclosure</p>
	<p>Persistent XSS on issue details</p>
	<p>Diff formatter DoS in Sidekiq jobs</p>
	<p>Confidential information disclosure in events API endpoint</p>
	<p>validate_localhost function in url_blocker.rb could be bypassed</p>
	<p>Slack integration CSRF Oauth2</p>
	<p>GRPC::Unknown logging token disclosure</p>
	<p>IDOR merge request approvals</p>
	<p>Persistent XSS package.json</p>
	<p>Persistent XSS merge request project import</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/</url>
	<cvename>CVE-2018-17450</cvename>
	<cvename>CVE-2018-17454</cvename>
	<cvename>CVE-2018-15472</cvename>
	<cvename>CVE-2018-17449</cvename>
	<cvename>CVE-2018-17452</cvename>
	<cvename>CVE-2018-17451</cvename>
	<cvename>CVE-2018-17453</cvename>
	<cvename>CVE-2018-17455</cvename>
	<cvename>CVE-2018-17537</cvename>
	<cvename>CVE-2018-17536</cvename>
	</references>
	<dates>
	<discovery>2018-10-01</discovery>
	<entry>2018-10-01</entry>
	</dates>
	</vuln>

	<vuln vid="5a757a31-f98e-4bd4-8a85-f1c0f3409769">
	<topic>pango -- remote DoS vulnerability</topic>
	<affects>
	<package>
	<name>pango</name>
	<range><lt>1.42.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120">
	<p>libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120</url>
	<url>https://www.exploit-db.com/exploits/45263/</url>
	<url>https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html</url>
	<url>https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f</url>
	<cvename>CVE-2018-15120</cvename>
	</references>
	<dates>
	<discovery>2018-08-06</discovery>
	<entry>2018-10-01</entry>
	</dates>
	</vuln>

	<vuln vid="01018916-c47c-11e8-8b07-00e04c1ea73d">
	<topic>Serendipity -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>serendipity</name>
	<range><lt>2.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Serendipity reports:</p>
	<blockquote cite="https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html">
	<p>Security: Fix XSS for pagination, when multi-category selection is used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html</url>
	</references>
	<dates>
	<discovery>2018-09-20</discovery>
	<entry>2018-09-30</entry>
	</dates>
	</vuln>

	<vuln vid="40a844bf-c430-11e8-96dc-000743165db0">
	<topic>bitcoin -- Denial of Service and Possible Mining Inflation</topic>
	<affects>
	<package>
	<name>bitcoin</name>
	<name>bitcoin-daemon</name>
	<range><lt>0.16.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bitcoin Core reports:</p>
	<blockquote cite="https://bitcoincore.org/en/2018/09/20/notice/">
	<p>CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bitcoincore.org/en/2018/09/20/notice/</url>
	<cvename>CVE-2018-17144</cvename>
	</references>
	<dates>
	<discovery>2018-09-17</discovery>
	<entry>2018-09-29</entry>
	</dates>
	</vuln>

	<vuln vid="613193a0-c1b4-11e8-ae2d-54e1ad3d6335">
	<topic>spamassassin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>spamassassin</name>
	<range><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>the Apache Spamassassin project reports:</p>
	<blockquote cite="https://seclists.org/oss-sec/2018/q3/242">
	<p>In Apache SpamAssassin, using HTML::Parser, we setup an object and
	hook into the begin and end tag event handlers In both cases, the
	"open" event is immediately followed by a "close" event - even if
	the tag does not close in the HTML being parsed.</p>
	<p>Because of this, we are missing the "text" event to deal with
	the object normally. This can cause carefully crafted emails that
	might take more scan time than expected leading to a Denial of
	Service.</p>
	<p>Fix a reliance on "." in @INC in one configuration script. Whether
	this can be exploited in any way is uncertain.</p>
	<p>Fix a potential Remote Code Execution bug with the PDFInfo plugin.
	Thanks to cPanel Security Team for their report of this issue.</p>
	<p> Fourth, this release fixes a local user code injection in the
	meta rule syntax. Thanks again to cPanel Security Team for their
	report of this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://seclists.org/oss-sec/2018/q3/242</url>
	<cvename>CVE-2017-15705</cvename>
	<cvename>CVE-2016-1238</cvename>
	<cvename>CVE-2018-11780</cvename>
	<cvename>CVE-2018-11781</cvename>
	</references>
	<dates>
	<discovery>2018-09-16</discovery>
	<entry>2018-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="bad59128-c188-11e8-9d40-f0def10dca57">
	<topic>wesnoth -- Code Injection vulnerability</topic>
	<affects>
	<package>
	<name>wesnoth</name>
	<range><ge>1.7.0</ge><lt>1.14.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>shadowm reports:</p>
	<blockquote cite="https://forums.wesnoth.org/viewtopic.php?t=48528">
	<p>A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0.
	Users of all previous version should upgrade immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1999023</cvename>
	<url>https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380</url>
	</references>
	<dates>
	<discovery>2018-07-14</discovery>
	<entry>2018-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="e182c076-c189-11e8-a6d2-b499baebfeaf">
	<topic>Apache -- Denial of service vulnerability in HTTP/2</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache httpd project reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	<p>low: DoS for HTTP/2 connections by continuous SETTINGS</p>
	<p>By sending continous SETTINGS frames of maximum size an ongoing
	HTTP/2 connection could be kept busy and would never time out. This
	can be abused for a DoS on the server. This only affect a server
	that has enabled the h2 protocol.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
	<cvename>CVE-2018-11763</cvename>
	</references>
	<dates>
	<discovery>2018-09-25</discovery>
	<entry>2018-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="6bf71117-c0c9-11e8-b760-6023b685b1ee">
	<topic>mantis -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>mantis-php56</name>
	<name>mantis-php70</name>
	<name>mantis-php71</name>
	<name>mantis-php72</name>
	<range><lt>2.17.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Brian Carpenter reports:</p>
	<blockquote cite="https://mantisbt.org/bugs/view.php?id=24731">
	<p>Reflected XSS in view_filters_page.php via core/filter_form_api.php</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-16514</cvename>
	</references>
	<dates>
	<discovery>2018-09-03</discovery>
	<entry>2018-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="2d6de6a8-fb78-4149-aeda-77fc8f140f06">
	<topic>smart_proxy_dynflow -- authentication bypass vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-smart_proxy_dynflow</name>
	<range><lt>0.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643">
	<p>An authentication bypass flaw was found in the smart_proxy_dynflow
	component used by Foreman. A malicious attacker can use this flaw to
	remotely execute arbitrary commands on machines managed by vulnerable
	Foreman instances, in a highly privileged context.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643</url>
	<cvename>CVE-2018-14643</cvename>
	</references>
	<dates>
	<discovery>2018-09-20</discovery>
	<entry>2018-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="be1aada2-be6c-11e8-8fc6-000c29434208">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki127</name>
	<range><lt>1.27.5</lt></range>
	</package>
	<package>
	<name>mediawiki129</name>
	<range><le>1.29.3</le></range>
	</package>
	<package>
	<name>mediawiki130</name>
	<range><lt>1.30.1</lt></range>
	</package>
	<package>
	<name>mediawiki131</name>
	<range><lt>1.31.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mediawiki reports:</p>
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html">
	<p>Security fixes:</p>
	<p>T169545: $wgRateLimits entry for 'user' overrides 'newbie'.</p>
	<p>T194605: BotPasswords can bypass CentralAuth's account lock.</p>
	<p>T187638: When a log event is (partially) hidden Special:Redirect/logid
	can link to the incorrect log and reveal hidden</p>
	<p>T193237: Special:BotPasswords should require reauthenticate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-0503</cvename>
	<cvename>CVE-2018-0505</cvename>
	<cvename>CVE-2018-0504</cvename>
	<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html</url>
	</references>
	<dates>
	<discovery>2018-08-29</discovery>
	<entry>2018-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="3284d948-140c-4a3e-aa76-3b440e2006a8">
	<topic>firefox -- Crash in TransportSecurityInfo due to cached data</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>62.0.2,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>60.2.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-22/">
	<p>A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-12385</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-22/</url>
	</references>
	<dates>
	<discovery>2018-09-21</discovery>
	<entry>2018-09-21</entry>
	</dates>
	</vuln>

	<vuln vid="77f67b46-bd75-11e8-81b6-001999f8d30b">
	<topic>asterisk -- Remote crash vulnerability in HTTP websocket upgrade</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.23.1</lt></range>
	</package>
	<package>
	<name>asterisk15</name>
	<range><lt>15.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>There is a stack overflow vulnerability in the
	res_http_websocket.so module of Asterisk that allows an
	attacker to crash Asterisk via a specially crafted HTTP
	request to upgrade the connection to a websocket. The
	attackers request causes Asterisk to run out of stack
	space and crash.</p>
	<p>As a workaround disable HTTP websocket access by not
	loading the res_http_websocket.so module.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-009.html</url>
	<cvename>CVE-2018-17281</cvename>
	</references>
	<dates>
	<discovery>2018-08-16</discovery>
	<entry>2018-09-21</entry>
	</dates>
	</vuln>

	<vuln vid="074cb225-bb2d-11e8-90e1-fcaa147e860e">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.14</lt></range>
	</package>
	<package>
	<name>moodle33</name>
	<range><lt>3.3.8</lt></range>
	</package>
	<package>
	<name>moodle34</name>
	<range><lt>3.4.5</lt></range>
	</package>
	<package>
	<name>moodle35</name>
	<range><lt>3.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>moodle reports:</p>
	<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=376023">
	<p>Moodle XML import of ddwtos could lead to intentional remote code
	execution</p>
	<p>QuickForm library remote code vulnerability (upstream)</p>
	<p>Boost theme - blog search GET parameter insufficiently filtered</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14630</cvename>
	<cvename>CVE-2018-1999022</cvename>
	<cvename>CVE-2018-14631</cvename>
	<url>https://moodle.org/mod/forum/discuss.php?d=376023</url>
	</references>
	<dates>
	<discovery>2018-09-05</discovery>
	<entry>2018-09-18</entry>
	</dates>
	</vuln>

	<vuln vid="bf2b9c56-b93e-11e8-b2a8-a4badb296695">
	<topic>joomla3 -- vulnerabilitiesw</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><lt>3.8.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>JSST reports: Multiple low-priority Vulnerabilities</p>
	<blockquote cite="https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html">
	<p>Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html">
	<p>Inadequate output filtering on the user profile page could lead to a stored XSS attack.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html">
	<p>Inadequate checks regarding disabled fields can lead to an ACL violation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15860</cvename>
	<cvename>CVE-2018-15881</cvename>
	<cvename>CVE-2018-15882</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882</url>
	<url>https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html</url>
	<url>https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html</url>
	<url>https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html</url>
	</references>
	<dates>
	<discovery>2018-08-23</discovery>
	<entry>2018-09-15</entry>
	</dates>
	</vuln>

	<vuln vid="ab38d9f8-b787-11e8-8e7a-00e04c1ea73d">
	<topic>mybb -- vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.8.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mybb Team reports:</p>
	<blockquote cite="https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/">
	<p>High risk: Email field SQL Injection.</p>
	<p>Medium risk: Video MyCode Persistent XSS in Visual Editor.</p>
	<p>Low risk: Insufficient permission check in User CP’s attachment management.</p>
	<p>Low risk: Insufficient email address verification.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-09-11</discovery>
	<entry>2018-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="a67c122a-b693-11e8-ac58-a4badb2f4699">
	<topic>FreeBSD -- Improper ELF header parsing</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_3</lt></range>
	<range><ge>11.1</ge><lt>11.1_14</lt></range>
	<range><ge>10.4</ge><lt>10.4_12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Insufficient validation was performed in the ELF header
	parser, and malformed or otherwise invalid ELF binaries
	were not rejected as they should be.</p>
	<h1>Impact:</h1>
	<p>Execution of a malicious ELF binary may result in a
	kernel crash or may disclose kernel memory.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6924</cvename>
	<freebsdsa>SA-18:12.elf</freebsdsa>
	</references>
	<dates>
	<discovery>2018-09-12</discovery>
	<entry>2018-09-12</entry>
	</dates>
	</vuln>

	<vuln vid="fe818607-b5ff-11e8-856b-485b3931c969">
	<topic>Containous Traefik -- exposes the configuration and secret</topic>
	<affects>
	<package>
	<name>traefik</name>
	<range><lt>1.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15598">
	<p>Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the
	configuration and secret if authentication is missing and the API's port
	is publicly reachable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15598</cvename>
	<url>https://github.com/containous/traefik/pull/3790</url>
	<url>https://github.com/containous/traefik/releases/tag/v1.6.6</url>
	</references>
	<dates>
	<discovery>2018-08-20</discovery>
	<entry>2018-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="f9d73a20-b5f0-11e8-b1da-6451062f0f7a">
	<topic>Flash Player -- information disclosure</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>31.0.0.108</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-31.html">
	<ul>
	<li>This update resolves a privilege escalation vulnerability that
	could lead to information disclosure (CVE-2018-15967).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-15967</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-31.html</url>
	</references>
	<dates>
	<discovery>2018-09-11</discovery>
	<entry>2018-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="337960ec-b5dc-11e8-ac58-a4badb2f4699">
	<topic>Plex Media Server -- Information Disclosure Vulnerability</topic>
	<affects>
	<package>
	<name>plexmediaserver</name>
	<name>plexmediaserver-plexpass</name>
	<range><lt>1.13.5.5332</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chris reports:</p>
	<blockquote cite="https://seclists.org/fulldisclosure/2018/Aug/1">
	<p>The XML parsing engine for Plex Media Server's SSDP/UPNP
	functionality is vulnerable to an XML External Entity
	Processing (XXE) attack. Unauthenticated attackers on the same LAN can
	use this vulnerability to:</p>
	<ul>
	<li>Access arbitrary files from the filesystem with the same permission as
	the user account running Plex.</li>
	<li>Initiate SMB connections to capture NetNTLM challenge/response and
	crack to clear-text password.</li>
	<li>Initiate SMB connections to relay NetNTLM challenge/response and
	achieve Remote Command Execution in Windows domains.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://seclists.org/fulldisclosure/2018/Aug/1</url>
	<cvename>CVE-2018-13415</cvename>
	</references>
	<dates>
	<discovery>2018-08-01</discovery>
	<entry>2018-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="f00acdec-b59f-11e8-805d-001e2a3f778d">
	<topic>X11 Session -- SDDM allows unauthorised unlocking</topic>
	<affects>
	<package>
	<name>sddm</name>
	<range><lt>0.17.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14345">
	<p>An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.</p>
	</blockquote>
	<p>The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.</p>
	</body>
	</description>
	<references>
	<url>https://www.suse.com/security/cve/CVE-2018-14345/</url>
	<cvename>CVE-2018-14345</cvename>
	</references>
	<dates>
	<discovery>2018-08-13</discovery>
	<entry>2018-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="db2acdac-b5a7-11e8-8f6f-00e04c1ea73d">
	<topic>mybb -- vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.8.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mybb Team reports:</p>
	<blockquote cite="https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/">
	<p>High risk: Image MyCode “alt” attribute persistent XSS.</p>
	<p>Medium risk: RSS Atom 1.0 item title persistent XSS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-08-22</discovery>
	<entry>2018-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="7c750960-b129-11e8-9fcd-080027f43a02">
	<topic>Information disclosure - Gitea leaks email addresses</topic>
	<affects>
	<package>
	<name>gitea</name>
	<range><lt>1.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Gitea project reports:</p>
	<blockquote cite="https://github.com/go-gitea/gitea/issues/4417">
	<p>[Privacy] Gitea leaks hidden email addresses #4417</p>
	<p>A fix has been implemented in Gitea 1.5.1.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/go-gitea/gitea/issues/4417</url>
	<url>https://github.com/go-gitea/gitea/pull/4784</url>
	</references>
	<dates>
	<discovery>2018-07-10</discovery>
	<entry>2018-09-05</entry>
	</dates>
	</vuln>

	<vuln vid="2a92555f-a6f8-11e8-8acd-10c37b4ac2ea">
	<topic>links -- denial of service</topic>
	<affects>
	<package>
	<name>links</name>
	<range><lt>2.16,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NIST reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-11114">
	<p>The put_chars function in html_r.c in Twibright Links 2.14 allows
	remote attackers to cause a denial of service (buffer over-read)
	via a crafted HTML file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11114</url>
	<cvename>CVE-2017-11114</cvename>
	</references>
	<dates>
	<discovery>2017-07-31</discovery>
	<entry>2018-08-23</entry>
	</dates>
	</vuln>

	<vuln vid="f4d638b9-e6e5-4dbe-8c70-571dbc116174">
	<topic>curl -- password overflow vulnerability</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.15.4</ge><lt>7.61.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>curl security problems:</p>
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	<p>CVE-2018-14618: NTLM password overflow via integer overflow</p>
	<p>The internal function Curl_ntlm_core_mk_nt_hash multiplies the length
	of the password by two (SUM) to figure out how large temporary storage
	area to allocate from the heap.</p>
	<p>The length value is then subsequently used to iterate over the
	password and generate output into the allocated storage buffer. On
	systems with a 32 bit size_t, the math to calculate SUM triggers an
	integer overflow when the password length exceeds 2GB (2^31 bytes).
	This integer overflow usually causes a very small buffer to actually
	get allocated instead of the intended very huge one, making the use of
	that buffer end up in a heap buffer overflow.</p>
	<p>This bug is almost identical to CVE-2017-8816.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/security.html</url>
	<url>https://curl.haxx.se/docs/CVE-2018-14618.html</url>
	<cvename>CVE-2018-14618</cvename>
	</references>
	<dates>
	<discovery>2018-09-05</discovery>
	<entry>2018-09-05</entry>
	</dates>
	</vuln>

	<vuln vid="c96d416a-eae7-4d5d-bc84-40deca9329fb">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>62.0_1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.2.3</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.5</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>60.2.0_1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>60.2.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/">
	<p>CVE-2018-12377: Use-after-free in refresh driver timers</p>
	<p>CVE-2018-12378: Use-after-free in IndexedDB</p>
	<p>CVE-2018-12379: Out-of-bounds write with malicious MAR file</p>
	<p>CVE-2017-16541: Proxy bypass using automount and autofs</p>
	<p>CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation</p>
	<p>CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android</p>
	<p>CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords</p>
	<p>CVE-2018-12375: Memory safety bugs fixed in Firefox 62</p>
	<p>CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-16541</cvename>
	<cvename>CVE-2018-12375</cvename>
	<cvename>CVE-2018-12376</cvename>
	<cvename>CVE-2018-12377</cvename>
	<cvename>CVE-2018-12378</cvename>
	<cvename>CVE-2018-12379</cvename>
	<cvename>CVE-2018-12381</cvename>
	<cvename>CVE-2018-12382</cvename>
	<cvename>CVE-2018-12383</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/</url>
	</references>
	<dates>
	<discovery>2018-09-05</discovery>
	<entry>2018-09-05</entry>
	<modified>2018-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="30c0f878-b03e-11e8-be8a-0011d823eebd">
	<topic>Ghostscript -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>ghostscript9-agpl-base</name>
	<name>ghostscript9-agpl-x11</name>
	<range><lt>9.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CERT reports:</p>
	<blockquote cite="https://www.kb.cert.org/vuls/id/332928">
	<p>Ghostscript contains an optional -dSAFER option, which is supposed
	to prevent unsafe PostScript operations. Multiple PostScript
	operations bypass the protections provided by -dSAFER, which can
	allow an attacker to execute arbitrary commands with arbitrary
	arguments. This vulnerability can also be exploited in applications
	that leverage Ghostscript, such as ImageMagick, GraphicsMagick,
	evince, Okular, Nautilus, and others.</p>
	<p>Exploit code for this vulnerability is publicly available.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.kb.cert.org/vuls/id/332928</url>
	<cvename>CVE-2018-15908</cvename>
	<cvename>CVE-2018-15909</cvename>
	<cvename>CVE-2018-15910</cvename>
	<cvename>CVE-2018-15911</cvename>
	</references>
	<dates>
	<discovery>2018-08-21</discovery>
	<entry>2018-09-04</entry>
	</dates>
	</vuln>

	<vuln vid="1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea">
	<topic>grafana -- LDAP and OAuth login vulnerability</topic>
	<affects>
	<package>
	<name>grafana5</name>
	<range><ge>5.0.0</ge><lt>5.2.3</lt></range>
	</package>
	<package>
	<name>grafana4</name>
	<range><ge>4.0.0</ge><lt>4.6.4</lt></range>
	</package>
	<package>
	<name>grafana3</name>
	<range><ge>3.0.0</ge></range>
	</package>
	<package>
	<name>grafana2</name>
	<range><ge>2.0.0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Grafana Labs reports:</p>
	<blockquote cite="https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050">
	<p>On the 20th of August at 1800 CEST we were contacted about a
	potential security issue with the “remember me” cookie Grafana
	sets upon login. The issue targeted users without a local Grafana
	password (LDAP & OAuth users) and enabled a potential attacker
	to generate a valid cookie knowing only a username.</p>
	<p>All installations which use the Grafana LDAP or OAuth
	authentication features must be upgraded as soon as possible. If
	you cannot upgrade, you should switch authentication mechanisms
	or put additional protections in front of Grafana such as a
	reverse proxy.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050</url>
	<cvename>CVE-2018-558213</cvename>
	</references>
	<dates>
	<discovery>2018-08-20</discovery>
	<entry>2018-08-31</entry>
	</dates>
	</vuln>

	<vuln vid="ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.2.0</ge><lt>11.2.3</lt></range>
	<range><ge>11.1.0</ge><lt>11.1.6</lt></range>
	<range><ge>2.7.0</ge><lt>11.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/">
	<p>Persistent XSS in Pipeline Tooltip</p>
	<p>GitLab.com GCP Endpoints Exposure</p>
	<p>Persistent XSS in Merge Request Changes View</p>
	<p>Sensitive Data Disclosure in Sidekiq Logs</p>
	<p>Missing CSRF in System Hooks</p>
	<p>Orphaned Upload Files Exposure</p>
	<p>Missing Authorization Control API Repository Storage</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/</url>
	</references>
	<dates>
	<discovery>2018-08-28</discovery>
	<entry>2018-08-30</entry>
	</dates>
	</vuln>

	<vuln vid="d0be41fe-2a20-4633-b057-4e8b25c41780">
	<topic>bro -- array bounds and potential DOS issues</topic>
	<affects>
	<package>
	<name>bro</name>
	<range><lt>2.5.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Corelight reports:</p>
	<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
	<p>Bro 2.5.5 primarily addresses security issues:</p>
	<ul>
	<li>Fix array bounds checking in BinPAC: for arrays
	that are fields within a record, the bounds check
	was based on a pointer to the start of the record
	rather than the start of the array field, potentially
	resulting in a buffer over-read.</li>
	<li>Fix SMTP command string comparisons: the number
	of bytes compared was based on the user-supplied
	string length and can lead to incorrect matches.
	e.g. giving a command of "X" incorrectly matched
	"X-ANONYMOUSTLS" (and an empty commands match
	anything).</li>
	</ul>
	<p>Address potential vectors for Denial of Service:</p>
	<ul>
	<li>"Weird" events are now generally suppressed/sampled
	by default according to some tunable parameters.</li>
	<li>Improved handling of empty lines in several text
	protocol analyzers that can cause performance issues
	when seen in long sequences.</li>
	<li>Add `smtp_excessive_pending_cmds' weird which
	serves as a notification for when the "pending
	command" queue has reached an upper limit and been
	cleared to prevent one from attempting to slowly
	exhaust memory.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.bro.org/download/NEWS.bro.html</url>
	</references>
	<dates>
	<discovery>2018-08-28</discovery>
	<entry>2018-08-29</entry>
	</dates>
	</vuln>

	<vuln vid="0904e81f-a89d-11e8-afbb-bc5ff4f77b71">
	<topic>node.js -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node</name>
	<range><lt>10.9.0</lt></range>
	</package>
	<package>
	<name>node8</name>
	<range><lt>8.11.4</lt></range>
	</package>
	<package>
	<name>node6</name>
	<range><lt>6.14.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js reports:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/">
	<h1>OpenSSL: Client DoS due to large DH parameter</h1>
	<p>This fixes a potential denial of service (DoS) attack
	against client connections by a malicious server. During a TLS
	communication handshake, where both client and server agree to
	use a cipher-suite using DH or DHE (Diffie-Hellman, in both
	ephemeral and non-ephemeral modes), a malicious server can
	send a very large prime value to the client. Because this has
	been unbounded in OpenSSL, the client can be forced to spend
	an unreasonably long period of time to generate a key,
	potentially causing a denial of service.</p>
	<h1>OpenSSL: ECDSA key extraction via local side-channel</h1>
	<p>Attackers with access to observe cache-timing may be able
	to extract DSA or ECDSA private keys by causing the victim to
	create several signatures and watching responses. This flaw
	does not have a CVE due to OpenSSL policy to not assign itself
	CVEs for local-only vulnerabilities that are more academic
	than practical. This vulnerability was discovered by Keegan
	Ryan at NCC Group and impacts many cryptographic libraries
	including OpenSSL.</p>
	<h1>Unintentional exposure of uninitialized memory</h1>
	<p>Only Node.js 10 is impacted by this flaw.</p>
	<p>Node.js TSC member Nikita Skovoroda discovered an argument
	processing flaw that causes Buffer.alloc() to return
	uninitialized memory. This method is intended to be safe and
	only return initialized, or cleared, memory. The third
	argument specifying encoding can be passed as a number, this
	is misinterpreted by Buffer's internal "fill" method as the
	start to a fill operation. This flaw may be abused where
	Buffer.alloc() arguments are derived from user input to return
	uncleared memory blocks that may contain sensitive
	information.</p>
	<h1>Out of bounds (OOB) write</h1>
	<p>Node.js TSC member Nikita Skovoroda discovered an OOB write
	in Buffer that can be used to write to memory outside of a
	Buffer's memory space. This can corrupt unrelated Buffer
	objects or cause the Node.js process to crash.</p>
	<p>When used with UCS-2 encoding (recognized by Node.js under
	the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'),
	Buffer#write() can be abused to write outside of the bounds of
	a single Buffer. Writes that start from the second-to-last
	position of a buffer cause a miscalculation of the maximum
	length of the input bytes to be written.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/</url>
	<cvename>CVE-2018-0732</cvename>
	<cvename>CVE-2018-7166</cvename>
	<cvename>CVE-2018-12115</cvename>
	</references>
	<dates>
	<discovery>2018-08-16</discovery>
	<entry>2018-08-25</entry>
	</dates>
	</vuln>

	<vuln vid="45671c0e-a652-11e8-805b-a4badb2f4699">
	<topic>FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.2</ge><lt>11.2_2</lt></range>
	<range><ge>11.1</ge><lt>11.1_13</lt></range>
	<range><ge>10.4</ge><lt>10.4_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When using WPA2, EAPOL-Key frames with the Encrypted
	flag and without the MIC flag set, the data field was
	decrypted first without verifying the MIC. When the dta
	field was encrypted using RC4, for example, when negotiating
	TKIP as a pairwise cipher, the unauthenticated but decrypted
	data was subsequently processed. This opened wpa_supplicant(8)
	to abuse by decryption and recovery of sensitive information
	contained in EAPOL-Key messages.</p>
	<p>See
	https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
	for a detailed description of the bug.</p>
	<h1>Impact:</h1>
	<p>All users of the WPA2 TKIP pairwise cipher are vulnerable
	to information, for example, the group key.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1452</cvename>
	<freebsdsa>SA-18:11.hostapd</freebsdsa>
	</references>
	<dates>
	<discovery>2018-08-14</discovery>
	<entry>2018-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="359e1548-a652-11e8-805b-a4badb2f4699">
	<topic>FreeBSD -- Resource exhaustion in IP fragment reassembly</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_2</lt></range>
	<range><ge>11.1</ge><lt>11.1_13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A researcher has notified us of a DoS attack applicable
	to another operating system. While FreeBSD may not be
	vulnerable to that exact attack, we have identified several
	places where inadequate DoS protection could allow an
	attacker to consume system resources.</p>
	<p>It is not necessary that the attacker be able to establish
	two-way communication to carry out these attacks. These
	attacks impact both IPv4 and IPv6 fragment reassembly.</p>
	<h1>Impact:</h1>
	<p>In the worst case, an attacker could send a stream of
	crafted fragments with a low packet rate which would consume
	a substantial amount of CPU.</p>
	<p>Other attack vectors allow an attacker to send a stream
	of crafted fragments which could consume a large amount of
	CPU or all available mbuf clusters on the system.</p>
	<p>These attacks could temporarily render a system unreachable
	through network interfaces or temporarily render a system
	unresponsive. The effects of the attack should clear within
	60 seconds after the attack stops.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6923</cvename>
	<freebsdsa>SA-18:10.ip</freebsdsa>
	</references>
	<dates>
	<discovery>2018-08-14</discovery>
	<entry>2018-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="2310b814-a652-11e8-805b-a4badb2f4699">
	<topic>FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_2</lt></range>
	<range><ge>11.1</ge><lt>11.1_13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>On certain Intel 64-bit x86 systems there is a period
	of time during terminal fault handling where the CPU may
	use speculative execution to try to load data. The CPU may
	speculatively access the level 1 data cache (L1D). Data
	which would otherwise be protected may then be determined
	by using side channel methods.</p>
	<p>This issue affects bhyve on FreeBSD/amd64 systems.</p>
	<h1>Impact:</h1>
	<p>An attacker executing user code, or kernel code inside
	of a virtual machine, may be able to read secret data from
	the kernel or from another virtual machine.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-3620</cvename>
	<cvename>CVE-2018-3646</cvename>
	<freebsdsa>SA-18:09.l1tf</freebsdsa>
	</references>
	<dates>
	<discovery>2018-08-14</discovery>
	<entry>2018-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="e53a908d-a645-11e8-8acd-10c37b4ac2ea">
	<topic>gogs -- open redirect vulnerability</topic>
	<affects>
	<package>
	<name>gogs</name>
	<range><lt>0.11.53_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>bluecatli (Tencent's Xuanwu Lab) reports:</p>
	<blockquote cite="https://github.com/gogs/gogs/issues/5364">
	<p>The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.</p>
	<p>If the Location header startswith /\, it will be transformed to // by browsers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/gogs/gogs/issues/5364</url>
	<url>https://github.com/gogs/gogs/pull/5365</url>
	<url>https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2</url>
	</references>
	<dates>
	<discovery>2018-08-06</discovery>
	<entry>2018-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="9e205ef5-a649-11e8-b1f6-6805ca0b3d42">
	<topic>phpmyadmin -- XSS in the import dialog</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php56</name>
	<name>phpMyAdmin-php70</name>
	<name>phpMyAdmin-php71</name>
	<name>phpMyAdmin-php72</name>
	<range><lt>4.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-5/">
	<h3>Description</h3>
	<p>A Cross-Site Scripting vulnerability was found in the
	file import feature, where an attacker can deliver a payload
	to a user through importing a specially-crafted file.</p>
	<h3>Severity</h3>
	<p>We consider this attack to be of moderate severity.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-5/</url>
	<cvename>CVE-2018-15605</cvename>
	</references>
	<dates>
	<discovery>2018-08-21</discovery>
	<entry>2018-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="fe99d3ca-a63a-11e8-a7c6-54e1ad3d6335">
	<topic>libX11 -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libX11</name>
	<range><lt>1.6.6,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The freedesktop.org project reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2018-August/002915.html">
	<p>The functions XGetFontPath, XListExtensions, and XListFonts are
	vulnerable to an off-by-one override on malicious server responses.
	The server replies consist of chunks consisting of a length byte
	followed by actual string, which is not NUL-terminated.
	While parsing the response, the length byte is overridden with '\0',
	thus the memory area can be used as storage of C strings later on.
	To be able to NUL-terminate the last string, the buffer is reserved
	with an additional byte of space. For a boundary check, the variable
	chend (end of ch) was introduced, pointing at the end of the buffer
	which ch initially points to. Unfortunately there is a difference
	in handling "the end of ch". While chend points at the first byte
	that must not be written to, the for-loop uses chend as the last
	byte that can be written to. Therefore, an off-by-one can occur.</p>
	<p>The length value is interpreted as signed char on many systems
	(depending on default signedness of char), which can lead to an out
	of boundary write up to 128 bytes in front of the allocated storage,
	but limited to NUL byte(s).</p>
	<p>If the server sends a reply in which even the first string would
	overflow the transmitted bytes, list[0] (or flist[0]) will be set to
	NULL and a count of 0 is returned. If the resulting list is freed
	with XFreeExtensionList or XFreeFontPath later on, the first Xfree
	call is turned into Xfree (NULL-1) which will most likely trigger a
	segmentation fault. Casting the length value to unsigned char fixes
	the problem and allows string values with up to 255 characters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.x.org/archives/xorg-announce/2018-August/002915.html</url>
	<cvename>CVE-2018-14598</cvename>
	<cvename>CVE-2018-14599</cvename>
	<cvename>CVE-2018-14600</cvename>
	</references>
	<dates>
	<discovery>2018-08-21</discovery>
	<entry>2018-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="9b19b6df-a4be-11e8-9366-0028f8d09152">
	<topic>couchdb -- administrator privilege escalation</topic>
	<affects>
	<package>
	<name>couchdb</name>
	<range><lt>2.2.0,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache CouchDB PMC reports:</p>
	<blockquote cite="https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75@%3Cdev.couchdb.apache.org%3E">
	<p>Database Administrator could achieve privilege escalation to
	the account that CouchDB runs under, by abusing insufficient validation
	in the HTTP API, escaping security controls implemented in previous
	releases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://docs.couchdb.org/en/stable/cve/2018-11769.html</url>
	<cvename>CVE-2018-11769</cvename>
	</references>
	<dates>
	<discovery>2018-06-05</discovery>
	<entry>2018-08-08</entry>
	</dates>
	</vuln>

	<vuln vid="7762d7ad-2e38-41d2-9785-c51f653ba8bd">
	<topic>botan2 -- ECDSA side channel</topic>
	<affects>
	<package>
	<name>botan2</name>
	<range><ge>2.5.0</ge><lt>2.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>botan2 developers report:</p>
	<blockquote cite="https://botan.randombit.net/security.html#id1">
	<p>A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.</p>
	<p>Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://botan.randombit.net/security.html#id1</url>
	<url>https://github.com/randombit/botan/pull/1604</url>
	<cvename>CVE-2018-12435</cvename>
	</references>
	<dates>
	<discovery>2018-06-13</discovery>
	<entry>2018-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="6905f05f-a0c9-11e8-8335-8c164535ad80">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.138</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.121.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-08-15/">
	<h1>Description</h1>
	<h5>(Low) SECURITY-637</h5>
	<p> Jenkins allowed deserialization of URL objects with host components</p>
	<h5>(Medium) SECURITY-672</h5>
	<p>Ephemeral user record was created on some invalid authentication attempts</p>
	<h5>(Medium) SECURITY-790</h5>
	<p>Cron expression form validation could enter infinite loop, potentially resulting in denial of service</p>
	<h5>(Low) SECURITY-996</h5>
	<p>"Remember me" cookie was evaluated even if that feature is disabled</p>
	<h5>(Medium) SECURITY-1071</h5>
	<p>Unauthorized users could access agent logs</p>
	<h5>(Low) SECURITY-1076</h5>
	<p>Unauthorized users could cancel scheduled restarts initiated from the update center</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2018-08-15/</url>
	</references>
	<dates>
	<discovery>2018-08-15</discovery>
	<entry>2018-08-15</entry>
	</dates>
	</vuln>

	<vuln vid="98b603c8-9ff3-11e8-ad63-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>30.0.0.154</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-25.html">
	<ul>
	<li>This update resolves out-of-bounds read vulnerabilities that
	could lead to information disclosure (CVE-2018-12824,
	CVE-2018-12826, CVE-2018-12827).</li>
	<li>This update resolves a security bypass vulnerability that
	could lead to security mitigation bypass (CVE-2018-12825).</li>
	<li>This update resolves a component vulnerability that
	could lead to privilege escalation (CVE-2018-12828).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-12824</cvename>
	<cvename>CVE-2018-12825</cvename>
	<cvename>CVE-2018-12826</cvename>
	<cvename>CVE-2018-12827</cvename>
	<cvename>CVE-2018-12828</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-25.html</url>
	</references>
	<dates>
	<discovery>2018-08-14</discovery>
	<entry>2018-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="c4e9a427-9fc2-11e8-802a-000c29a1e3ec">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba46</name>
	<range><lt>4.6.16</lt></range>
	</package>
	<package>
	<name>samba47</name>
	<range><lt>4.7.9</lt></range>
	</package>
	<package>
	<name>samba48</name>
	<range><lt>4.8.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The samba project reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1139.html">
	<p>Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which
	allows authentication using NTLMv1 over an SMB1 transport (either
	directory or via NETLOGON SamLogon calls from a member server), even
	when NTLMv1 is explicitly disabled on the server.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1140.html">
	<p>Missing input sanitization checks on some of the input parameters to
	LDB database layer cause the LDAP server and DNS server to crash when
	following a NULL pointer.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10858.html">
	<p>Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in
	libsmbclient that could allow a malicious server to overwrite
	client heap memory by returning an extra long filename in a directory
	listing.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10918.html">
	<p>Missing database output checks on the returned directory attributes
	from the LDB database layer cause the DsCrackNames call in the DRSUAPI
	server to crash when following a NULL pointer.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10919.html">
	<p>All versions of the Samba Active Directory LDAP server from 4.0.0
	onwards are vulnerable to the disclosure of confidential attribute
	values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL
	(0x80) searchFlags bit and where an explicit Access Control Entry has
	been specified on the ntSecurityDescriptor.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.samba.org/samba/security/CVE-2018-1139.html</url>
	<cvename>CVE-2018-1139</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-1140.html</url>
	<cvename>CVE-2018-1140</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-10858.html</url>
	<cvename>CVE-2018-10858</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-10918.html</url>
	<cvename>CVE-2018-10918</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-10919.html</url>
	<cvename>CVE-2018-10919</cvename>
	</references>
	<dates>
	<discovery>2018-08-14</discovery>
	<entry>2018-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="e714b7d2-39f6-4992-9f48-e6b2f5f949df">
	<topic>GraphicsMagick -- SVG/Rendering vulnerability</topic>
	<affects>
	<package>
	<name>GraphicsMagick</name>
	<range><lt>1.3.30,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GraphicsMagick News:</p>
	<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
	<p>Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is
	another manefestation of CVE-2016-2317, which should finally be fixed
	correctly due to active detection/correction of pending overflow rather
	than using estimation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.graphicsmagick.org/NEWS.html</url>
	<cvename>CVE-2016-2317</cvename>
	</references>
	<dates>
	<discovery>2018-06-23</discovery>
	<entry>2018-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="5a771686-9e33-11e8-8b2d-9cf7a8059466">
	<topic>chicken -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chicken</name>
	<range><lt>4.13.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CHICKEN reports:</p>
	<blockquote cite="https://code.call-cc.org/releases/4.13.0/NEWS">
	<ul>
	<li>CVE-2017-6949: Unchecked malloc() call in SRFI-4
	constructors when allocating in non-GC memory, resulting
	in potential 1-word buffer overrun and/or segfault</li>
	<li>CVE-2017-9334: "length" crashes on improper lists</li>
	<li>CVE-2017-11343: The randomization factor of the symbol
	table was set before the random seed was set, causing it
	to have a fixed value on many platforms</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://code.call-cc.org/releases/4.13.0/NEWS</url>
	<cvename>CVE-2017-6949</cvename>
	<cvename>CVE-2017-9334</cvename>
	<cvename>CVE-2017-11343</cvename>
	</references>
	<dates>
	<discovery>2017-03-16</discovery>
	<entry>2018-08-12</entry>
	</dates>
	</vuln>

	<vuln vid="bcf56a42-9df8-11e8-afb0-589cfc0f81b0">
	<topic>gitea -- TOTP passcode reuse</topic>
	<affects>
	<package>
	<name>gitea</name>
	<range><lt>1.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Gitea project reports:</p>
	<blockquote cite="https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/">
	<p>TOTP passcodes can be reused.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/go-gitea/gitea/pull/3878</url>
	</references>
	<dates>
	<discovery>2018-05-01</discovery>
	<entry>2018-08-12</entry>
	</dates>
	</vuln>

	<vuln vid="f4876dd4-9ca8-11e8-aa17-0011d823eebd">
	<topic>mbed TLS -- plaintext recovery vulnerabilities</topic>
	<affects>
	<package>
	<name>mbedtls</name>
	<range><lt>2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Butcher reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02">
	<ul>
	<li>When using a CBC based ciphersuite, a remote attacker can
	partially recover the plaintext.</li>
	<li>When using a CBC based ciphersuite, an attacker with the
	ability to execute arbitrary code on the machine under attack
	can partially recover the plaintext by use of cache based
	side-channels.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02</url>
	<cvename>CVE-2018-0497</cvename>
	<cvename>CVE-2018-0498</cvename>
	</references>
	<dates>
	<discovery>2018-07-24</discovery>
	<entry>2018-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="96eab874-9c79-11e8-b34b-6cc21735f730">
	<topic>PostgreSQL -- two vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql10-server</name>
	<range><lt>10.5</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><lt>9.6.10</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><lt>9.5.14</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><lt>9.4.19</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><lt>9.3.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/1878/">
	<p>CVE-2018-10915: Certain host connection parameters defeat
	client-side security defenses</p>
	<p>libpq, the client connection API for PostgreSQL that is also used
	by other connection libraries, had an internal issue where it did not
	reset all of its connection state variables when attempting to
	reconnect. In particular, the state variable that determined whether
	or not a password is needed for a connection would not be reset, which
	could allow users of features requiring libpq, such as the "dblink" or
	"postgres_fdw" extensions, to login to servers they should not be able
	to access.</p>
	<p>CVE-2018-10925: Memory disclosure and missing authorization in
	`INSERT ... ON CONFLICT DO UPDATE`</p>
	<p>An attacker able to issue CREATE TABLE can read arbitrary bytes of
	server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`)
	query. By default, any user can exploit that. A user that has
	specific INSERT privileges and an UPDATE privilege on at least one
	column in a given table can also update other columns using a view and
	an upsert query.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.postgresql.org/about/news/1878/</url>
	<cvename>CVE-2018-10915</cvename>
	<cvename>CVE-2018-10925</cvename>
	</references>
	<dates>
	<discovery>2018-08-09</discovery>
	<entry>2018-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="909be51b-9b3b-11e8-add2-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.61</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.36</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.35</lt></range>
	</package>
	<package>
	<name>mariadb102-server</name>
	<range><lt>10.2.17</lt></range>
	</package>
	<package>
	<name>mariadb103-server</name>
	<range><lt>10.3.9</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.61</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.41</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.23</lt></range>
	</package>
	<package>
	<name>mysql80-server</name>
	<range><lt>8.0.12</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.61</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.41</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html">
	<p>Multiple vulnerabilities have been disclosed by Oracle without
	further detail. CVSS scores 7.1 - 2.7</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html</url>
	<cvename>CVE-2018-3064</cvename>
	<cvename>CVE-2018-0739</cvename>
	<cvename>CVE-2018-3070</cvename>
	<cvename>CVE-2018-3060</cvename>
	<cvename>CVE-2018-3065</cvename>
	<cvename>CVE-2018-3073</cvename>
	<cvename>CVE-2018-3074</cvename>
	<cvename>CVE-2018-3081</cvename>
	<cvename>CVE-2018-3071</cvename>
	<cvename>CVE-2018-3079</cvename>
	<cvename>CVE-2018-3054</cvename>
	<cvename>CVE-2018-3077</cvename>
	<cvename>CVE-2018-3078</cvename>
	<cvename>CVE-2018-3080</cvename>
	<cvename>CVE-2018-3061</cvename>
	<cvename>CVE-2018-3067</cvename>
	<cvename>CVE-2018-3063</cvename>
	<cvename>CVE-2018-3075</cvename>
	<cvename>CVE-2018-3058</cvename>
	<cvename>CVE-2018-3056</cvename>
	<cvename>CVE-2018-3066</cvename>
	<cvename>CVE-2018-2767</cvename>
	<cvename>CVE-2018-3084</cvename>
	<cvename>CVE-2018-3082</cvename>
	</references>
	<dates>
	<discovery>2018-07-17</discovery>
	<entry>2018-08-08</entry>
	</dates>
	</vuln>

	<vuln vid="5786185a-9a43-11e8-b34b-6cc21735f730">
	<topic>xml-security-c -- crashes on malformed KeyInfo content</topic>
	<affects>
	<package>
	<name>apache-xml-security-c</name>
	<range><lt>2.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The shibboleth project reports:</p>
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180803.txt">
	<p>
	SAML messages, assertions, and metadata all commonly make use of the
	XML Signature KeyInfo construct, which expresses information about
	keys and certificates used in signing or encrypting XML.
	</p>
	<p>
	The Apache Santuario XML Security for C++ library contained code
	paths at risk of dereferencing null pointers when processing various
	kinds of malformed KeyInfo hints typically found in signed or
	encrypted XML. The usual effect is a crash, and in the case of the
	Shibboleth SP software, a crash in the shibd daemon, which prevents
	access to protected resources until the daemon is restarted.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://shibboleth.net/community/advisories/secadv_20180803.txt</url>
	</references>
	<dates>
	<discovery>2018-08-03</discovery>
	<entry>2018-08-07</entry>
	</dates>
	</vuln>

	<vuln vid="3c2eea8c-99bf-11e8-8bee-a4badb2f4699">
	<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_1</lt></range>
	<range><ge>11.1</ge><lt>11.1_12</lt></range>
	<range><ge>10.4</ge><lt>10.4_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>One of the data structures that holds TCP segments uses
	an inefficient algorithm to reassemble the data. This causes
	the CPU time spent on segment processing to grow linearly
	with the number of segments in the reassembly queue.</p>
	<h1>Impact:</h1>
	<p>An attacker who has the ability to send TCP traffic to
	a victim system can degrade the victim system's network
	performance and/or consume excessive CPU by exploiting the
	inefficiency of TCP reassembly handling, with relatively
	small bandwidth cost.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6922</cvename>
	<freebsdsa>SA-18:08.tcp</freebsdsa>
	</references>
	<dates>
	<discovery>2018-08-06</discovery>
	<entry>2018-08-06</entry>
	</dates>
	</vuln>

	<vuln vid="9e2d0dcf-9926-11e8-a92d-0050562a4d7b">
	<topic>py-cryptography -- tag forgery vulnerability</topic>
	<affects>
	<package>
	<name>py27-cryptography</name>
	<name>py34-cryptography</name>
	<name>py35-cryptography</name>
	<name>py36-cryptography</name>
	<name>py37-cryptography</name>
	<range><lt>2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Python Cryptographic Authority (PyCA) project reports:</p>
	<blockquote cite="https://cryptography.io/en/latest/changelog/#v2-3">
	<p>finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-10903</cvename>
	</references>
	<dates>
	<discovery>2018-07-17</discovery>
	<entry>2018-08-06</entry>
	</dates>
	</vuln>

	<vuln vid="06c4a79b-981d-11e8-b460-9c5c8e75236a">
	<topic>cgit -- directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>cgit</name>
	<range><lt>1.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jann Horn reports:</p>
	<blockquote cite="https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html">
	<p>cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html</url>
	<cvename>CVE-2018-14912</cvename>
	</references>
	<dates>
	<discovery>2018-08-03</discovery>
	<entry>2018-08-04</entry>
	</dates>
	</vuln>

	<vuln vid="e309a2c7-598b-4fa6-a398-bc72fbd1d167">
	<topic>rubygem-doorkeeper -- token revocation vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-doorkeeper</name>
	<name>rubygem-doorkeeper43</name>
	<name>rubygem-doorkeeper-rails5</name>
	<name>rubygem-doorkeeper-rails50</name>
	<range><lt>4.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000211">
	<p>Doorkeeper version 4.2.0 and later contains a Incorrect Access Control
	vulnerability in Token revocation API's authorized method that can
	result in Access tokens are not revoked for public OAuth apps, leaking
	access until expiry.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000211</url>
	<url>https://github.com/doorkeeper-gem/doorkeeper/pull/1120</url>
	<cvename>CVE-2018-1000211</cvename>
	</references>
	<dates>
	<discovery>2018-07-13</discovery>
	<entry>2018-07-31</entry>
	<modified>2018-08-03</modified>
	</dates>
	</vuln>

	<vuln vid="ca05d9da-ac1d-4113-8a05-ffe9cd0d6160">
	<topic>sinatra -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-sinatra</name>
	<range><ge>2.0.0</ge><lt>2.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sinatra blog:</p>
	<blockquote cite="http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html">
	<p>Sinatra had a critical vulnerability since v2.0.0. The purpose of this
	release is to fix CVE-2018-11627.</p>
	<p>The vulnerability is that XSS can be executed by using illegal parameters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html</url>
	<url>https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md</url>
	<cvename>CVE-2018-11627</cvename>
	</references>
	<dates>
	<discovery>2018-06-09</discovery>
	<entry>2018-07-31</entry>
	</dates>
	</vuln>

	<vuln vid="b4f0ad36-94a5-11e8-9007-080027ac955c">
	<topic>mailman -- content spoofing with invalid list names in web UI</topic>
	<affects>
	<package><name>mailman</name> <range><lt>2.1.28</lt></range></package>
	<package><name>mailman-with-htdig</name><range><lt>2.1.28</lt></range></package>
	<package><name>ja-mailman</name> <range><lt>2.1.14.j7_6,1</lt></range></package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Sapiro reports:</p>
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1780874">
	<p>A URL with a very long text listname such as</p>
	<pre>http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_text</pre>
	<p>will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.</p>
	<p>This issue was discovered by Hammad Qureshi.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.launchpad.net/mailman/+bug/1780874</url>
	<url>https://mail.python.org/pipermail/mailman-announce/2018-July/000241.html</url>
	<cvename>CVE-2018-13796</cvename>
	</references>
	<dates>
	<discovery>2018-07-09</discovery>
	<entry>2018-07-31</entry>
	</dates>
	</vuln>

	<vuln vid="0822a4cf-9318-11e8-8d88-00e04c1ea73d">
	<topic>mantis -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>2.15.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mantis reports:</p>
	<blockquote cite="https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f">
	<p>Teun Beijers reported a cross-site scripting (XSS) vulnerability in
	the Edit Filter page which allows execution of arbitrary code
	(if CSP settings permit it) when displaying a filter with a crafted
	name. Prevent the attack by sanitizing the filter name before display.</p>
	<p>Ömer Cıtak, Security Researcher at Netsparker, reported this
	vulnerability, allowing remote attackers to inject arbitrary code
	(if CSP settings permit it) through a crafted PATH_INFO on
	view_filters_page.php. Prevent the attack by sanitizing the output
	of $_SERVER['PHP_SELF'] before display.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f</url>
	<url>https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a</url>
	<cvename>CVE-2018-14504</cvename>
	<cvename>CVE-2018-13066</cvename>
	</references>
	<dates>
	<discovery>2018-07-13</discovery>
	<entry>2018-07-29</entry>
	<modified>2018-08-24</modified>
	</dates>
	</vuln>

	<vuln vid="e97a8852-32dd-4291-ba4d-92711daff056">
	<topic>py-bleach -- unsanitized character entities</topic>
	<affects>
	<package>
	<name>py27-bleach</name>
	<name>py36-bleach</name>
	<range><ge>2.1.0</ge><lt>2.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>bleach developer reports:</p>
	<blockquote cite="https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES">
	<p>Attributes that have URI values weren't properly sanitized if the
	values contained character entities. Using character entities, it
	was possible to construct a URI value with a scheme that was not
	allowed that would slide through unsanitized.</p>
	<p>This security issue was introduced in Bleach 2.1. Anyone using
	Bleach 2.1 is highly encouraged to upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES</url>
	</references>
	<dates>
	<discovery>2018-03-05</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="07d04eef-d8e2-11e6-a071-001e67f15f5a">
	<topic>lshell -- Shell autocomplete reveals forbidden directories</topic>
	<affects>
	<package>
	<name>lshell</name>
	<range><lt>0.9.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>lshell reports:</p>
	<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
	<p>The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/ghantoos/lshell/issues/109</url>
	</references>
	<dates>
	<discovery>2015-07-25</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="f353525a-d8b8-11e6-a071-001e67f15f5a">
	<topic>lshell -- Multiple security issues</topic>
	<affects>
	<package>
	<name>lshell</name>
	<range><le>0.9.18</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>lshell reports:</p>
	<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
	<p>It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).</p>
	<p>Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/ghantoos/lshell/issues/122</url>
	<url>https://github.com/ghantoos/lshell/issues/147</url>
	<url>https://github.com/ghantoos/lshell/issues/149</url>
	<url>https://github.com/ghantoos/lshell/issues/151</url>
	</references>
	<dates>
	<discovery>2016-02-04</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="11dc3890-0e64-11e8-99b0-d017c2987f9a">
	<topic>OpenJPEG -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openjpeg</name>
	<range><le>2.3.0_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenJPEG reports:</p>
	<blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2018-5727+OR+CVE-2018-5785+OR+CVE-2018-6616">
	<p>Multiple vulnerabilities have been found in OpenJPEG, the
	opensource JPEG 2000 codec. Please consult the CVE list for further
	details.</p>
	<p>CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.</p>
	<p>CVE-2018-5785 was fixed in r480624.</p>
	<p>CVE-2018-5727 and CVE-2018-6616 are not fixed yet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17479</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17480</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5785</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-6616</url>
	<cvename>CVE-2017-17479</cvename>
	<cvename>CVE-2017-17480</cvename>
	<cvename>CVE-2018-5727</cvename>
	<cvename>CVE-2018-5785</cvename>
	<cvename>CVE-2018-6616</cvename>
	</references>
	<dates>
	<discovery>2017-12-08</discovery>
	<entry>2018-07-27</entry>
	<modified>2018-11-11</modified>
	</dates>
	</vuln>

	<vuln vid="5ccbb2f8-c798-11e7-a633-009c02a2ab30">
	<topic>ffmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range><lt>3.3.5_1,1</lt></range>
	<range><ge>3.4,1</ge><le>3.4.1_4,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://ffmpeg.org/security.html">
	<p>Multiple vulnerabilities have been found in FFmpeg. Please refer
	to CVE list for details.</p>
	<p>Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch
	before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed
	in 3.4.1. They're listed here for completeness of the record.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16840</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392</url>
	<url>http://ffmpeg.org/security.html</url>
	<cvename>CVE-2017-15186</cvename>
	<cvename>CVE-2017-15672</cvename>
	<cvename>CVE-2017-16840</cvename>
	<cvename>CVE-2017-17081</cvename>
	<cvename>CVE-2018-6392</cvename>
	</references>
	<dates>
	<discovery>2017-10-09</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="bfda2d80-0858-11e8-ad5c-0021ccb9e74d">
	<topic>GIMP - Heap Buffer Overflow Vulnerability</topic>
	<affects>
	<package>
	<name>gimp</name>
	<range><lt>2.8.22,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNOME reports:</p>
	<blockquote cite="https://www.securityfocus.com/bid/102765/references">
	<p>CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=739134</url>
	<cvename>CVE-2017-17786</cvename>
	</references>
	<dates>
	<discovery>2017-12-21</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>68.0.3440.75</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">
	<p>42 security fixes in this release, including:</p>
	<ul>
	<li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li>
	<li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li>
	<li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li>
	<li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li>
	<li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li>
	<li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li>
	<li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li>
	<li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li>
	<li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li>
	<li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li>
	<li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li>
	<li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li>
	<li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li>
	<li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li>
	<li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li>
	<li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li>
	<li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li>
	<li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li>
	<li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li>
	<li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li>
	<li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li>
	<li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12</li>
	<li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li>
	<li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li>
	<li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li>
	<li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li>
	<li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li>
	<li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li>
	<li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li>
	<li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li>
	<li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li>
	<li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li>
	<li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4117</cvename>
	<cvename>CVE-2018-6044</cvename>
	<cvename>CVE-2018-6150</cvename>
	<cvename>CVE-2018-6151</cvename>
	<cvename>CVE-2018-6152</cvename>
	<cvename>CVE-2018-6153</cvename>
	<cvename>CVE-2018-6154</cvename>
	<cvename>CVE-2018-6155</cvename>
	<cvename>CVE-2018-6156</cvename>
	<cvename>CVE-2018-6157</cvename>
	<cvename>CVE-2018-6158</cvename>
	<cvename>CVE-2018-6159</cvename>
	<cvename>CVE-2018-6160</cvename>
	<cvename>CVE-2018-6161</cvename>
	<cvename>CVE-2018-6162</cvename>
	<cvename>CVE-2018-6163</cvename>
	<cvename>CVE-2018-6164</cvename>
	<cvename>CVE-2018-6165</cvename>
	<cvename>CVE-2018-6166</cvename>
	<cvename>CVE-2018-6167</cvename>
	<cvename>CVE-2018-6168</cvename>
	<cvename>CVE-2018-6169</cvename>
	<cvename>CVE-2018-6170</cvename>
	<cvename>CVE-2018-6171</cvename>
	<cvename>CVE-2018-6172</cvename>
	<cvename>CVE-2018-6173</cvename>
	<cvename>CVE-2018-6174</cvename>
	<cvename>CVE-2018-6175</cvename>
	<cvename>CVE-2018-6176</cvename>
	<cvename>CVE-2018-6177</cvename>
	<cvename>CVE-2018-6178</cvename>
	<cvename>CVE-2018-6179</cvename>
	<url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2018-07-24</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a">
	<topic>curl -- SMTP send heap buffer overflow</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.54.1</ge><lt>7.61.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Peter Wu reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_2018-70a2.html">
	<p>curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_2018-70a2.html</url>
	<cvename>CVE-2018-0500</cvename>
	</references>
	<dates>
	<discovery>2018-07-11</discovery>
	<entry>2018-07-27</entry>
	<modified>2018-07-28</modified>
	</dates>
	</vuln>

	<vuln vid="2da838f9-9168-11e8-8c75-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<range><ge>11.1.0</ge><lt>11.1.2</lt></range>
	<range><ge>11.0.0</ge><lt>11.0.5</lt></range>
	<range><ge>2.7.0</ge><lt>10.8.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/">
	<p>Markdown DoS</p>
	<p>Information Disclosure Prometheus Metrics</p>
	<p>CSRF in System Hooks</p>
	<p>Persistent XSS Pipeline Tooltip</p>
	<p>Persistent XSS in Branch Name via Web IDE</p>
	<p>Persistent XSS in Branch Name via Web IDE</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14601</cvename>
	<cvename>CVE-2018-14602</cvename>
	<cvename>CVE-2018-14603</cvename>
	<cvename>CVE-2018-14604</cvename>
	<cvename>CVE-2018-14605</cvename>
	<cvename>CVE-2018-14606</cvename>
	<url>https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/</url>
	</references>
	<dates>
	<discovery>2018-07-26</discovery>
	<entry>2018-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="38fec4bd-90f7-11e8-aafb-1c39475b9f84">
	<topic>Fix a buffer overflow in the tiff reader</topic>
	<affects>
	<package>
	<name>vips</name>
	<range><lt>8.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libvips reports:</p>
	<blockquote cite="https://github.com/jcupitt/libvips/releases/tag/v8.6.5">
	<p>A buffer overflow was found and fixed in the libvips code</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/jcupitt/libvips/releases/tag/v8.6.5</url>
	</references>
	<dates>
	<discovery>2018-07-22</discovery>
	<entry>2018-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="efe43d2b-8f35-11e8-b9e8-dcfe074bd614">
	<topic>Memory leak in different components</topic>
	<affects>
	<package>
	<name>libsixel</name>
	<range><lt>1.8.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14072">
	<p>bsixel 1.8.1 has a memory leak in sixel_decoder_decode in
	decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in
	fromsixel.c and sixel_allocator_new in allocator.c</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14072</cvename>
	<cvename>CVE-2018-14073</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14072</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14073</url>
	</references>
	<dates>
	<discovery>2018-07-15</discovery>
	<entry>2018-07-24</entry>
	</dates>
	</vuln>

	<vuln vid="dc57ad48-ecbb-439b-a4d0-5869be47684e">
	<topic>vlc -- Use after free vulnerability</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><le>2.2.8_6,4</le></range>
	</package>
	<package>
	<name>vlc-qt4</name>
	<range><le>2.2.8_6,4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529">
	<p>VideoLAN VLC media player 2.2.x is prone to a use after free
	vulnerability which an attacker can leverage to execute arbitrary
	code via crafted MKV files. Failed exploit attempts will likely
	result in denial of service conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-11529</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529</url>
	<url>http://seclists.org/fulldisclosure/2018/Jul/28</url>
	<url>https://github.com/rapid7/metasploit-framework/pull/10335</url>
	<url>https://github.com/videolan/vlc-3.0/commit/c472668ff873cfe29281822b4548715fb7bb0368</url>
	<url>https://github.com/videolan/vlc-3.0/commit/d2dadb37e7acc25ae08df71e563855d6e17b5b42</url>
	</references>
	<dates>
	<discovery>2018-06-06</discovery>
	<entry>2018-07-21</entry>
	</dates>
	</vuln>

	<vuln vid="a2f35081-8a02-11e8-8fa5-4437e6ad11c4">
	<topic>mutt -- remote code injection and path traversal vulnerability</topic>
	<affects>
	<package>
	<name>mutt</name>
	<range><lt>1.10.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kevin J. McCarthy reports:</p>
	<blockquote cite="http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html">
	<p>Fixes a remote code injection vulnerability when "subscribing"
	to an IMAP mailbox, either via $imap_check_subscribed, or via the
	<subscribe> function in the browser menu. Mutt was generating a
	"mailboxes" command and sending that along to the muttrc parser.
	However, it was not escaping "`", which executes code and inserts
	the result. This would allow a malicious IMAP server to execute
	arbitrary code (for $imap_check_subscribed).</p>
	<p>Fixes POP body caching path traversal vulnerability.</p>
	<p>Fixes IMAP header caching path traversal vulnerability.</p>
	<p>CVE-2018-14349 - NO Response Heap Overflow</p>
	<p>CVE-2018-14350 - INTERNALDATE Stack Overflow</p>
	<p>CVE-2018-14351 - STATUS Literal Length relative write</p>
	<p>CVE-2018-14352 - imap_quote_string off-by-one stack overflow</p>
	<p>CVE-2018-14353 - imap_quote_string int underflow</p>
	<p>CVE-2018-14354 - imap_subscribe Remote Code Execution</p>
	<p>CVE-2018-14355 - STATUS mailbox header cache directory traversal</p>
	<p>CVE-2018-14356 - POP empty UID NULL deref</p>
	<p>CVE-2018-14357 - LSUB Remote Code Execution</p>
	<p>CVE-2018-14358 - RFC822.SIZE Stack Overflow</p>
	<p>CVE-2018-14359 - base64 decode Stack Overflow</p>
	<p>CVE-2018-14362 - POP Message Cache Directory Traversal</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14349</cvename>
	<cvename>CVE-2018-14350</cvename>
	<cvename>CVE-2018-14351</cvename>
	<cvename>CVE-2018-14352</cvename>
	<cvename>CVE-2018-14353</cvename>
	<cvename>CVE-2018-14354</cvename>
	<cvename>CVE-2018-14355</cvename>
	<cvename>CVE-2018-14356</cvename>
	<cvename>CVE-2018-14357</cvename>
	<cvename>CVE-2018-14358</cvename>
	<cvename>CVE-2018-14359</cvename>
	<cvename>CVE-2018-14362</cvename>
	<url>http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html</url>
	</references>
	<dates>
	<discovery>2018-07-15</discovery>
	<entry>2018-07-17</entry>
	</dates>
	</vuln>

	<vuln vid="fe12ef83-8b47-11e8-96cc-001a4a7ec6be">
	<topic>mutt/neomutt -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>neomutt</name>
	<range><lt>20180716</lt></range>
	</package>
	<package>
	<name>mutt</name>
	<range><lt>1.10.1</lt></range>
	</package>
	<package>
	<name>mutt14</name>
	<range><lt>*</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NeoMutt report:</p>
	<blockquote cite="https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716">
	<h1>Description</h1>
	<h5>CVE-2018-14349</h5><p>NO Response Heap Overflow</p>
	<h5>CVE-2018-14350</h5><p>INTERNALDATE Stack Overflow</p>
	<h5>CVE-2018-14351</h5><p>STATUS Literal Length relative write</p>
	<h5>CVE-2018-14352</h5><p>imap_quote_string off-by-one stack overflow</p>
	<h5>CVE-2018-14353</h5><p>imap_quote_string int underflow</p>
	<h5>CVE-2018-14354</h5><p>imap_subscribe Remote Code Execution</p>
	<h5>CVE-2018-14355</h5><p>STATUS mailbox header cache directory traversal</p>
	<h5>CVE-2018-14356</h5><p>POP empty UID NULL deref</p>
	<h5>CVE-2018-14357</h5><p>LSUB Remote Code Execution</p>
	<h5>CVE-2018-14358</h5><p>RFC822.SIZE Stack Overflow</p>
	<h5>CVE-2018-14359</h5><p>base64 decode Stack Overflow</p>
	<h5>CVE-2018-14360</h5><p>NNTP Group Stack Overflow</p>
	<h5>CVE-2018-14361</h5><p>NNTP Write 1 where via GROUP response</p>
	<h5>CVE-2018-14362</h5><p>POP Message Cache Directory Traversal</p>
	<h5>CVE-2018-14363</h5><p>NNTP Header Cache Directory Traversal</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14349</cvename>
	<cvename>CVE-2018-14350</cvename>
	<cvename>CVE-2018-14351</cvename>
	<cvename>CVE-2018-14352</cvename>
	<cvename>CVE-2018-14353</cvename>
	<cvename>CVE-2018-14354</cvename>
	<cvename>CVE-2018-14355</cvename>
	<cvename>CVE-2018-14356</cvename>
	<cvename>CVE-2018-14357</cvename>
	<cvename>CVE-2018-14358</cvename>
	<cvename>CVE-2018-14359</cvename>
	<cvename>CVE-2018-14360</cvename>
	<cvename>CVE-2018-14361</cvename>
	<cvename>CVE-2018-14362</cvename>
	<cvename>CVE-2018-14363</cvename>
	<url>https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716</url>
	</references>
	<dates>
	<discovery>2018-07-10</discovery>
	<entry>2018-07-19</entry>
	</dates>
	</vuln>

	<vuln vid="20a1881e-8a9e-11e8-bddf-d017c2ca229d">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.133</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.121.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-07-18/">
	<h1>Description</h1>
	<h5>(High) SECURITY-897 / CVE-2018-1999001</h5>
	<p>Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart </p>
	<h5>(High) SECURITY-914 / CVE-2018-1999002</h5>
	<p>Arbitrary file read vulnerability</p>
	<h5>(Medium) SECURITY-891 / CVE-2018-1999003</h5>
	<p>Unauthorized users could cancel queued builds</p>
	<h5>(Medium) SECURITY-892 / CVE-2018-1999004</h5>
	<p>Unauthorized users could initiate and abort agent launches</p>
	<h5>(Medium) SECURITY-944 / CVE-2018-1999005</h5>
	<p>Stored XSS vulnerability</p>
	<h5>(Medium) SECURITY-925 / CVE-2018-1999006</h5>
	<p>Unauthorized users are able to determine when a plugin was extracted from its JPI package</p>
	<h5>(Medium) SECURITY-390 / CVE-2018-1999007</h5>
	<p>XSS vulnerability in Stapler debug mode</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1999001</cvename>
	<cvename>CVE-2018-1999002</cvename>
	<cvename>CVE-2018-1999003</cvename>
	<cvename>CVE-2018-1999004</cvename>
	<cvename>CVE-2018-1999005</cvename>
	<cvename>CVE-2018-1999006</cvename>
	<cvename>CVE-2018-1999007</cvename>
	<url>https://jenkins.io/security/advisory/2018-07-18/</url>
	</references>
	<dates>
	<discovery>2018-07-18</discovery>
	<entry>2018-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="c6d1a8a6-8a91-11e8-be4d-005056925db4">
	<topic>znc -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>znc</name>
	<range><lt>1.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14055">
	<p>ZNC before 1.7.1-rc1 does not properly validate untrusted lines
	coming from the network, allowing a non-admin user to escalate his
	privilege and inject rogue values into znc.conf.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14056">
	<p>ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in
	a web skin name to access files outside of the intended skins
	directories.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14055</cvename>
	<cvename>CVE-2018-14056</cvename>
	<url>https://wiki.znc.in/ChangeLog/1.7.1</url>
	</references>
	<dates>
	<discovery>2018-07-14</discovery>
	<entry>2018-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="8b1a50ab-8a8e-11e8-add2-b499baebfeaf">
	<topic>Apache httpd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache project reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	<ul>
	<li>DoS for HTTP/2 connections by crafted requests
	(CVE-2018-1333). By specially crafting HTTP/2 requests, workers
	would be allocated 60 seconds longer than necessary, leading to
	worker exhaustion and a denial of service. (low)</li>
	<li>mod_md, DoS via Coredumps on specially crafted requests
	(CVE-2018-8011). By specially crafting HTTP requests, the mod_md
	challenge handler would dereference a NULL pointer and cause the
	child process to segfault. This could be used to DoS the server.
	(moderate)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
	<cvename>CVE-2018-1333</cvename>
	<cvename>CVE-2018-8011</cvename>
	</references>
	<dates>
	<discovery>2018-07-18</discovery>
	<entry>2018-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="8fc615cc-8a66-11e8-8c75-d8cb8abf62dd">
	<topic>Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import</topic>
	<affects>
	<package>
	<name>gitlab-ce</name>
	<name>gitlab</name>
	<range><ge>11.0.0</ge><lt>11.0.4</lt></range>
	<range><ge>10.8.0</ge><lt>10.8.6</lt></range>
	<range><ge>8.9.0</ge><lt>10.7.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/">
	<p>Remote Code Execution Vulnerability in GitLab Projects Import</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-14364</cvename>
	<url>https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/</url>
	</references>
	<dates>
	<discovery>2018-07-17</discovery>
	<entry>2018-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="ef013039-89cd-11e8-84e9-00e04c1ea73d">
	<topic>typo3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>typo3-7</name>
	<range><lt>7.6.30</lt></range>
	</package>
	<package>
	<name>typo3-8</name>
	<range><lt>8.7.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo3 core team reports:</p>
	<blockquote cite="https://typo3.org/article/typo3-931-8717-and-7630-security-releases-published/">
	<p>It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component)
	is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance.
	In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden
	when using MD5 as the default hashing algorithm by just knowing a valid username.
	Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.</p>
	<p>Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact
	that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored
	with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way,
	Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted
	to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by
	manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability.
	In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit
	has been identified so far.</p>
	<p>Failing to properly dissociate system related configuration from user generated configuration,
	the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation.
	Basically instructions can be persisted to a form definition file that were not configured to be modified -
	this applies to definitions managed using the form editor module as well as direct file upload using the regular
	file list module. A valid backend user account as well as having system extension form activated are needed
	in order to exploit this vulnerability.</p>
	<p>It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization
	when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents
	to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed
	to exploit this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://typo3.org/security/advisory/typo3-core-sa-2018-001/</url>
	<url>https://typo3.org/security/advisory/typo3-core-sa-2018-002/</url>
	<url>https://typo3.org/security/advisory/typo3-core-sa-2018-003/</url>
	<url>https://typo3.org/security/advisory/typo3-core-sa-2018-004/</url>
	</references>
	<dates>
	<discovery>2018-07-12</discovery>
	<entry>2018-07-17</entry>
	</dates>
	</vuln>

	<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b">
	<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
	<affects>
	<package>
	<name>bouncycastle15</name>
	<range><lt>1.60</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Legion of the Bouncy Castle reports:</p>
	<blockquote cite="https://www.bouncycastle.org/latest_releases.html">
	<p>Release 1.60 is now available for download.</p>
	<p>CVE-2018-1000180: issue around primality tests for RSA key pair
	generation if done using only the low-level API.</p>
	<p>CVE-2018-1000613: lack of class checking in deserialization
	of XMSS/XMSS^MT private keys with BDS state information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1000180</cvename>
	<cvename>CVE-2018-1000613</cvename>
	<url>https://www.bouncycastle.org/latest_releases.html</url>
	</references>
	<dates>
	<discovery>2018-06-30</discovery>
	<entry>2018-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="bd6cf187-8710-11e8-833d-18a6f7016652">
	<topic>qutebrowser -- Remote code execution due to CSRF</topic>
	<affects>
	<package>
	<name>qutebrowser</name>
	<range><ge>1.4.0</ge><lt>1.4.1</lt></range>
	<range><ge>1.0.0</ge><lt>1.3.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>qutebrowser team reports:</p>
	<blockquote cite="https://blog.qutebrowser.org/cve-2018-10895-remote-code-execution-due-to-csrf-in-qutebrowser.html">
	<p>Due to a CSRF vulnerability affecting the qute://settings page,
	it was possible for websites to modify qutebrowser settings.
	Via settings like editor.command, this possibly allowed websites
	to execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2018/q3/29</url>
	<cvename>CVE-2018-10895</cvename>
	</references>
	<dates>
	<discovery>2018-07-11</discovery>
	<entry>2018-07-14</entry>
	</dates>
	</vuln>

	<vuln vid="e78732b2-8528-11e8-9c42-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>30.0.0.134</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-24.html">
	<ul>
	<li>This update resolves an out-of-bounds read vulnerability that
	could lead to information disclosure (CVE-2018-5008).</li>
	<li>This update resolves a type confusion vulnerability that
	could lead to arbitrary code execution (CVE-2018-5007).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5007</cvename>
	<cvename>CVE-2018-5008</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-24.html</url>
	</references>
	<dates>
	<discovery>2018-07-10</discovery>
	<entry>2018-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="1e54d140-8493-11e8-a795-0028f8d09152">
	<topic>couchdb -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>couchdb</name>
	<range><lt>1.7.2,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache CouchDB PMC reports:</p>
	<blockquote cite="https://blog.couchdb.org/2018/07/10/cve-2018-8007/">
	<p>Database Administrator could achieve privilege escalation to
	the account that CouchDB runs under, by abusing insufficient validation
	in the HTTP API, escaping security controls implemented in previous
	releases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.couchdb.org/2018/07/10/cve-2018-8007/</url>
	<cvename>CVE-2018-8007</cvename>
	<url>https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/</url>
	<cvename>CVE-2017-12636</cvename>
	<cvename>CVE-2017-12635</cvename>
	<url>https://lists.apache.org/thread.html/6fa798e96686b7b0013ec2088140d00aeb7d34487d3f5ad032af6934@%3Cdev.couchdb.apache.org%3E</url>
	</references>
	<dates>
	<discovery>2017-11-14</discovery>
	<entry>2018-07-10</entry>
	</dates>
	</vuln>

	<vuln vid="3c9b7698-84da-11e8-8c75-d8cb8abf62dd">
	<topic>Libgit2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libgit2</name>
	<range><lt>0.27.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Git community reports:</p>
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.3">
	<p>Out-of-bounds reads when reading objects from a packfile</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.3</url>
	<cvename>CVE-2018-10887</cvename>
	<cvename>CVE-2018-10888</cvename>
	</references>
	<dates>
	<discovery>2018-07-09</discovery>
	<entry>2018-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="d1e9d8c5-839b-11e8-9610-9c5c8e75236a">
	<topic>clamav -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.100.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> Joel Esler reports:</p>
	<blockquote cite="https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html">
	<p>3 security fixes in this release:</p>
	<ul>
	<li>CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).</li>
	<li>CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.</li>
	<li>CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report
	ed by aCaB.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html</url>
	<cvename>CVE-2017-16932</cvename>
	<cvename>CVE-2018-0360</cvename>
	<cvename>CVE-2018-0361</cvename>
	</references>
	<dates>
	<discovery>2018-07-09</discovery>
	<entry>2018-07-09</entry>
	</dates>
	</vuln>

	<vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374">
	<topic>zziplib - multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>zziplib</name>
	<range><lt>0.13.68</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p>
	<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018">
	<p>17 security fixes in this release:</p>
	<ul>
	<li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li>
	<li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li>
	<li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function
	in memdisk.c.</li>
	<li>The zzip_mem_entry_new function in memdisk.c allows remote attackers
	to cause a denial of service (out-of-bounds read and crash) via a
	crafted ZIP file.</li>
	<li>The prescan_entry function in fseeko.c allows remote attackers to cause
	a denial of service (NULL pointer dereference and crash) via crafted
	ZIP file.</li>
	<li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer
	dereference and crash via a crafted ZIP file.</li>
	<li>seeko.c cause a denial of service (assertion failure and crash) via a
	crafted ZIP file.</li>
	<li>A segmentation fault caused by invalid memory access in the
	zzip_disk_fread function because the size variable is not validated
	against the amount of file->stored data.</li>
	<li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer
	function of zzip/zip.c.</li>
	<li>A bus error caused by loading of a misaligned address in the
	zzip_disk_findfirst function.</li>
	<li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory
	function.</li>
	<li>An invalid memory address dereference was discovered in zzip_disk_fread
	in mmapped.c.</li>
	<li>A memory leak triggered in the function zzip_mem_disk_new in
	memdisk.c.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5974</cvename>
	<cvename>CVE-2017-5975</cvename>
	<cvename>CVE-2017-5976</cvename>
	<cvename>CVE-2017-5977</cvename>
	<cvename>CVE-2017-5978</cvename>
	<cvename>CVE-2017-5979</cvename>
	<cvename>CVE-2017-5980</cvename>
	<cvename>CVE-2017-5981</cvename>
	<cvename>CVE-2018-6381</cvename>
	<cvename>CVE-2018-6484</cvename>
	<cvename>CVE-2018-6540</cvename>
	<cvename>CVE-2018-6541</cvename>
	<cvename>CVE-2018-6542</cvename>
	<cvename>CVE-2018-6869</cvename>
	<cvename>CVE-2018-7725</cvename>
	<cvename>CVE-2018-7726</cvename>
	<cvename>CVE-2018-7727</cvename>
	<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"</url>
	</references>
	<dates>
	<discovery>2017-03-01</discovery>
	<entry>2018-07-06</entry>
	</dates>
	</vuln>

	<vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.7,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>4.9.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpressdevelopers reports:</p>
	<blockquote cite="https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/">
	<p>Taxonomy: Improve cache handling for term queries.</p>
	<p>Posts, Post Types: Clear post password cookie when logging out.</p>
	<p>Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.</p>
	<p>Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.</p>
	<p>Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-07-05</discovery>
	<entry>2018-07-08</entry>
	</dates>
	</vuln>

	<vuln vid="bfd5d004-81d4-11e8-a29a-00e04c1ea73d">
	<topic>mybb -- vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.8.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mybb Team reports:</p>
	<blockquote cite="https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/">
	<p>High risk: Image and URL MyCode Persistent XSS</p>
	<p>Medium risk: Multipage Reflected XSS</p>
	<p>Low risk: ACP logs XSS</p>
	<p>Low risk: Arbitrary file deletion via ACP’s Settings</p>
	<p>Low risk: Login CSRF</p>
	<p>Low risk: Non-video content embedding via Video MyCode</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-07-04</discovery>
	<entry>2018-07-07</entry>
	</dates>
	</vuln>

	<vuln vid="e375ff3f-7fec-11e8-8088-28d244aee256">
	<topic>expat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>expat</name>
	<range><lt>2.2.1</lt></range>
	</package>
	<package>
	<name>libwww</name>
	<range><lt>5.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063">
	<p>An integer overflow during the parsing of XML using the Expat library.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233">
	<p>XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat
	XML Parser Library) allows attackers to put the parser in an infinite
	loop using a malformed external entity definition from an external DTD.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9063</cvename>
	<cvename>CVE-2017-9233</cvename>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063</url>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233</url>
	<url>https://libexpat.github.io/doc/cve-2017-9233/</url>
	</references>
	<dates>
	<discovery>2016-10-27</discovery>
	<entry>2018-07-05</entry>
	</dates>
	</vuln>

	<vuln vid="ce39379f-7eb7-11e8-ab03-00bd7f19ff09">
	<topic>h2o -- heap buffer overflow during logging</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range><lt>2.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marlies Ruck reports:</p>
	<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.5">
	<p>Fix heap buffer overflow while trying to emit access log
	- see references for full details.</p>
	<p>CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and
	earlier allows remote attackers to execute arbitrary code or
	cause a denial of service (DoS) via unspecified vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-0608</cvename>
	<url>https://github.com/h2o/h2o/issues/1775</url>
	<url>https://github.com/h2o/h2o/releases/tag/v2.2.5</url>
	</references>
	<dates>
	<discovery>2018-06-01</discovery>
	<entry>2018-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="c1630aa3-7970-11e8-8634-dcfe074bd614">
	<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
	<affects>
	<package>
	<name>upp</name>
	<range><le>11540</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
	<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
	statement could cause a NULL pointer dereference, related to build.c
	and prepare.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-8740</cvename>
	<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
	</references>
	<dates>
	<discovery>2018-03-16</discovery>
	<entry>2018-07-01</entry>
	</dates>
	</vuln>

	<vuln vid="cd81806c-26e7-4d4a-8425-02724a2f48af">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>61.0_1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.2.1.19_2</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.4</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><ge>60.0,1</ge><lt>60.1.0_1,1</lt></range>
	<range><lt>52.9.0_1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.9.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.9.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/">
	<p>CVE-2018-12359: Buffer overflow using computed size of canvas element</p>
	<p>CVE-2018-12360: Use-after-free when using focus()</p>
	<p>CVE-2018-12361: Integer overflow in SwizzleData</p>
	<p>CVE-2018-12358: Same-origin bypass using service worker and redirection</p>
	<p>CVE-2018-12362: Integer overflow in SSSE3 scaler</p>
	<p>CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture</p>
	<p>CVE-2018-12363: Use-after-free when appending DOM nodes</p>
	<p>CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins</p>
	<p>CVE-2018-12365: Compromised IPC child process can list local filenames</p>
	<p>CVE-2018-12371: Integer overflow in Skia library during edge builder allocation</p>
	<p>CVE-2018-12366: Invalid data handling during QCMS transformations</p>
	<p>CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming</p>
	<p>CVE-2018-12368: No warning when opening executable SettingContent-ms files</p>
	<p>CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments</p>
	<p>CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View</p>
	<p>CVE-2018-5186: Memory safety bugs fixed in Firefox 61</p>
	<p>CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1</p>
	<p>CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5156</cvename>
	<cvename>CVE-2018-5186</cvename>
	<cvename>CVE-2018-5187</cvename>
	<cvename>CVE-2018-5188</cvename>
	<cvename>CVE-2018-12358</cvename>
	<cvename>CVE-2018-12359</cvename>
	<cvename>CVE-2018-12360</cvename>
	<cvename>CVE-2018-12361</cvename>
	<cvename>CVE-2018-12362</cvename>
	<cvename>CVE-2018-12363</cvename>
	<cvename>CVE-2018-12364</cvename>
	<cvename>CVE-2018-12365</cvename>
	<cvename>CVE-2018-12366</cvename>
	<cvename>CVE-2018-12367</cvename>
	<cvename>CVE-2018-12368</cvename>
	<cvename>CVE-2018-12369</cvename>
	<cvename>CVE-2018-12370</cvename>
	<cvename>CVE-2018-12371</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/</url>
	</references>
	<dates>
	<discovery>2018-06-26</discovery>
	<entry>2018-06-26</entry>
	<modified>2018-07-07</modified>
	</dates>
	</vuln>

	<vuln vid="739948e3-78bf-11e8-b23c-080027ac955c">
	<topic>mailman -- hardening against malicious listowners injecting evil HTML scripts</topic>
	<affects>
	<package> <name>mailman</name> <range><lt>2.1.27</lt></range> </package>
	<package> <name>mailman-with-htdig</name> <range><lt>2.1.27</lt></range> </package>
	<package> <name>ja-mailman</name> <range><lt>2.1.14.j7_5,1</lt></range> </package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Sapiro reports:</p>
	<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8">
	<p>Existing protections against malicious listowners injecting evil
	scripts into listinfo pages have had a few more checks added.
	</p>
	<p>A few more error messages have had their values HTML escaped.</p>
	<p>The hash generated when SUBSCRIBE_FORM_SECRET is set could have been
	the same as one generated at the same time for a different list and
	IP address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8</url>
	<url>https://www.mail-archive.com/mailman-users@python.org/</url>
	<cvename>CVE-2018-0618</cvename>
	</references>
	<dates>
	<discovery>2018-03-09</discovery> <!-- Launchpad rev. 1747 -->
	<entry>2018-06-25</entry>
	</dates>
	</vuln>

	<vuln vid="b950a83b-789e-11e8-8545-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>11.0.0</ge><lt>11.0.1</lt></range>
	<range><ge>10.8.0</ge><lt>10.8.5</lt></range>
	<range><ge>4.1</ge><lt>10.7.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/">
	<p>Wiki XSS</p>
	<p>Sanitize gem updates</p>
	<p>XSS in url_for(params)</p>
	<p>Content injection via username</p>
	<p>Activity feed publicly displaying internal project names</p>
	<p>Persistent XSS in charts</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-12606</cvename>
	<cvename>CVE-2018-3740</cvename>
	<cvename>CVE-2018-12605</cvename>
	<cvename>CVE-2018-12607</cvename>
	<url>https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/</url>
	</references>
	<dates>
	<discovery>2018-06-25</discovery>
	<entry>2018-06-25</entry>
	</dates>
	</vuln>

	<vuln vid="17cb6ff3-7670-11e8-8854-6805ca0b3d42">
	<topic>phpmyadmin -- remote code inclusion and XSS scripting</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><lt>4.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-3/">
	<h3>Summary</h3>
	<p>XSS in Designer feature</p>
	<h3>Description</h3>
	<p>A Cross-Site Scripting vulnerability was found in the
	Designer feature, where an attacker can deliver a
	payload to a user through a specially-crafted database
	name.</p>
	<h3>Severity</h3>
	<p>We consider this attack to be of moderate severity.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-4/">
	<h3>Summary</h3>
	<p>File inclusion and remote code execution attack</p>
	<h3>Description</h3>
	<p>A flaw has been discovered where an attacker can include
	(view and potentially execute) files on the server.</p>
	<p>The vulnerability comes from a portion of code where
	pages are redirected and loaded within phpMyAdmin, and an
	improper test for whitelisted pages.</p>
	<p>An attacker must be authenticated, except in these
	situations:</p>
	<ul>
	<li>$cfg['AllowArbitraryServer'] = true: attacker can
	specify any host he/she is already in control of, and
	execute arbitrary code on phpMyAdmin</li>
	<li>$cfg['ServerDefault'] = 0: this bypasses the login and
	runs the vulnerable code without any authentication</li>
	</ul>
	<h3>Severity</h3>
	<p>We consider this to be severe.</p> <h3>Mitigation
	factor</h3> <p>Configuring PHP with a restrictive
	`open_basedir` can greatly restrict an attacker's ability to
	view files on the server. Vulnerable systems should not be
	run with the phpMyAdmin directives
	$cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault']
	= 0</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-3/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-4/</url>
	<cvename>CVE-2018-12581</cvename>
	<cvename>CVE-2018-12613</cvename>
	</references>
	<dates>
	<discovery>2018-06-21</discovery>
	<entry>2018-06-22</entry>
	</dates>
	</vuln>

	<vuln vid="4e07d94f-75a5-11e8-85d1-a4badb2f4699">
	<topic>FreeBSD -- Lazy FPU State Restore Information Disclosure</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A subset of Intel processors can allow a local thread
	to infer data from another thread through a speculative
	execution side channel when Lazy FPU state restore is
	used.</p>
	<h1>Impact:</h1>
	<p>Any local thread can potentially read FPU state information
	from other threads running on the host. This could include
	cryptographic keys when the AES-NI CPU feature is present.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-3665</cvename>
	<freebsdsa>SA-18:07.lazyfpu</freebsdsa>
	</references>
	<dates>
	<discovery>2018-06-21</discovery>
	<entry>2018-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba">
	<topic>GraphicsMagick -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>GraphicsMagick</name>
	<range><lt>1.3.26,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GraphicsMagick reports:</p>
	<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
	<p>Multiple vulnerabilities have been found in GraphicsMagick 1.3.26
	or earlier. Please refer to the CVE list for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.graphicsmagick.org/NEWS.html</url>
	<cvename>CVE-2016-7800</cvename>
	<cvename>CVE-2016-7996</cvename>
	<cvename>CVE-2016-7997</cvename>
	<cvename>CVE-2016-9830</cvename>
	<cvename>CVE-2017-6335</cvename>
	<cvename>CVE-2017-8350</cvename>
	<cvename>CVE-2017-10794</cvename>
	<cvename>CVE-2017-10799</cvename>
	<cvename>CVE-2017-10800</cvename>
	</references>
	<dates>
	<discovery>2017-07-04</discovery>
	<entry>2018-06-18</entry>
	</dates>
	</vuln>

	<vuln vid="3a66cb69-716f-11e8-be54-3085a9a47796">
	<topic>slurm -- insecure handling of user_name and gid fields</topic>
	<affects>
	<package>
	<name>slurm-wlm</name>
	<range><lt>17.02.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SchedMD reports:</p>
	<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html">
	<h1>Insecure handling of user_name and gid fields (CVE-2018-10995)</h1>
	<p>While fixes are only available for the supported 17.02 and 17.11
	releases, it is believed that similar vulnerabilities do affect past
	versions as well. The only resolution is to upgrade Slurm to a fixed
	release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html</url>
	</references>
	<dates>
	<discovery>2018-05-30</discovery>
	<entry>2018-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="45b8e2eb-7056-11e8-8fab-63ca6e0e13a2">
	<topic>node.js -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node6</name>
	<range><lt>6.14.3</lt></range>
	</package>
	<package>
	<name>node8</name>
	<range><lt>8.11.3</lt></range>
	</package>
	<package>
	<name>node</name>
	<range><lt>10.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js reports:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/">
	<h1>Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)</h1>
	<p>All versions of 8.x and later are vulnerable and the severity is
	HIGH. An attacker can cause a denial of service (DoS) by causing a
	node server providing an http2 server to crash. This can be
	accomplished by interacting with the http2 server in a manner that
	triggers a cleanup bug where objects are used in native code after
	they are no longer available. This has been addressed by updating
	the http2 implementation. Thanks to Jordan Zebor at F5 Networks for
	reporting this issue.</p>
	<h1>Denial of Service, nghttp2 dependency (CVE-2018-1000168)</h1>
	<p>All versions of 9.x and later are vulnerable and the severity is
	HIGH. Under certain conditions, a malicious client can trigger an
	uninitialized read (and a subsequent segfault) by sending a
	malformed ALTSVC frame. This has been addressed through an by
	updating nghttp2.</p>
	<h1>Denial of Service Vulnerability in TLS (CVE-2018-7162)</h1>
	<p>All versions of 9.x and later are vulnerable and the severity is
	HIGH. An attacker can cause a denial of service (DoS) by causing a
	node process which provides an http server supporting TLS server to
	crash. This can be accomplished by sending duplicate/unexpected
	messages during the handshake. This vulnerability has been addressed
	by updating the TLS implementation. Thanks to Jordan Zebor at F5
	Networks all of his help investigating this issue with the Node.js
	team.</p>
	<h1>Memory exhaustion DoS on v9.x (CVE-2018-7164)</h1>
	<p>Versions 9.7.0 and later are vulnerable and the severity is MEDIUM.
	A bug introduced in 9.7.0 increases the memory consumed when reading
	from the network into JavaScript using the net.Socket object
	directly as a stream. An attacker could use this cause a denial of
	service by sending tiny chunks of data in short succession. This
	vulnerability was restored by reverting to the prior behaviour.</p>
	<h1>Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)</h1>
	<p>Calling Buffer.fill() or Buffer.alloc() with some parameters can
	lead to a hang which could result in a Denial of Service. In order
	to address this vulnerability, the implementations of Buffer.alloc()
	and Buffer.fill() were updated so that they zero fill instead of
	hanging in these cases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/</url>
	<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
	<cvename>CVE-2018-7161</cvename>
	<cvename>CVE-2018-7162</cvename>
	<cvename>CVE-2018-7164</cvename>
	<cvename>CVE-2018-7167</cvename>
	<cvename>CVE-2018-1000168</cvename>
	</references>
	<dates>
	<discovery>2018-06-12</discovery>
	<entry>2018-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec">
	<topic>password-store -- GPG parsing vulnerabilities</topic>
	<affects>
	<package>
	<name>password-store</name>
	<range><lt>1.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason A. Donenfeld reports:</p>
	<blockquote cite="https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html">
	<p>Markus Brinkmann discovered that [the] parsing of gpg command line
	output with regexes isn't anchored to the beginning of the line,
	which means an attacker can generate a malicious key that simply has
	the verification string as part of its username.</p>
	<p>This has a number of nasty consequences:</p>
	<ul>
	<li>an attacker who manages to write into your ~/.password-store
	and also inject a malicious key into your keyring can replace
	your .gpg-id key and have your passwords encrypted under
	additional keys;</li>
	<li>if you have extensions enabled (disabled by default), an
	attacker who manages to write into your ~/.password-store and
	also inject a malicious key into your keyring can replace your
	extensions and hence execute code.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html</url>
	<cvename>CVE-2018-12356</cvename>
	</references>
	<dates>
	<discovery>2018-06-14</discovery>
	<entry>2018-06-14</entry>
	</dates>
	</vuln>

	<vuln vid="9b5162de-6f39-11e8-818e-e8e0b747a45a">
	<topic>libgcrypt -- side-channel attack vulnerability</topic>
	<affects>
	<package>
	<name>libgcrypt</name>
	<range><lt>1.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuPG reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495">
	<p>Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-0495</cvename>
	<url>https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495</url>
	<url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt</url>
	</references>
	<dates>
	<discovery>2018-06-13</discovery>
	<entry>2018-06-13</entry>
	<modified>2018-06-14</modified>
	</dates>
	</vuln>

	<vuln vid="c82ecac5-6e3f-11e8-8777-b499baebfeaf">
	<topic>OpenSSL -- Client DoS due to large DH parameter</topic>
	<affects>
	<package>
	<name>libressl</name>
	<name>libressl-devel</name>
	<range><lt>2.6.5</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
	</package>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2o_4,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0h_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20180612.txt">
	<p>During key agreement in a TLS handshake using a DH(E) based
	ciphersuite a malicious server can send a very large prime value
	to the client. This will cause the client to spend an unreasonably
	long period of time generating a key for this prime resulting in a
	hang until the client has finished. This could be exploited in a
	Denial Of Service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20180612.txt</url>
	<cvename>CVE-2018-0732</cvename>
	</references>
	<dates>
	<discovery>2018-06-12</discovery>
	<entry>2018-06-12</entry>
	<modified>2018-07-24</modified>
	</dates>
	</vuln>

	<vuln vid="0137167b-6dca-11e8-a671-001999f8d30b">
	<topic>asterisk -- PJSIP endpoint presence disclosure when using ACL</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.21.1</lt></range>
	</package>
	<package>
	<name>asterisk15</name>
	<range><lt>15.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p> When endpoint specific ACL rules block a SIP request
	they respond with a 403 forbidden. However, if an endpoint
	is not identified then a 401 unauthorized response is
	sent. This vulnerability just discloses which requests
	hit a defined endpoint. The ACL rules cannot be bypassed
	to gain access to the disclosed endpoints.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-008.html</url>
	</references>
	<dates>
	<discovery>2018-06-11</discovery>
	<entry>2018-06-11</entry>
	</dates>
	</vuln>

	<vuln vid="f14ce57f-6dc8-11e8-a671-001999f8d30b">
	<topic>asterisk -- Infinite loop when reading iostreams</topic>
	<affects>
	<package>
	<name>asterisk15</name>
	<range><lt>15.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>When connected to Asterisk via TCP/TLS if the client
	abruptly disconnects, or sends a specially crafted message
	then Asterisk gets caught in an infinite loop while trying
	to read the data stream. Thus rendering the system as
	unusable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-007.html</url>
	</references>
	<dates>
	<discovery>2018-06-11</discovery>
	<entry>2018-06-11</entry>
	</dates>
	</vuln>

	<vuln vid="4cb49a23-6c89-11e8-8b33-e8e0b747a45a">
	<topic>chromium -- Incorrect handling of CSP header</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>67.0.3396.79</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html">
	<p>1 security fix contributed by external researchers:</p>
	<ul>
	<li>[845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6148</cvename>
	<url>https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2018-06-06</discovery>
	<entry>2018-06-10</entry>
	</dates>
	</vuln>

	<vuln vid="7da0417f-6b24-11e8-84cc-002590acae31">
	<topic>gnupg -- unsanitized output (CVE-2018-12020)</topic>
	<affects>
	<package>
	<name>gnupg</name>
	<range><lt>2.2.8</lt></range>
	</package>
	<package>
	<name>gnupg1</name>
	<range><lt>1.4.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuPG reports:</p>
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html">
	<p>GnuPG did not sanitize input file names, which may then be output to
	the terminal. This could allow terminal control sequences or fake
	status messages to be injected into the output.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020</url>
	<cvename>CVE-2018-12020</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526</url>
	<cvename>CVE-2017-7526</cvename>
	</references>
	<dates>
	<discovery>2018-06-07</discovery>
	<entry>2018-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7">
	<topic>firefox -- Heap buffer overflow rasterizing paths in SVG with Skia</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>60.0.2,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.2.0.13_5</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.8.1,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/">
	<p>A heap buffer overflow can occur in the Skia library when
	rasterizing paths using a maliciously crafted SVG file
	with anti-aliasing turned off. This results in a
	potentially exploitable crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-14/</url>
	</references>
	<dates>
	<discovery>2018-06-06</discovery>
	<entry>2018-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="2dde5a56-6ab1-11e8-b639-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>30.0.0.113</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-19.html">
	<ul>
	<li>This update resolves a type confusion vulnerability that
	could lead to arbitrary code execution (CVE-2018-4945).</li>
	<li>This update resolves an integer overflow vulnerability that
	could lead to information disclosure (CVE-2018-5000).</li>
	<li>This update resolves an out-of-bounds read vulnerability that
	could lead to information disclosure (CVE-2018-5001).</li>
	<li>This update resolves a stack-based buffer overflow vulnerability that
	could lead to arbitrary code execution (CVE-2018-5002).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4945</cvename>
	<cvename>CVE-2018-5000</cvename>
	<cvename>CVE-2018-5001</cvename>
	<cvename>CVE-2018-5002</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-19.html</url>
	</references>
	<dates>
	<discovery>2018-06-07</discovery>
	<entry>2018-06-07</entry>
	<modified>2018-07-11</modified>
	</dates>
	</vuln>

	<vuln vid="2f4fd3aa-32f8-4116-92f2-68f05398348e">
	<topic>bro -- multiple memory allocation issues</topic>
	<affects>
	<package>
	<name>bro</name>
	<range><lt>2.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Corelight reports:</p>
	<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
	<p>Bro 2.5.4 primarily fixes security issues</p>
	<p>Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.</p>
	<p>The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.bro.org/download/NEWS.bro.html</url>
	</references>
	<dates>
	<discovery>2018-05-29</discovery>
	<entry>2018-06-06</entry>
	</dates>
	</vuln>

	<vuln vid="5a1589ad-68f9-11e8-83f5-d8cb8abf62dd">
	<topic>Libgit2 -- Fixing insufficient validation of submodule names</topic>
	<affects>
	<package>
	<name>libgit2</name>
	<name>py-pygit2</name>
	<range><lt>0.27.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Git community reports:</p>
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.1">
	<p>Insufficient validation of submodule names</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.1</url>
	<cvename>CVE-2018-11235</cvename>
	</references>
	<dates>
	<discovery>2018-05-29</discovery>
	<entry>2018-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="c7a135f4-66a4-11e8-9e63-3085a9a47796">
	<topic>Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235)</topic>
	<affects>
	<package>
	<name>git</name>
	<name>git-lite</name>
	<range><lt>2.13.7</lt></range>
	<range><ge>2.14</ge><lt>2.14.4</lt></range>
	<range><ge>2.15</ge><lt>2.15.2</lt></range>
	<range><ge>2.16</ge><lt>2.16.4</lt></range>
	<range><ge>2.17</ge><lt>2.17.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Git community reports:</p>
	<blockquote cite="https://marc.info/?l=git&m=152761328506724&=2">
	<ul><li>In affected versions of Git, code to sanity-check pathnames on
	NTFS can result in reading out-of-bounds memory.</li>
	<li>In affected versions of Git, remote code execution can
	occur. With a crafted .gitmodules file, a malicious project can
	execute an arbitrary script on a machine that runs "git clone
	--recurse-submodules" because submodule "names" are obtained from
	this file, and then appended to $GIT_DIR/modules, leading to
	directory traversal with "../" in a name. Finally, post-checkout
	hooks from a submodule are executed, bypassing the intended design
	in which hooks are not obtained from a remote server.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233</url>
	<cvename>CVE-2018-11233</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235</url>
	<cvename>CVE-2018-11235</cvename>
	</references>
	<dates>
	<discovery>2018-05-29</discovery>
	<entry>2018-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="9557dc72-64da-11e8-bc32-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>10.8.0</ge><lt>10.8.2</lt></range>
	<range><ge>10.7.0</ge><lt>10.7.5</lt></range>
	<range><ge>1.0</ge><lt>10.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/">
	<p>Removing public deploy keys regression</p>
	<p>Users can update their password without entering current password</p>
	<p>Persistent XSS - Selecting users as allowed merge request approvers</p>
	<p>Persistent XSS - Multiple locations of user selection drop downs</p>
	<p>include directive in .gitlab-ci.yml allows SSRF requests</p>
	<p>Permissions issue in Merge Requests Create Service</p>
	<p>Arbitrary assignment of project fields using "Import project"</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/</url>
	</references>
	<dates>
	<discovery>2018-05-29</discovery>
	<entry>2018-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="7fc3e827-64a5-11e8-aedb-00224d821998">
	<topic>strongswan -- Fix Denial-of-Service Vulnerability strongSwan (CVE-2018-10811, CVE-2018-5388)</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><lt>5.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>strongSwan security team reports:</p>
	<blockquote cite="https://www.strongswan.org/blog/2018/05/28/strongswan-5.6.3-released.html">
	<ul><li>A denial-of-service vulnerability in the IKEv2 key derivation was fixed
	if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as
	PRF (which is not FIPS-compliant). So this should only affect very specific setups,
	but in such configurations all strongSwan versions since 5.0.1 may be affected.</li>
	<li>A denial-of-service vulnerability in the stroke plugin was fixed.
	When reading a message from the socket the plugin did not check the received length.
	Unless a group is configured, root privileges are required to access that socket,
	so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected.
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html</url>
	<cvename>CVE-2018-10811</cvename>
	<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-5388).html</url>
	<cvename>CVE-2018-5388</cvename>
	</references>
	<dates>
	<discovery>2018-05-16</discovery>
	<entry>2018-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="427b0f58-644c-11e8-9e1b-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>67.0.3396.62</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html">
	<p>34 security fixes in this release, including:</p>
	<ul>
	<li>[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22</li>
	<li>[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07</li>
	<li>[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05</li>
	<li>[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18</li>
	<li>[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15</li>
	<li>[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09</li>
	<li>[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01</li>
	<li>[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30</li>
	<li>[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27</li>
	<li>[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04</li>
	<li>[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28</li>
	<li>[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23</li>
	<li>[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19</li>
	<li>[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12</li>
	<li>[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21</li>
	<li>[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08</li>
	<li>[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24</li>
	<li>[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01</li>
	<li>[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19</li>
	<li>[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28</li>
	<li>[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15</li>
	<li>[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02</li>
	<li>[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25</li>
	<li>[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02</li>
	<li>[847542] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6123</cvename>
	<cvename>CVE-2018-6124</cvename>
	<cvename>CVE-2018-6125</cvename>
	<cvename>CVE-2018-6126</cvename>
	<cvename>CVE-2018-6127</cvename>
	<cvename>CVE-2018-6128</cvename>
	<cvename>CVE-2018-6129</cvename>
	<cvename>CVE-2018-6130</cvename>
	<cvename>CVE-2018-6131</cvename>
	<cvename>CVE-2018-6132</cvename>
	<cvename>CVE-2018-6133</cvename>
	<cvename>CVE-2018-6134</cvename>
	<cvename>CVE-2018-6135</cvename>
	<cvename>CVE-2018-6136</cvename>
	<cvename>CVE-2018-6137</cvename>
	<cvename>CVE-2018-6138</cvename>
	<cvename>CVE-2018-6139</cvename>
	<cvename>CVE-2018-6140</cvename>
	<cvename>CVE-2018-6141</cvename>
	<cvename>CVE-2018-6142</cvename>
	<cvename>CVE-2018-6143</cvename>
	<cvename>CVE-2018-6144</cvename>
	<cvename>CVE-2018-6145</cvename>
	<cvename>CVE-2018-6147</cvename>
	<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html</url>
	</references>
	<dates>
	<discovery>2018-05-29</discovery>
	<entry>2018-05-30</entry>
	</dates>
	</vuln>

	<vuln vid="94599fe0-5ca3-11e8-8be1-d05099c0ae8c">
	<topic>BIND -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bind912</name>
	<range><lt>9.12.1P2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01602">
	<p>An error in zone database reference counting can
	lead to an assertion failure if a server which is
	running an affected version of BIND attempts
	several transfers of a slave zone in quick
	succession.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01606">
	<p>A problem with the implementation of the new
	serve-stale feature in BIND 9.12 can lead to
	an assertion failure in rbtdb.c, even when
	stale-answer-enable is off. Additionally,
	problematic interaction between the serve-stale
	feature and NSEC aggressive negative caching can
	in some cases cause undesirable behavior from named,
	such as a recursion loop or excessive logging.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5736</cvename>
	<cvename>CVE-2018-5737</cvename>
	<url>https://kb.isc.org/article/AA-01602</url>
	<url>https://kb.isc.org/article/AA-01606</url>
	</references>
	<dates>
	<discovery>2018-05-18</discovery>
	<entry>2018-05-21</entry>
	</dates>
	</vuln>

	<vuln vid="04fe6c8d-2a34-4009-a81e-e7a7e759b5d2">
	<topic>cURL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.60.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL security problems:</p>
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	<p>CVE-2018-1000300: FTP shutdown response buffer overflow</p>
	<p>curl might overflow a heap based memory buffer when closing down an
	FTP connection with very long server command replies.</p>
	<p>When doing FTP transfers, curl keeps a spare "closure handle" around
	internally that will be used when an FTP connection gets shut down
	since the original curl easy handle is then already removed.</p>
	<p>FTP server response data that gets cached from the original transfer
	might then be larger than the default buffer size (16 KB) allocated in
	the "closure handle", which can lead to a buffer overwrite. The
	contents and size of that overwrite is controllable by the server.</p>
	<p>This situation was detected by an assert() in the code, but that was
	of course only preventing bad stuff in debug builds. This bug is very
	unlikely to trigger with non-malicious servers.</p>
	<p>We are not aware of any exploit of this flaw.</p>
	<p>CVE-2018-1000301: RTSP bad headers buffer over-read</p>
	<p>curl can be tricked into reading data beyond the end of a heap based
	buffer used to store downloaded content.</p>
	<p>When servers send RTSP responses back to curl, the data starts out
	with a set of headers. curl parses that data to separate it into a
	number of headers to deal with those appropriately and to find the end
	of the headers that signal the start of the "body" part.</p>
	<p>The function that splits up the response into headers is called
	Curl_http_readwrite_headers() and in situations where it can't find a
	single header in the buffer, it might end up leaving a pointer pointing
	into the buffer instead of to the start of the buffer which then later
	on may lead to an out of buffer read when code assumes that pointer
	points to a full buffer size worth of memory to use.</p>
	<p>This could potentially lead to information leakage but most likely a
	crash/denial of service for applications if a server triggers this flaw.</p>
	<p>We are not aware of any exploit of this flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/security.html</url>
	<url>https://curl.haxx.se/docs/adv_2018-82c2.html</url>
	<url>https://curl.haxx.se/docs/adv_2018-b138.html</url>
	<cvename>CVE-2018-1000300</cvename>
	<cvename>CVE-2018-1000301</cvename>
	</references>
	<dates>
	<discovery>2018-05-16</discovery>
	<entry>2018-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
	<topic>wavpack -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wavpack</name>
	<range><lt>5.1.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Ramacher reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
	<p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
	<p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
	<p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p>
	</blockquote>
	<p>Thuan Pham reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
	<p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
	<p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
	<p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
	<p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
	<p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6767</cvename>
	<cvename>CVE-2018-7253</cvename>
	<cvename>CVE-2018-7254</cvename>
	<cvename>CVE-2018-10536</cvename>
	<cvename>CVE-2018-10537</cvename>
	<cvename>CVE-2018-10538</cvename>
	<cvename>CVE-2018-10539</cvename>
	<cvename>CVE-2018-10540</cvename>
	<url>https://www.debian.org/security/2018/dsa-4125</url>
	<url>https://www.debian.org/security/2018/dsa-4197</url>
	<freebsdpr>228141</freebsdpr>
	</references>
	<dates>
	<discovery>2018-05-09</discovery>
	<entry>2018-05-11</entry>
	</dates>
	</vuln>

	<vuln vid="e457978b-5484-11e8-9b85-54ee754af08e">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>66.0.3359.170</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html">
	<p>4 security fixes in this release:</p>
	<ul>
	<li>[835887] Critical: Chain leading to sandbox escape.
	Reported by Anonymous on 2018-04-23</li>
	<li>[836858] High CVE-2018-6121: Privilege Escalation in extensions</li>
	<li>[836141] High CVE-2018-6122: Type confusion in V8</li>
	<li>[833721] High CVE-2018-6120: Heap buffer overflow in PDFium.
	Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17</li>
	<li>[841841] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6120</cvename>
	<cvename>CVE-2018-6121</cvename>
	<cvename>CVE-2018-6122</cvename>
	<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2018-04-14</discovery>
	<entry>2018-05-11</entry>
	</dates>
	</vuln>

	<vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>2.120</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>2.107.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins developers report:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-05-09/">
	<p>The agent to master security subsystem ensures that the Jenkins
	master is protected from maliciously configured agents. A path
	traversal vulnerability allowed agents to escape whitelisted
	directories to read and write to files they should not be able to
	access.</p>
	<p>Black Duck Hub Plugin's API endpoint was affected by an XML
	External Entity (XXE) processing vulnerability. This allowed an
	attacker with Overall/Read access to have Jenkins parse a maliciously
	crafted file that uses external entities for extraction of secrets
	from the Jenkins master, server-side request forgery, or
	denial-of-service attacks.</p>
	<p>Several other lower severity issues were reported, see reference
	url for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2018-05-09/</url>
	</references>
	<dates>
	<discovery>2018-05-09</discovery>
	<entry>2018-05-10</entry>
	</dates>
	</vuln>

	<vuln vid="5aefc41e-d304-4ec8-8c82-824f84f08244">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>60.0,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.1.0_18</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.4</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.8.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.8.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">
	<p>CVE-2018-5183: Backport critical security fixes in Skia</p>
	<p>CVE-2018-5154: Use-after-free with SVG animations and clip paths</p>
	<p>CVE-2018-5155: Use-after-free with SVG animations and text paths</p>
	<p>CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files</p>
	<p>CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer</p>
	<p>CVE-2018-5159: Integer overflow and out-of-bounds write in Skia</p>
	<p>CVE-2018-5160: Uninitialized memory use by WebRTC encoder</p>
	<p>CVE-2018-5152: WebExtensions information leak through webRequest API</p>
	<p>CVE-2018-5153: Out-of-bounds read in mixed content websocket messages</p>
	<p>CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache</p>
	<p>CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace</p>
	<p>CVE-2018-5166: WebExtension host permission bypass through filterReponseData</p>
	<p>CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger</p>
	<p>CVE-2018-5168: Lightweight themes can be installed without user interaction</p>
	<p>CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages</p>
	<p>CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer</p>
	<p>CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters</p>
	<p>CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update</p>
	<p>CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies</p>
	<p>CVE-2018-5176: JSON Viewer script injection</p>
	<p>CVE-2018-5177: Buffer overflow in XSLT during number formatting</p>
	<p>CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox</p>
	<p>CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension</p>
	<p>CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced</p>
	<p>CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink</p>
	<p>CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar</p>
	<p>CVE-2018-5151: Memory safety bugs fixed in Firefox 60</p>
	<p>CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5150</cvename>
	<cvename>CVE-2018-5151</cvename>
	<cvename>CVE-2018-5152</cvename>
	<cvename>CVE-2018-5153</cvename>
	<cvename>CVE-2018-5154</cvename>
	<cvename>CVE-2018-5155</cvename>
	<cvename>CVE-2018-5157</cvename>
	<cvename>CVE-2018-5158</cvename>
	<cvename>CVE-2018-5159</cvename>
	<cvename>CVE-2018-5160</cvename>
	<cvename>CVE-2018-5163</cvename>
	<cvename>CVE-2018-5164</cvename>
	<cvename>CVE-2018-5165</cvename>
	<cvename>CVE-2018-5166</cvename>
	<cvename>CVE-2018-5167</cvename>
	<cvename>CVE-2018-5168</cvename>
	<cvename>CVE-2018-5169</cvename>
	<cvename>CVE-2018-5172</cvename>
	<cvename>CVE-2018-5173</cvename>
	<cvename>CVE-2018-5174</cvename>
	<cvename>CVE-2018-5175</cvename>
	<cvename>CVE-2018-5176</cvename>
	<cvename>CVE-2018-5177</cvename>
	<cvename>CVE-2018-5178</cvename>
	<cvename>CVE-2018-5180</cvename>
	<cvename>CVE-2018-5181</cvename>
	<cvename>CVE-2018-5182</cvename>
	<cvename>CVE-2018-5183</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-11/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-12/</url>
	</references>
	<dates>
	<discovery>2018-05-09</discovery>
	<entry>2018-05-09</entry>
	</dates>
	</vuln>

	<vuln vid="5af6378b-bd88-4997-bccc-b9ba2daecdd2">
	<topic>kamailio - buffer overflow</topic>
	<affects>
	<package>
	<name>kamailio</name>
	<range><lt>5.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A specially crafted REGISTER message with a malformed branch or
	From tag triggers an off-by-one heap-based buffer overflow in the
	tmx_check_pretran function in modules/tmx/tmx_pretran.c</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-8828</cvename>
	<url>https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/</url>
	<url>https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow</url>
	</references>
	<dates>
	<discovery>2018-02-10</discovery>
	<entry>2018-05-06</entry>
	</dates>
	</vuln>

	<vuln vid="7b5a8e3b-52cc-11e8-8c7a-9c5c8e75236a">
	<topic>wget -- cookie injection vulnerability</topic>
	<affects>
	<package>
	<name>wget</name>
	<range><lt>1.19.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Harry Sintonen of F-Secure Corporation reports:</p>
	<blockquote cite="https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt">
	<p>GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt</url>
	<cvename>CVE-2018-0494</cvename>
	<freebsdpr>ports/228071</freebsdpr>
	</references>
	<dates>
	<discovery>2018-04-26</discovery>
	<entry>2018-05-08</entry>
	</dates>
	</vuln>

	<vuln vid="9558d49c-534c-11e8-8177-d43d7ef03aa6">
	<topic>Flash Player -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>29.0.0.171</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-16.html">
	<ul>
	<li>This update resolves a type confusion vulnerability that
	could lead to arbitrary code execution (CVE-2018-4944).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4944</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-16.html</url>
	</references>
	<dates>
	<discovery>2018-05-08</discovery>
	<entry>2018-05-09</entry>
	</dates>
	</vuln>

	<vuln vid="521ce804-52fd-11e8-9123-a4badb2f4699">
	<topic>FreeBSD -- Mishandling of x86 debug exceptions</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_10</lt></range>
	<range><ge>10.4</ge><lt>10.4_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The MOV SS and POP SS instructions inhibit debug exceptions
	until the instruction boundary following the next instruction.
	If that instruction is a system call or similar instruction
	that transfers control to the operating system, the debug
	exception will be handled in the kernel context instead of
	the user context.</p>
	<h1>Impact:</h1>
	<p>An authenticated local attacker may be able to read
	sensitive data in kernel memory, control low-level operating
	system functions, or may panic the system.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-8897</cvename>
	<freebsdsa>SA-18:06.debugreg</freebsdsa>
	</references>
	<dates>
	<discovery>2018-05-08</discovery>
	<entry>2018-05-08</entry>
	</dates>
	</vuln>

	<vuln vid="8719b935-8bae-41ad-92ba-3c826f651219">
	<topic>python 2.7 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>python27</name>
	<range><lt>2.7.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>python release notes:</p>
	<blockquote cite="https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst">
	<p>Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst</url>
	<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15.rst</url>
	<cvename>CVE-2012-0876</cvename>
	<cvename>CVE-2016-0718</cvename>
	<cvename>CVE-2016-4472</cvename>
	<cvename>CVE-2016-9063</cvename>
	<cvename>CVE-2017-9233</cvename>
	<cvename>CVE-2018-1060</cvename>
	<cvename>CVE-2018-1061</cvename>
	</references>
	<dates>
	<discovery>2018-05-01</discovery>
	<entry>2018-05-05</entry>
	</dates>
	</vuln>

	<vuln vid="83a548b5-4fa5-11e8-9a8e-001e2a3f778d">
	<topic>KWallet-PAM -- Access to privileged files</topic>
	<affects>
	<package>
	<name>plasma5-kwallet-pam</name>
	<range><lt>5.12.5_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The KDE Community reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20180503-1.txt">
	<p>
	kwallet-pam was doing file writing and permission changing
	as root that with correct timing and use of carefully
	crafted symbolic links could allow a non privileged user
	to become the owner of any file on the system.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.kde.org/info/security/advisory-20180503-1.txt</url>
	</references>
	<dates>
	<discovery>2018-05-04</discovery>
	<entry>2018-05-04</entry>
	</dates>
	</vuln>

	<vuln vid="89ca6f7d-4f00-11e8-9b1d-00e04c1ea73d">
	<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.58</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><lt>8.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2018-004">
	<p>A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x.
	This potentially allows attackers to exploit multiple attack vectors on a Drupal site,
	which could result in the site being compromised. This vulnerability is related to
	Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002.
	Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.drupal.org/SA-CORE-2018-004</url>
	</references>
	<dates>
	<discovery>2018-04-25</discovery>
	<entry>2018-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="9dfe61c8-4d15-11e8-8f2f-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>10.7.0</ge><lt>10.7.2</lt></range>
	<range><ge>10.6.0</ge><lt>10.6.5</lt></range>
	<range><ge>9.5.0</ge><lt>10.5.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released">
	<p>Persistent XSS in Move Issue using project namespace</p>
	<p>Download Archive allowing unauthorized private repo access</p>
	<p>Mattermost Updates</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-10379</cvename>
	<url>https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released</url>
	</references>
	<dates>
	<discovery>2018-04-30</discovery>
	<entry>2018-05-01</entry>
	</dates>
	</vuln>

	<vuln vid="006bee4e-4c49-11e8-9c32-54ee754af08e">
	<topic>chromium -- vulnerability</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>66.0.3359.139</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html">
	<p>3 security fixes in this release:</p>
	<ul>
	<li>[831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12</li>
	<li>[837635] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6118</cvename>
	<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html</url>
	</references>
	<dates>
	<discovery>2018-04-12</discovery>
	<entry>2018-04-30</entry>
	</dates>
	</vuln>

	<vuln vid="499f6b41-58db-4f98-b8e7-da8c18985eda">
	<topic>quassel -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>quassel</name>
	<range><lt>0.12.5</lt></range>
	</package>
	<package>
	<name>quassel-core</name>
	<range><lt>0.12.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo reports:</p>
	<blockquote cite="https://bugs.gentoo.org/653834">
	<p>quasselcore: corruption of heap metadata caused by qdatastream
	leading to preauth remote code execution.</p>
	<ul>
	<li>Severity: high, by default the server port is publicly open
	and the address can be requested using the /WHOIS command of IRC
	protocol.</li>
	<li>Description: In Qdatastream protocol each object is prepended
	with 4 bytes for the object size, this can be used to trigger
	allocation errors.</li>
	</ul>
	<p>quasselcore DDOS</p>
	<ul>
	<li>Severity: low, only impacts unconfigured quasselcore
	instances.</li>
	<li>Description: A login attempt causes a NULL pointer dereference
	when the database is not initialized.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.gentoo.org/653834</url>
	<url>https://github.com/quassel/quassel/commit/08bace4e9ecf08273f094c0c6aa8b3363d38ac3e</url>
	<url>https://github.com/quassel/quassel/commit/18389a713a6810f57ab237b945e8ee03df857b8b</url>
	</references>
	<dates>
	<discovery>2018-04-24</discovery>
	<entry>2018-04-26</entry>
	</dates>
	</vuln>

	<vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088">
	<topic>chromium -- vulnerability</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>66.0.3359.117</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
	<p>62 security fixes in this release:</p>
	<ul>
	<li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li>
	<li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li>
	<li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li>
	<li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li>
	<li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li>
	<li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li>
	<li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li>
	<li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li>
	<li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li>
	<li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li>
	<li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li>
	<li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li>
	<li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li>
	<li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li>
	<li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li>
	<li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li>
	<li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li>
	<li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li>
	<li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li>
	<li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li>
	<li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li>
	<li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li>
	<li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li>
	<li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li>
	<li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li>
	<li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li>
	<li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li>
	<li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li>
	<li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li>
	<li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li>
	<li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li>
	<li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li>
	<li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li>
	<li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>
	<cvename>CVE-2018-6085</cvename>
	<cvename>CVE-2018-6086</cvename>
	<cvename>CVE-2018-6087</cvename>
	<cvename>CVE-2018-6088</cvename>
	<cvename>CVE-2018-6089</cvename>
	<cvename>CVE-2018-6090</cvename>
	<cvename>CVE-2018-6091</cvename>
	<cvename>CVE-2018-6092</cvename>
	<cvename>CVE-2018-6093</cvename>
	<cvename>CVE-2018-6094</cvename>
	<cvename>CVE-2018-6095</cvename>
	<cvename>CVE-2018-6096</cvename>
	<cvename>CVE-2018-6097</cvename>
	<cvename>CVE-2018-6098</cvename>
	<cvename>CVE-2018-6099</cvename>
	<cvename>CVE-2018-6100</cvename>
	<cvename>CVE-2018-6101</cvename>
	<cvename>CVE-2018-6102</cvename>
	<cvename>CVE-2018-6103</cvename>
	<cvename>CVE-2018-6104</cvename>
	<cvename>CVE-2018-6105</cvename>
	<cvename>CVE-2018-6106</cvename>
	<cvename>CVE-2018-6107</cvename>
	<cvename>CVE-2018-6108</cvename>
	<cvename>CVE-2018-6109</cvename>
	<cvename>CVE-2018-6110</cvename>
	<cvename>CVE-2018-6111</cvename>
	<cvename>CVE-2018-6112</cvename>
	<cvename>CVE-2018-6113</cvename>
	<cvename>CVE-2018-6114</cvename>
	<cvename>CVE-2018-6115</cvename>
	<cvename>CVE-2018-6116</cvename>
	<cvename>CVE-2018-6117</cvename>
	<cvename>CVE-2018-6084</cvename>
	</references>
	<dates>
	<discovery>2017-04-10</discovery>
	<entry>2018-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd">
	<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mbedtls</name>
	<range><lt>2.7.2</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Butcher reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released">
	<ul>
	<li>Defend against Bellcore glitch attacks by verifying the results
	of RSA private key operations.</li>
	<li>Fix implementation of the truncated HMAC extension. The
	previous implementation allowed an offline 2^80 brute force
	attack on the HMAC key of a single, uninterrupted connection
	(with no resumption of the session).</li>
	<li>Reject CRLs containing unsupported critical extensions. Found
	by Falko Strenzke and Evangelos Karatsiolis.</li>
	<li>Fix a buffer overread in ssl_parse_server_key_exchange() that
	could cause a crash on invalid input.</li>
	<li>Fix a buffer overread in ssl_parse_server_psk_hint() that could
	cause a crash on invalid input.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released</url>
	</references>
	<dates>
	<discovery>2018-03-21</discovery>
	<entry>2018-04-23</entry>
	</dates>
	</vuln>

	<vuln vid="57aec168-453e-11e8-8777-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.60</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.35</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.33</lt></range>
	</package>
	<package>
	<name>mariadb102-server</name>
	<range><lt>10.2.15</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.60</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.40</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.22</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.60</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.40</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html">
	<p>MySQL Multiple Flaws Let Remote Authenticated Users Access and
	Modify Data, Remote and Local Users Deny Service, and Local Users
	Access Data and Gain Elevated Privileges</p>
	<ul>
	<li>A local user can exploit a flaw in the Replication component
	to gain elevated privileges [CVE-2018-2755].</li>
	<li>A remote authenticated user can exploit a flaw in the GIS
	Extension component to cause denial of service conditions
	[CVE-2018-2805].</li>
	<li>A remote authenticated user can exploit a flaw in the InnoDB
	component to cause denial of service conditions [CVE-2018-2782,
	CVE-2018-2784, CVE-2018-2819].</li>
	<li>A remote authenticated user can exploit a flaw in the Security
	Privileges component to cause denial of service conditions
	[CVE-2018-2758, CVE-2018-2818].</li>
	<li>A remote authenticated user can exploit a flaw in the DDL
	component to cause denial of service conditions
	[CVE-2018-2817].</li>
	<li>A remote authenticated user can exploit a flaw in the Optimizer
	component to cause denial of service conditions [CVE-2018-2775,
	CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781,
	CVE-2018-2816].</li>
	<li>A remote user can exploit a flaw in the Client programs
	component to cause denial of service conditions [CVE-2018-2761,
	CVE-2018-2773].</li>
	<li>A remote authenticated user can exploit a flaw in the InnoDB
	component to partially modify data and cause denial of service
	conditions [CVE-2018-2786, CVE-2018-2787].</li>
	<li>A remote authenticated user can exploit a flaw in the Optimizer
	component to partially modify data and cause denial of service
	conditions [CVE-2018-2812].</li>
	<li>A local user can exploit a flaw in the Cluster ndbcluster/plugin
	component to cause denial of service conditions [CVE-2018-2877].
	</li>
	<li>A remote authenticated user can exploit a flaw in the InnoDB
	component to cause denial of service conditions [CVE-2018-2759,
	CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].</li>
	<li>A remote authenticated user can exploit a flaw in the DML
	component to cause denial of service conditions [CVE-2018-2839].
	</li>
	<li>A remote authenticated user can exploit a flaw in the
	Performance Schema component to cause denial of service conditions
	[CVE-2018-2846].</li>
	<li>A remote authenticated user can exploit a flaw in the Pluggable
	Auth component to cause denial of service conditions
	[CVE-2018-2769].</li>
	<li>A remote authenticated user can exploit a flaw in the Group
	Replication GCS component to cause denial of service conditions
	[CVE-2018-2776].</li>
	<li>A local user can exploit a flaw in the Connection component to
	cause denial of service conditions [CVE-2018-2762].</li>
	<li>A remote authenticated user can exploit a flaw in the Locking
	component to cause denial of service conditions [CVE-2018-2771].
	</li>
	<li>A remote authenticated user can exploit a flaw in the DDL
	component to partially access data [CVE-2018-2813].</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html</url>
	<cvename>CVE-2018-2755</cvename>
	<cvename>CVE-2018-2805</cvename>
	<cvename>CVE-2018-2782</cvename>
	<cvename>CVE-2018-2784</cvename>
	<cvename>CVE-2018-2819</cvename>
	<cvename>CVE-2018-2758</cvename>
	<cvename>CVE-2018-2817</cvename>
	<cvename>CVE-2018-2775</cvename>
	<cvename>CVE-2018-2780</cvename>
	<cvename>CVE-2018-2761</cvename>
	<cvename>CVE-2018-2786</cvename>
	<cvename>CVE-2018-2787</cvename>
	<cvename>CVE-2018-2812</cvename>
	<cvename>CVE-2018-2877</cvename>
	<cvename>CVE-2018-2759</cvename>
	<cvename>CVE-2018-2766</cvename>
	<cvename>CVE-2018-2777</cvename>
	<cvename>CVE-2018-2810</cvename>
	<cvename>CVE-2018-2818</cvename>
	<cvename>CVE-2018-2839</cvename>
	<cvename>CVE-2018-2778</cvename>
	<cvename>CVE-2018-2779</cvename>
	<cvename>CVE-2018-2781</cvename>
	<cvename>CVE-2018-2816</cvename>
	<cvename>CVE-2018-2846</cvename>
	<cvename>CVE-2018-2769</cvename>
	<cvename>CVE-2018-2776</cvename>
	<cvename>CVE-2018-2762</cvename>
	<cvename>CVE-2018-2771</cvename>
	<cvename>CVE-2018-2813</cvename>
	<cvename>CVE-2018-2773</cvename>
	</references>
	<dates>
	<discovery>2018-04-17</discovery>
	<entry>2018-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="be38245e-44d9-11e8-a292-00e04c1ea73d">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.5,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<range><lt>4.9.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpress developers reports:</p>
	<blockquote cite="https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/">
	<p>Don't treat localhost as same host by default.</p>
	<p>Use safe redirects when redirecting the login page if SSL is forced.</p>
	<p>Make sure the version string is correctly escaped for use in generator tags.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-04-03</discovery>
	<entry>2018-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="ac7da39b-4405-11e8-afbe-6805ca0b3d42">
	<topic>phpmyadmin -- CSRF vulnerability allowing arbitrary SQL execution</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.8.0</ge><lt>4.8.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-2/">
	<h3>Summary</h3>
	<p>CSRF vulnerability allowing arbitrary SQL execution</p>
	<h3>Description</h3>
	<p>By deceiving a user to click on a crafted URL, it is
	possible for an attacker to execute arbitrary SQL
	commands.</p>
	<h3>Severity</h3>
	<p>We consider this vulnerability to be critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-2/</url>
	</references>
	<dates>
	<discovery>2018-04-17</discovery>
	<entry>2018-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="33174280-43fa-11e8-aad5-6cf0497db129">
	<topic>drupal -- Drupal core - Moderately critical</topic>
	<affects>
	<package>
	<name>drupal8</name>
	<range><lt>8.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal security team reports:</p>
	<blockquote cite="https://www.drupal.org/sa-core-2018-003">
	<p>CKEditor, a third-party JavaScript library included in Drupal
	core, has fixed a cross-site scripting (XSS) vulnerability. The
	vulnerability stemmed from the fact that it was possible to execute
	XSS inside CKEditor when using the image2 plugin (which Drupal 8
	core also uses).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.drupal.org/sa-core-2018-003</url>
	</references>
	<dates>
	<discovery>2018-04-18</discovery>
	<entry>2018-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="8f353420-4197-11e8-8777-b499baebfeaf">
	<topic>OpenSSL -- Cache timing vulnerability</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2o_2,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0h_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20180416.txt">
	<p>The OpenSSL RSA Key generation algorithm has been shown to be
	vulnerable to a cache timing side channel attack. An attacker
	with sufficient access to mount cache timing attacks during the
	RSA key generation process could recover the private key.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20180416.txt</url>
	<cvename>CVE-2018-0737</cvename>
	</references>
	<dates>
	<discovery>2018-04-16</discovery>
	<entry>2018-04-16</entry>
	</dates>
	</vuln>

	<vuln vid="a9e466e8-4144-11e8-a292-00e04c1ea73d">
	<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.57</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/psa-2018-001">
	<p>CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6,
	and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because
	of an issue affecting multiple subsystems with default or common module configurations.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-7600</cvename>
	</references>
	<dates>
	<discovery>2018-03-13</discovery>
	<entry>2018-04-16</entry>
	</dates>
	</vuln>

	<vuln vid="41c96ffd-29a6-4dcc-9a88-65f5038fa6eb">
	<topic>perl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>perl5</name>
	<range><ge>5.24.0</ge><lt>5.24.4</lt></range>
	<range><ge>5.26.0</ge><lt>5.26.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>perldelta:</p>
	<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.2">
	<p>CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom
	(regcomp.c)</p>
	<p>A crafted regular expression could cause a heap buffer write overflow,
	with control over the bytes written. [perl #132227]</p>
	<p>CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)</p>
	<p>Matching a crafted locale dependent regular expression could cause a
	heap buffer read overflow and potentially information disclosure. [perl
	#132063]</p>
	<p>CVE-2018-6913: heap-buffer-overflow in S_pack_rec</p>
	<p>pack() could cause a heap buffer write overflow with a large item
	count. [perl #131844]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://metacpan.org/changes/release/SHAY/perl-5.26.2</url>
	<url>https://metacpan.org/changes/release/SHAY/perl-5.24.4</url>
	<cvename>CVE-2018-6797</cvename>
	<cvename>CVE-2018-6798</cvename>
	<cvename>CVE-2018-6913</cvename>
	</references>
	<dates>
	<discovery>2018-04-14</discovery>
	<entry>2018-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="974a6d32-3fda-11e8-aea4-001b216d295b">
	<topic>ipsec-tools -- remotely exploitable computational-complexity attack</topic>
	<affects>
	<package>
	<name>ipsec-tools</name>
	<range><lt>0.8.2_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Robert Foggia via NetBSD GNATS reports:</p>
	<blockquote cite="https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682">
	<p>The ipsec-tools racoon daemon contains a remotely exploitable computational
	complexity attack when parsing and storing isakmp fragments. The implementation
	permits a remote attacker to exhaust computational resources on the remote endpoint
	by repeatedly sending isakmp fragment packets in a particular order such that
	the worst-case computational complexity is realized in the algorithm utilized
	to determine if reassembly of the fragments can take place.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682</url>
	<cvename>CVE-2016-10396</cvename>
	</references>
	<dates>
	<discovery>2016-12-02</discovery>
	<entry>2018-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="1fccb25e-8451-438c-a2b9-6a021e4d7a31">
	<topic>nghttp2 -- Denial of service due to NULL pointer dereference</topic>
	<affects>
	<package>
	<name>libnghttp2</name>
	<name>nghttp2</name>
	<range><ge>1.10.0</ge><lt>1.31.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>nghttp2 blog:</p>
	<blockquote cite="https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/">
	<p>If ALTSVC frame is received by libnghttp2 and it is larger than it can
	accept, the pointer field which points to ALTSVC frame payload is left
	NULL. Later libnghttp2 attempts to access another field through the
	pointer, and gets segmentation fault.</p>
	<p>ALTSVC frame is defined by RFC 7838.</p>
	<p>The largest frame size libnghttp2 accept is by default 16384 bytes.</p>
	<p>Receiving ALTSVC frame is disabled by default. Application has to
	enable it explicitly by calling
	nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).</p>
	<p>Transmission of ALTSVC is always enabled, and it does not cause this
	vulnerability.</p>
	<p>ALTSVC frame is expected to be sent by server, and received by client
	as defined in RFC 7838.</p>
	<p>Client and server are both affected by this vulnerability if the
	reception of ALTSVC frame is enabled. As written earlier, it is useless
	to enable reception of ALTSVC frame on server side. So, server is
	generally safe unless application accidentally enabled the reception of
	ALTSVC frame.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
	<cvename>CVE-2018-1000168</cvename>
	</references>
	<dates>
	<discovery>2018-04-04</discovery>
	<entry>2018-04-13</entry>
	</dates>
	</vuln>

	<vuln vid="48894ca9-3e6f-11e8-92f0-f0def167eeea">
	<topic>roundcube -- IMAP command injection vulnerability</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><le>1.3.5,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Upstream reports:</p>
	<blockquote cite="https://roundcube.net/news/2018/04/11/security-update-1.3.6">
	<p>This update primarily fixes a recently discovered IMAP-cmd-injection
	vulnerability caused by insufficient input validation within
	the archive plugin.
	Details about the vulnerability are published under CVE-2018-9846.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-9846</cvename>
	<url>https://roundcube.net/news/2018/04/11/security-update-1.3.6</url>
	</references>
	<dates>
	<discovery>2018-04-11</discovery>
	<entry>2018-04-13</entry>
	</dates>
	</vuln>

	<vuln vid="aaba17aa-782e-4843-8a79-7756cfa2bf89">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>2.115</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>2.107.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins developers report:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-04-11/">
	<p>The Jenkins CLI sent different error responses for commands with
	view and agent arguments depending on the existence of the specified
	views or agents to unauthorized users. This allowed attackers to
	determine whether views or agents with specified names exist.</p>
	<p>The Jenkins CLI now returns the same error messages to unauthorized
	users independent of the existence of specified view or agent
	names</p>
	<p>Some JavaScript confirmation dialogs included the item name in an
	unsafe manner, resulting in a possible cross-site scripting
	vulnerability exploitable by users with permission to create or
	configure items.</p>
	<p>JavaScript confirmation dialogs that include the item name now
	properly escape it, so it can be safely displayed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2018-04-11/</url>
	</references>
	<dates>
	<discovery>2018-04-11</discovery>
	<entry>2018-04-12</entry>
	</dates>
	</vuln>

	<vuln vid="5c6f7482-3ced-11e8-b157-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>29.0.0.140</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-08.html">
	<ul>
	<li>This update resolves a use-after-free vulnerability that
	could lead to remote code execution (CVE-2018-4932).</li>
	<li>This update resolves out-of-bounds read vulnerabilities that
	could lead to information disclosure (CVE-2018-4933,
	CVE-2018-4934).</li>
	<li>This update resolves out-of-bounds write vulnerabilities that
	could lead to remote code execution (CVE-2018-4935,
	CVE-2018-4937).</li>
	<li>This update resolves a heap overflow vulnerability that
	could lead to information disclosure (CVE-2018-4936).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4932</cvename>
	<cvename>CVE-2018-4933</cvename>
	<cvename>CVE-2018-4934</cvename>
	<cvename>CVE-2018-4935</cvename>
	<cvename>CVE-2018-4936</cvename>
	<cvename>CVE-2018-4937</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-08.html</url>
	</references>
	<dates>
	<discovery>2018-04-10</discovery>
	<entry>2018-04-10</entry>
	<modified>2018-07-11</modified>
	</dates>
	</vuln>

	<vuln vid="085a087b-3897-11e8-ac53-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>10.6.0</ge><lt>10.6.3</lt></range>
	<range><ge>10.5.0</ge><lt>10.5.7</lt></range>
	<range><ge>8.6</ge><lt>10.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/">
	<p>Confidential issue comments in Slack, Mattermost, and webhook integrations.</p>
	<p>Persistent XSS in milestones data-milestone-id.</p>
	<p>Persistent XSS in filename of merge request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/</url>
	</references>
	<dates>
	<discovery>2018-04-04</discovery>
	<entry>2018-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="c0c5afef-38db-11e8-8b7f-a4badb2f469b">
	<topic>FreeBSD -- ipsec crash or denial of service</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_9</lt></range>
	<range><ge>10.4</ge><lt>10.4_8</lt></range>
	<range><ge>10.3</ge><lt>10.3_29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The length field of the option header does not count the
	size of the option header itself. This causes a problem
	when the length is zero, the count is then incremented by
	zero, which causes an infinite loop.</p>
	<p>In addition there are pointer/offset mistakes in the
	handling of IPv4 options.</p>
	<h1>Impact:</h1>
	<p>A remote attacker who is able to send an arbitrary packet,
	could cause the remote target machine to crash.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6918</cvename>
	<freebsdsa>SA-18:05.ipsec</freebsdsa>
	</references>
	<dates>
	<discovery>2018-04-04</discovery>
	<entry>2018-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="a5cf3ecd-38db-11e8-8b7f-a4badb2f469b">
	<topic>FreeBSD -- vt console memory disclosure</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_9</lt></range>
	<range><ge>10.4</ge><lt>10.4_8</lt></range>
	<range><ge>10.3</ge><lt>10.3_29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Insufficient validation of user-provided font parameters
	can result in an integer overflow, leading to the use of
	arbitrary kernel memory as glyph data. Characters that
	reference this data can be displayed on the screen, effectively
	disclosing kernel memory.</p>
	<h1>Impact:</h1>
	<p>Unprivileged users may be able to access privileged
	kernel data.</p>
	<p>Such memory might contain sensitive information, such
	as portions of the file cache or terminal buffers. This
	information might be directly useful, or it might be leveraged
	to obtain elevated privileges in some way; for example, a
	terminal buffer might include a user-entered password.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6917</cvename>
	<freebsdsa>SA-18:04.vt</freebsdsa>
	</references>
	<dates>
	<discovery>2018-04-04</discovery>
	<entry>2018-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="cdb4d962-34f9-11e8-92db-080027907385">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.11</lt></range>
	</package>
	<package>
	<name>moodle32</name>
	<range><lt>3.2.8</lt></range>
	</package>
	<package>
	<name>moodle33</name>
	<range><lt>3.3.5</lt></range>
	</package>
	<package>
	<name>moodle34</name>
	<range><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>moodle reports:</p>
	<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=367938">
	<p>Unauthenticated users can trigger custom messages to admin via
	paypal enrol script.</p>
	<p>Suspended users with OAuth 2 authentication method can still log in to
	the site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1081</cvename>
	<cvename>CVE-2018-1082</cvename>
	<url>https://moodle.org/mod/forum/discuss.php?d=367938</url>
	</references>
	<dates>
	<discovery>2018-03-14</discovery>
	<entry>2018-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="eb69bcf2-18ef-4aa2-bb0c-83b263364089">
	<topic>ruby -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>2.3.0,1</ge><lt>2.3.7,1</lt></range>
	<range><ge>2.4.0,1</ge><lt>2.4.4,1</lt></range>
	<range><ge>2.5.0,1</ge><lt>2.5.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby news:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/">
	<p>CVE-2017-17742: HTTP response splitting in WEBrick</p>
	<p>If a script accepts an external input and outputs it without
	modification as a part of HTTP responses, an attacker can use newline
	characters to deceive the clients that the HTTP response header is
	stopped at there, and can inject fake HTTP responses after the newline
	characters to show malicious contents to the clients.</p>
	<p>CVE-2018-6914: Unintentional file and directory creation with
	directory traversal in tempfile and tmpdir</p>
	<p>Dir.mktmpdir method introduced by tmpdir library accepts the prefix
	and the suffix of the directory which is created as the first parameter.
	The prefix can contain relative directory specifiers "../", so this
	method can be used to target any directory. So, if a script accepts an
	external input as the prefix, and the targeted directory has
	inappropriate permissions or the ruby process has inappropriate
	privileges, the attacker can create a directory or a file at any
	directory.</p>
	<p>CVE-2018-8777: DoS by large request in WEBrick</p>
	<p>If an attacker sends a large request which contains huge HTTP headers,
	WEBrick try to process it on memory, so the request causes the
	out-of-memory DoS attack.</p>
	<p>CVE-2018-8778: Buffer under-read in String#unpack</p>
	<p>String#unpack receives format specifiers as its parameter, and can
	be specified the position of parsing the data by the specifier @. If a
	big number is passed with @, the number is treated as the negative
	value, and out-of-buffer read is occurred. So, if a script accepts an
	external input as the argument of String#unpack, the attacker can read
	data on heaps.</p>
	<p>CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
	UNIXServer and UNIXSocket</p>
	<p>UNIXServer.open accepts the path of the socket to be created at the
	first parameter. If the path contains NUL (\0) bytes, this method
	recognize that the path is completed before the NUL bytes. So, if a
	script accepts an external input as the argument of this method, the
	attacker can make the socket file in the unintentional path. And,
	UNIXSocket.open also accepts the path of the socket to be created at
	the first parameter without checking NUL bytes like UNIXServer.open.
	So, if a script accepts an external input as the argument of this
	method, the attacker can accepts the socket file in the unintentional
	path.</p>
	<p>CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
	in Dir</p>
	<p>Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
	target directory as their parameter. If the parameter contains NUL (\0)
	bytes, these methods recognize that the path is completed before the
	NUL bytes. So, if a script accepts an external input as the argument of
	these methods, the attacker can make the unintentional directory
	traversal.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/</url>
	<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/</url>
	<cvename>CVE-2017-17742</cvename>
	<cvename>CVE-2018-6914</cvename>
	<cvename>CVE-2018-8777</cvename>
	<cvename>CVE-2018-8778</cvename>
	<cvename>CVE-2018-8779</cvename>
	<cvename>CVE-2018-8780</cvename>
	</references>
	<dates>
	<discovery>2018-03-28</discovery>
	<entry>2018-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="5a9bbb6e-32d3-11e8-a769-6daaba161086">
	<topic>node.js -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node4</name>
	<range><lt>4.9.0</lt></range>
	</package>
	<package>
	<name>node6</name>
	<range><lt>6.14.0</lt></range>
	</package>
	<package>
	<name>node8</name>
	<range><lt>8.11.0</lt></range>
	</package>
	<package>
	<name>node</name>
	<range><lt>9.10.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js reports:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/">
	<h1>Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)</h1>
	<p>Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.</p>
	<h1>'path' module regular expression denial of service (CVE-2018-7158)</h1>
	<p>The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.</p>
	<h1>Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)</h1>
	<p>The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/</url>
	<cvename>CVE-2018-7158</cvename>
	<cvename>CVE-2018-7159</cvename>
	<cvename>CVE-2018-7160</cvename>
	</references>
	<dates>
	<discovery>2018-03-21</discovery>
	<entry>2018-03-28</entry>
	<modified>2018-03-28</modified>
	</dates>
	</vuln>

	<vuln vid="1ce95bc7-3278-11e8-b527-00012e582166">
	<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>webkit2-gtk3</name>
	<range><ge>2.16.6</ge><lt>2.20.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The WebKit team reports many vulnerabilities.</p>
	<p>Please reference the CVE/URL list for details.</p>
	</body>
	</description>
	<references>
	<url>https://webkitgtk.org/security/WSA-2017-0008.html</url>
	<url>https://webkitgtk.org/security/WSA-2017-0009.html</url>
	<url>https://webkitgtk.org/security/WSA-2017-0010.html</url>
	<url>https://webkitgtk.org/security/WSA-2018-0001.html</url>
	<url>https://webkitgtk.org/security/WSA-2018-0002.html</url>
	<cvename>CVE-2017-7087</cvename>
	<cvename>CVE-2017-7089</cvename>
	<cvename>CVE-2017-7090</cvename>
	<cvename>CVE-2017-7091</cvename>
	<cvename>CVE-2017-7092</cvename>
	<cvename>CVE-2017-7092</cvename>
	<cvename>CVE-2017-7093</cvename>
	<cvename>CVE-2017-7095</cvename>
	<cvename>CVE-2017-7096</cvename>
	<cvename>CVE-2017-7098</cvename>
	<cvename>CVE-2017-7100</cvename>
	<cvename>CVE-2017-7102</cvename>
	<cvename>CVE-2017-7104</cvename>
	<cvename>CVE-2017-7107</cvename>
	<cvename>CVE-2017-7109</cvename>
	<cvename>CVE-2017-7111</cvename>
	<cvename>CVE-2017-7117</cvename>
	<cvename>CVE-2017-7120</cvename>
	<cvename>CVE-2017-13783</cvename>
	<cvename>CVE-2017-13784</cvename>
	<cvename>CVE-2017-13785</cvename>
	<cvename>CVE-2017-13788</cvename>
	<cvename>CVE-2017-13791</cvename>
	<cvename>CVE-2017-13792</cvename>
	<cvename>CVE-2017-13794</cvename>
	<cvename>CVE-2017-13795</cvename>
	<cvename>CVE-2017-13796</cvename>
	<cvename>CVE-2017-13798</cvename>
	<cvename>CVE-2017-13802</cvename>
	<cvename>CVE-2017-13803</cvename>
	<cvename>CVE-2017-7156</cvename>
	<cvename>CVE-2017-7157</cvename>
	<cvename>CVE-2017-13856</cvename>
	<cvename>CVE-2017-13866</cvename>
	<cvename>CVE-2017-13870</cvename>
	<cvename>CVE-2017-5753</cvename>
	<cvename>CVE-2017-5715</cvename>
	<cvename>CVE-2018-4088</cvename>
	<cvename>CVE-2018-4089</cvename>
	<cvename>CVE-2018-4096</cvename>
	<cvename>CVE-2017-7153</cvename>
	<cvename>CVE-2017-7160</cvename>
	<cvename>CVE-2017-7161</cvename>
	<cvename>CVE-2017-7165</cvename>
	<cvename>CVE-2017-13884</cvename>
	<cvename>CVE-2017-13885</cvename>
	</references>
	<dates>
	<discovery>2017-10-18</discovery>
	<entry>2018-03-28</entry>
	<modified>2018-03-28</modified>
	</dates>
	</vuln>

	<vuln vid="3ae21918-31e3-11e8-927b-e8e0b747a45a">
	<topic>chromium -- vulnerability</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>65.0.3325.181</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html">
	<p>1 security fix in this release, including:</p>
	<ul>
	<li>[823553] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html</url>
	</references>
	<dates>
	<discovery>2018-03-20</discovery>
	<entry>2018-03-27</entry>
	</dates>
	</vuln>

	<vuln vid="b7cff5a9-31cc-11e8-8f07-b499baebfeaf">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2o,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0h</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20180327.txt">
	<ul><li>Constructed ASN.1 types with a recursive definition could
	exceed the stack (CVE-2018-0739)<br/>
	Constructed ASN.1 types with a recursive definition (such as can be
	found in PKCS7) could eventually exceed the stack given malicious input
	with excessive recursion. This could result in a Denial Of Service
	attack. There are no such structures used within SSL/TLS that come from
	untrusted sources so this is considered safe.</li>
	<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
	There is an overflow bug in the AVX2 Montgomery multiplication
	procedure used in exponentiation with 1024-bit moduli. This only
	affects processors that support the AVX2 but not ADX extensions
	like Intel Haswell (4th generation).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20180327.txt</url>
	<cvename>CVE-2018-0739</cvename>
	<cvename>CVE-2017-3738</cvename>
	</references>
	<dates>
	<discovery>2018-03-27</discovery>
	<entry>2018-03-27</entry>
	</dates>
	</vuln>

	<vuln vid="dc0c201c-31da-11e8-ac53-d8cb8abf62dd">
	<topic>Gitlab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>10.5.0</ge><lt>10.5.6</lt></range>
	<range><ge>10.4.0</ge><lt>10.4.6</lt></range>
	<range><ge>8.3</ge><lt>10.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/">
	<h1>SSRF in services and web hooks</h1>
	<p>There were multiple server-side request forgery issues in the Services feature.
	An attacker could make requests to servers within the same network of the GitLab
	instance. This could lead to information disclosure, authentication bypass, or
	potentially code execution. This issue has been assigned
	<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8801">CVE-2018-8801</a>.</p>
	<h1>Gitlab Auth0 integration issue</h1>
	<p>There was an issue with the GitLab <code>omniauth-auth0</code> configuration
	which resulted in the Auth0 integration signing in the wrong users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-8801</cvename>
	<url>https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/</url>
	</references>
	<dates>
	<discovery>2018-03-20</discovery>
	<entry>2018-03-27</entry>
	<modified>2018-04-07</modified>
	</dates>
	</vuln>

	<vuln vid="23f59689-0152-42d3-9ade-1658d6380567">
	<topic>mozilla -- use-after-free in compositor</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>59.0.2,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.4.36_3</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.3</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.7.3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.7.3,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>52.7.3</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>52.7.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>52.7.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/">
	<h1>CVE-2018-5148: Use-after-free in compositor</h1>
	<p>A use-after-free vulnerability can occur in the
	compositor during certain graphics operations when a raw
	pointer is used instead of a reference counted one. This
	results in a potentially exploitable crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5148</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-10/</url>
	</references>
	<dates>
	<discovery>2018-03-26</discovery>
	<entry>2018-03-27</entry>
	<modified>2018-03-31</modified>
	</dates>
	</vuln>

	<vuln vid="81946ace-6961-4488-a164-22d58ebc8d66">
	<topic>rails-html-sanitizer -- possible XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-rails-html-sanitizer</name>
	<range><lt>1.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OSS-Security list:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2018/03/22/4">
	<p>There is a possible XSS vulnerability in rails-html-sanitizer. The gem
	allows non-whitelisted attributes to be present in sanitized output
	when input with specially-crafted HTML fragments, and these attributes
	can lead to an XSS attack on target applications.</p>
	<p>This issue is similar to CVE-2018-8048 in Loofah.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2018/03/22/4</url>
	<cvename>CVE-2018-3741</cvename>
	</references>
	<dates>
	<discovery>2018-03-22</discovery>
	<entry>2018-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="f38187e7-2f6e-11e8-8f07-b499baebfeaf">
	<topic>apache -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.30</lt></range>
	</package>
	<package>
	<name>apache22</name>
	<range><lt>2.2.34_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache httpd reports:</p>
	<blockquote cite="https://www.apache.org/dist/httpd/CHANGES_2.4.33">
	<p>Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig
	enabled (CVE-2017-15710)</p>
	<p>mod_session: CGI-like applications that intend to read from
	mod_session's 'SessionEnv ON' could be fooled into reading
	user-supplied data instead. (CVE-2018-1283)</p>
	<p>mod_cache_socache: Fix request headers parsing to avoid a possible
	crash with specially crafted input data. (CVE-2018-1303)</p>
	<p>core: Possible crash with excessively long HTTP request headers.
	Impractical to exploit with a production build and production
	LogLevel. (CVE-2018-1301)</p>
	<p>core: Configure the regular expression engine to match '$' to the
	end of the input string only, excluding matching the end of any
	embedded newline characters. Behavior can be changed with new
	directive 'RegexDefaultOptions'. (CVE-2017-15715)</p>
	<p>mod_auth_digest: Fix generation of nonce values to prevent replay
	attacks across servers using a common Digest domain. This change
	may cause problems if used with round robin load balancers.
	(CVE-2018-1312)</p>
	<p>mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.apache.org/dist/httpd/CHANGES_2.4.33</url>
	<cvename>CVE-2017-15710</cvename>
	<cvename>CVE-2018-1283</cvename>
	<cvename>CVE-2018-1303</cvename>
	<cvename>CVE-2018-1301</cvename>
	<cvename>CVE-2017-15715</cvename>
	<cvename>CVE-2018-1312</cvename>
	<cvename>CVE-2018-1302</cvename>
	</references>
	<dates>
	<discovery>2018-03-23</discovery>
	<entry>2018-03-24</entry>
	<modified>2018-03-27</modified>
	</dates>
	</vuln>

	<vuln vid="d50a50a2-2f3e-11e8-86f8-00e04c1ea73d">
	<topic>mybb -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.8.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mybb Team reports:</p>
	<blockquote cite="https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/">
	<p>Medium risk: Tasks Local File Inclusion</p>
	<p>Medium risk: Forum Password Check Bypass</p>
	<p>Low risk: Admin Permissions Group Title XSS</p>
	<p>Low risk: Attachment types file extension XSS</p>
	<p>Low risk: Moderator Tools XSS</p>
	<p>Low risk: Security Questions XSS</p>
	<p>Low risk: Settings Management XSS</p>
	<p>Low risk: Templates Set Name XSS</p>
	<p>Low risk: Usergroup Promotions XSS</p>
	<p>Low risk: Warning Types XSS</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-03-15</discovery>
	<entry>2018-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="6d52bda1-2e54-11e8-a68f-485b3931c969">
	<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
	<affects>
	<package>
	<name>sqlite3</name>
	<range><lt>3.22.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
	<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
	statement could cause a NULL pointer dereference, related to build.c
	and prepare.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-8740</cvename>
	<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
	</references>
	<dates>
	<discovery>2018-03-16</discovery>
	<entry>2018-03-22</entry>
	</dates>
	</vuln>

	<vuln vid="39a30e0a-0c34-431b-9dce-b87cab02412a">
	<topic>Sanitize -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-sanitize</name>
	<range><lt>2.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sanitize release:</p>
	<blockquote cite="https://github.com/rgrove/sanitize/releases">
	<p>Fixed an HTML injection vulnerability that could allow XSS.</p>
	<p>When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2,
	a specially crafted HTML fragment can cause libxml2 to generate
	improperly escaped output, allowing non-whitelisted attributes to be
	used on whitelisted elements.</p>
	<p>Sanitize now performs additional escaping on affected attributes to
	prevent this.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/rgrove/sanitize/releases</url>
	<url>https://github.com/rgrove/sanitize/issues/176</url>
	<cvename>CVE-2018-3740</cvename>
	</references>
	<dates>
	<discovery>2018-03-19</discovery>
	<entry>2018-03-21</entry>
	</dates>
	</vuln>

	<vuln vid="ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220">
	<topic>Loofah -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-loofah</name>
	<range><lt>2.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitHub issue:</p>
	<blockquote cite="https://github.com/flavorjones/loofah/issues/144">
	<p>This issue has been created for public disclosure of an XSS / code
	injection vulnerability that was responsibly reported by the Shopify
	Application Security Team.</p>
	<p>Loofah allows non-whitelisted attributes to be present in sanitized
	output when input with specially-crafted HTML fragments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/flavorjones/loofah/releases</url>
	<url>https://github.com/flavorjones/loofah/issues/144</url>
	<cvename>CVE-2018-8048</cvename>
	</references>
	<dates>
	<discovery>2018-03-15</discovery>
	<entry>2018-03-20</entry>
	</dates>
	</vuln>

	<vuln vid="b3edc7d9-9af5-4daf-88f1-61f68f4308c2">
	<topic>Jupyter Notebook -- vulnerability</topic>
	<affects>
	<package>
	<name>py27-notebook</name>
	<name>py34-notebook</name>
	<name>py35-notebook</name>
	<name>py36-notebook</name>
	<range><lt>5.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768">
	<p>In Jupyter Notebook before 5.4.1, a maliciously forged notebook file
	can bypass sanitization to execute JavaScript in the notebook context.
	Specifically, invalid HTML is 'fixed' by jQuery after sanitization,
	making it dangerous.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768</url>
	<cvename>CVE-2018-8768</cvename>
	</references>
	<dates>
	<discovery>2018-03-18</discovery>
	<entry>2018-03-19</entry>
	</dates>
	</vuln>

	<vuln vid="928d5c59-2a5a-11e8-a712-0025908740c2">
	<topic>SquirrelMail -- post-authentication access privileges</topic>
	<affects>
	<package>
	<name>squirrelmail</name>
	<range><le>20170705</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Grunow reports:</p>
	<blockquote cite="https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/">
	<p> An attacker able to exploit this vulnerability can extract files
	of the server the application is running on. This may include
	configuration files, log files and additionally all files that are
	readable for all users on the system. This issue is
	post-authentication. That means an attacker would need valid
	credentials for the application to log in or needs to exploit an
	additional vulnerability of which we are not aware of at this point
	of time.</p>
	<p>An attacker would also be able to delete files on the system, if
	the user running the application has the rights to do so.</p>
	<p>Does this issue affect me?</p>
	<p>Likely yes, if you are using Squirrelmail. We checked the latest
	development version, which is 1.5.2-svn and the latest version
	available for download at this point of time, 1.4.22. Both contain
	the vulnerable code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2018/03/17/2</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-8741</url>
	<cvename>CVE-2018-8741</cvename>
	</references>
	<dates>
	<discovery>2017-05-21</discovery>
	<entry>2018-03-17</entry>
	</dates>
	</vuln>

	<vuln vid="b3e04661-2a0a-11e8-9e63-3085a9a47796">
	<topic>slurm-wlm -- SQL Injection attacks against SlurmDBD</topic>
	<affects>
	<package>
	<name>slurm-wlm</name>
	<range><lt>17.02.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SchedMD reports:</p>
	<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000006.html">
	<p>Several issues were discovered with incomplete sanitization of
	user-provided text strings, which could potentially lead to SQL
	injection attacks against SlurmDBD itself. Such exploits could lead to a
	loss of accounting data, or escalation of user privileges on the cluster.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-7033</cvename>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-7033</url>
	</references>
	<dates>
	<discovery>2018-03-15</discovery>
	<entry>2018-03-17</entry>
	</dates>
	</vuln>

	<vuln vid="64ee858e-e035-4bb4-9c77-2468963dddb8">
	<topic>libvorbis -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libvorbis</name>
	<range><lt>1.3.6,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14632">
	<p>Xiph.Org libvorbis 1.3.5 allows Remote Code Execution
	upon freeing uninitialized memory in the function
	vorbis_analysis_headerout() in info.c when
	vi->channels<=0, a similar issue to Mozilla bug
	550184.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14633">
	<p>In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read
	vulnerability exists in the function mapping0_forward() in
	mapping0.c, which may lead to DoS when operating on a
	crafted audio file with vorbis_analysis().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-14632</cvename>
	<cvename>CVE-2017-14633</cvename>
	</references>
	<dates>
	<discovery>2018-03-16</discovery>
	<entry>2018-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="7943794f-707f-4e31-9fea-3bbf1ddcedc1">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libvorbis</name>
	<range><lt>1.3.6,3</lt></range>
	</package>
	<package>
	<name>libtremor</name>
	<range><lt>1.2.1.s20180316</lt></range>
	</package>
	<package>
	<name>firefox</name>
	<range><lt>59.0.1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.4.36_3</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.3</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.7.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.7.2,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>52.7.3</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/">
	<h1>CVE-2018-5146: Out of bounds memory write in libvorbis</h1>
	<p>An out of bounds memory write while processing Vorbis
	audio data was reported through the Pwn2Own contest.</p>
	<h1>CVE-2018-5147: Out of bounds memory write in libtremor</h1>
	<p>The libtremor library has the same flaw as
	CVE-2018-5146. This library is used by Firefox in place of
	libvorbis on Android and ARM platforms.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5146</cvename>
	<cvename>CVE-2018-5147</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-08/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-09/</url>
	</references>
	<dates>
	<discovery>2018-03-16</discovery>
	<entry>2018-03-16</entry>
	<modified>2018-03-31</modified>
	</dates>
	</vuln>

	<vuln vid="2aa9967c-27e0-11e8-9ae1-080027ac955c">
	<topic>e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program</topic>
	<affects>
	<package>
	<name>e2fsprogs</name>
	<range><lt>1.44.0</lt></range>
	</package>
	<package>
	<name>e2fsprogs-libblkid</name>
	<range><lt>1.44.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Theodore Y. Ts'o reports:</p>
	<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0">
	<p>Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0</url>
	</references>
	<dates>
	<discovery>2018-03-07</discovery>
	<entry>2018-03-14</entry>
	</dates>
	</vuln>

	<vuln vid="74daa370-2797-11e8-95ec-a4badb2f4699">
	<topic>FreeBSD -- Speculative Execution Vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A number of issues relating to speculative execution
	were found last year and publicly announced January 3rd.
	Two of these, known as Meltdown and Spectre V2, are addressed
	here.</p>
	<p>CVE-2017-5754 (Meltdown) - ------------------------</p>
	<p>This issue relies on an affected CPU speculatively
	executing instructions beyond a faulting instruction. When
	this happens, changes to architectural state are not
	committed, but observable changes may be left in micro-
	architectural state (for example, cache). This may be used
	to infer privileged data.</p>
	<p>CVE-2017-5715 (Spectre V2) - --------------------------</p>
	<p>Spectre V2 uses branch target injection to speculatively
	execute kernel code at an address under the control of an
	attacker.</p>
	<h1>Impact:</h1>
	<p>An attacker may be able to read secret data from the
	kernel or from a process when executing untrusted code (for
	example, in a web browser).</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5715</cvename>
	<cvename>CVE-2017-5754</cvename>
	<freebsdsa>SA-18:03.speculative_execution</freebsdsa>
	</references>
	<dates>
	<discovery>2018-03-14</discovery>
	<entry>2018-03-14</entry>
	</dates>
	</vuln>

	<vuln vid="dca7ced0-2796-11e8-95ec-a4badb2f4699">
	<topic>FreeBSD -- ipsec validation and use-after-free</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_7</lt></range>
	<range><ge>10.4</ge><lt>10.4_7</lt></range>
	<range><ge>10.3</ge><lt>10.3_28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to a lack of strict checking, an attacker from a
	trusted host can send a specially constructed IP packet
	that may lead to a system crash.</p>
	<p>Additionally, a use-after-free vulnerability in the AH
	handling code could cause unpredictable results.</p>
	<h1>Impact:</h1>
	<p>Access to out of bounds or freed mbuf data can lead to
	a kernel panic or other unpredictable results.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6916</cvename>
	<freebsdsa>SA-18:01.ipsec</freebsdsa>
	</references>
	<dates>
	<discovery>2018-03-07</discovery>
	<entry>2018-03-14</entry>
	</dates>
	</vuln>

	<vuln vid="313078e3-26e2-11e8-9920-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>29.0.0.113</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html">
	<ul>
	<li>This update resolves a use-after-free vulnerability that
	could lead to remote code execution (CVE-2018-4919).</li>
	<li>This update resolves a type confusion vulnerability that
	could lead to remote code execution (CVE-2018-4920).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4919</cvename>
	<cvename>CVE-2018-4920</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-05.html</url>
	</references>
	<dates>
	<discovery>2018-03-13</discovery>
	<entry>2018-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="c71cdc95-3c18-45b7-866a-af28b59aabb5">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>59.0_1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.4.36_3</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.3</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.7.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.7.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/">
	<p>CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList</p>
	<p>CVE-2018-5128: Use-after-free manipulating editor selection ranges</p>
	<p>CVE-2018-5129: Out-of-bounds write with malformed IPC messages</p>
	<p>CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption</p>
	<p>CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources</p>
	<p>CVE-2018-5132: WebExtension Find API can search privileged pages</p>
	<p>CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized</p>
	<p>CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions</p>
	<p>CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts</p>
	<p>CVE-2018-5136: Same-origin policy violation with data: URL shared workers</p>
	<p>CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources</p>
	<p>CVE-2018-5138: Android Custom Tab address spoofing through long domain names</p>
	<p>CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol</p>
	<p>CVE-2018-5141: DOS attack through notifications Push API</p>
	<p>CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs</p>
	<p>CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar</p>
	<p>CVE-2018-5126: Memory safety bugs fixed in Firefox 59</p>
	<p>CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5125</cvename>
	<cvename>CVE-2018-5126</cvename>
	<cvename>CVE-2018-5127</cvename>
	<cvename>CVE-2018-5128</cvename>
	<cvename>CVE-2018-5129</cvename>
	<cvename>CVE-2018-5130</cvename>
	<cvename>CVE-2018-5131</cvename>
	<cvename>CVE-2018-5132</cvename>
	<cvename>CVE-2018-5133</cvename>
	<cvename>CVE-2018-5134</cvename>
	<cvename>CVE-2018-5135</cvename>
	<cvename>CVE-2018-5136</cvename>
	<cvename>CVE-2018-5137</cvename>
	<cvename>CVE-2018-5138</cvename>
	<cvename>CVE-2018-5140</cvename>
	<cvename>CVE-2018-5141</cvename>
	<cvename>CVE-2018-5142</cvename>
	<cvename>CVE-2018-5143</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-06/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-07/</url>
	</references>
	<dates>
	<discovery>2018-03-13</discovery>
	<entry>2018-03-13</entry>
	<modified>2018-03-16</modified>
	</dates>
	</vuln>

	<vuln vid="fb26f78a-26a9-11e8-a1c2-00505689d4ae">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba44</name>
	<range><lt>4.4.17</lt></range>
	</package>
	<package>
	<name>samba45</name>
	<range><lt>4.5.16</lt></range>
	</package>
	<package>
	<name>samba46</name>
	<range><lt>4.6.14</lt></range>
	</package>
	<package>
	<name>samba47</name>
	<range><lt>4.7.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The samba project reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1050.html">
	<p>Missing null pointer checks may crash the external
	print server process.</p>
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1057.html">
	<p>On a Samba 4 AD DC any authenticated user can change
	other user's passwords over LDAP, including the
	passwords of administrative users and service accounts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.samba.org/samba/security/CVE-2018-1050.html</url>
	<cvename>CVE-2018-1050</cvename>
	<url>https://www.samba.org/samba/security/CVE-2018-1057.html</url>
	<cvename>CVE-2018-1057</cvename>
	</references>
	<dates>
	<discovery>2018-01-03</discovery>
	<entry>2018-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="c2f107e1-2493-11e8-b3e8-001cc0382b2f">
	<topic>mbed TLS (PolarSSL) -- remote code execution</topic>
	<affects>
	<package>
	<name>mbedtls</name>
	<range><lt>2.7.0</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><lt>1.3.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Butcher reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01">
	<ul>
	<li>When the truncated HMAC extension is enabled and CBC is used,
	sending a malicious application packet can be used to selectively
	corrupt 6 bytes on the peer's heap, potentially leading to a
	crash or remote code execution. This can be triggered remotely
	from either side in both TLS and DTLS.</li>
	<li>When RSASSA-PSS signature verification is enabled, sending a
	maliciously constructed certificate chain can be used to cause a
	buffer overflow on the peer's stack, potentially leading to crash
	or remote code execution. This can be triggered remotely from
	either side in both TLS and DTLS.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01</url>
	<cvename>CVE-2018-0487</cvename>
	<cvename>CVE-2018-0488</cvename>
	</references>
	<dates>
	<discovery>2018-02-05</discovery>
	<entry>2018-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="555af074-22b9-11e8-9799-54ee754af08e">
	<topic>chromium -- vulnerability</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>65.0.3325.146</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html">
	<p>45 security fixes in this release:</p>
	<ul>
	<li>[758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
	<li>[758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
	<li>[780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02</li>
	<li>[794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12</li>
	<li>[780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31</li>
	<li>[789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30</li>
	<li>[792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07</li>
	<li>[798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03</li>
	<li>[808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01</li>
	<li>[799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05</li>
	<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
	<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
	<li>[799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08</li>
	<li>[668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25</li>
	<li>[777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23</li>
	<li>[791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01</li>
	<li>[804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20</li>
	<li>[809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06</li>
	<li>[608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03</li>
	<li>[758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24</li>
	<li>[778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26</li>
	<li>[793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10</li>
	<li>[788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24</li>
	<li>[792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05</li>
	<li>[797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24</li>
	<li>[767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21</li>
	<li>[771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-11215</cvename>
	<cvename>CVE-2017-11225</cvename>
	<cvename>CVE-2018-6060</cvename>
	<cvename>CVE-2018-6061</cvename>
	<cvename>CVE-2018-6060</cvename>
	<cvename>CVE-2018-6061</cvename>
	<cvename>CVE-2018-6062</cvename>
	<cvename>CVE-2018-6057</cvename>
	<cvename>CVE-2018-6063</cvename>
	<cvename>CVE-2018-6064</cvename>
	<cvename>CVE-2018-6065</cvename>
	<cvename>CVE-2018-6066</cvename>
	<cvename>CVE-2018-6067</cvename>
	<cvename>CVE-2018-6069</cvename>
	<cvename>CVE-2018-6070</cvename>
	<cvename>CVE-2018-6071</cvename>
	<cvename>CVE-2018-6072</cvename>
	<cvename>CVE-2018-6073</cvename>
	<cvename>CVE-2018-6074</cvename>
	<cvename>CVE-2018-6075</cvename>
	<cvename>CVE-2018-6076</cvename>
	<cvename>CVE-2018-6077</cvename>
	<cvename>CVE-2018-6078</cvename>
	<cvename>CVE-2018-6079</cvename>
	<cvename>CVE-2018-6080</cvename>
	<cvename>CVE-2018-6081</cvename>
	<cvename>CVE-2018-6082</cvename>
	<cvename>CVE-2018-6083</cvename>
	<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2016-05-03</discovery>
	<entry>2018-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="c5ab620f-4576-4ad5-b51f-93e4fec9cd0e">
	<topic>wireshark -- multiple security issues</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>wireshark-qt5</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>tshark</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wireshark developers reports:</p>
	<blockquote cite="https://www.wireshark.org/security/">
	<p>wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)</p>
	<p>wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)</p>
	<p>wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)</p>
	<p>wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)</p>
	<p>wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)</p>
	<p>wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)</p>
	<p>wnpa-sec-2018-11. Pcapng file parser crash.</p>
	<p>wnpa-sec-2018-12. IPMI dissector crash.</p>
	<p>wnpa-sec-2018-13. SIGCOMP dissector crash.</p>
	<p>wnpa-sec-2018-14. NBAP dissector crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.wireshark.org/security/</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-05.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-06.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-07.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-08.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-09.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-10.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-11.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-12.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-13.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2018-14.html</url>
	<cvename>CVE-2018-7320</cvename>
	<cvename>CVE-2018-7321</cvename>
	<cvename>CVE-2018-7322</cvename>
	<cvename>CVE-2018-7323</cvename>
	<cvename>CVE-2018-7324</cvename>
	<cvename>CVE-2018-7325</cvename>
	<cvename>CVE-2018-7326</cvename>
	<cvename>CVE-2018-7327</cvename>
	<cvename>CVE-2018-7328</cvename>
	<cvename>CVE-2018-7329</cvename>
	<cvename>CVE-2018-7330</cvename>
	<cvename>CVE-2018-7331</cvename>
	<cvename>CVE-2018-7332</cvename>
	<cvename>CVE-2018-7333</cvename>
	<cvename>CVE-2018-7334</cvename>
	<cvename>CVE-2018-7335</cvename>
	<cvename>CVE-2018-7336</cvename>
	<cvename>CVE-2018-7337</cvename>
	<cvename>CVE-2018-7417</cvename>
	</references>
	<dates>
	<discovery>2018-02-23</discovery>
	<entry>2018-03-04</entry>
	</dates>
	</vuln>

	<vuln vid="2040c7f5-1e3a-11e8-8ae9-0050569f0b83">
	<topic>isc-dhcp -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>isc-dhcp44-server</name>
	<range><lt>4.4.1</lt></range>
	</package>
	<package>
	<name>isc-dhcp44-client</name>
	<range><lt>4.4.1</lt></range>
	</package>
	<package>
	<name>isc-dhcp43-server</name>
	<range><le>4.3.6</le></range>
	</package>
	<package>
	<name>isc-dhcp43-client</name>
	<range><le>4.3.6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01565">
	<p>Failure to properly bounds check a buffer used for processing
	DHCP options allows a malicious server (or an entity
	masquerading as a server) to cause a buffer overflow (and
	resulting crash) in dhclient by sending a response containing a
	specially constructed options section.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01567">
	<p>A malicious client which is allowed to send very large amounts
	of traffic (billions of packets) to a DHCP server can eventually
	overflow a 32-bit reference counter, potentially causing dhcpd
	to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5732</cvename>
	<cvename>CVE-2018-5733</cvename>
	<url>https://kb.isc.org/article/AA-01565</url>
	<url>https://kb.isc.org/article/AA-01567</url>
	</references>
	<dates>
	<discovery>2018-02-21</discovery>
	<entry>2018-03-02</entry>
	</dates>
	</vuln>

	<vuln vid="30704aba-1da4-11e8-b6aa-4ccc6adda413">
	<topic>libsndfile -- out-of-bounds reads</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><lt>1.0.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Xin-Jiang on Github reports:</p>
	<blockquote cite="https://github.com/erikd/libsndfile/issues/317">
	<p>CVE-2017-14245 (Medium): An out of bounds read in the function
	d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote
	DoS attack or information disclosure, related to mishandling of
	the NAN and INFINITY floating-point values.</p>
	<p>CVE-2017-14246 (Medium): An out of bounds read in the function
	d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote
	DoS attack or information disclosure, related to mishandling of the
	NAN and INFINITY floating-point values.</p>
	</blockquote>
	<p>my123px on Github reports:</p>
	<blockquote cite="https://github.com/erikd/libsndfile/issues/344">
	<p>CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of
	libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
	address 0x000000000000), a different vulnerability than CVE-2017-14245.</p>
	<p>CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of
	libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
	address 0x000000000000), a different vulnerability than CVE-2017-14246.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-14245</cvename>
	<cvename>CVE-2017-14246</cvename>
	<url>https://github.com/erikd/libsndfile/issues/317</url>
	<cvename>CVE-2017-17456</cvename>
	<cvename>CVE-2017-17457</cvename>
	<url>https://github.com/erikd/libsndfile/issues/344</url>
	</references>
	<dates>
	<discovery>2017-09-11</discovery>
	<entry>2018-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="2b386075-1d9c-11e8-b6aa-4ccc6adda413">
	<topic>libsndfile -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><le>1.0.28</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Agostino Sarubbo, Gentoo reports:</p>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/">
	<p>CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in
	libsndfile 1.0.28 allows remote attackers to cause a denial of service
	(buffer overflow and application crash) or possibly have unspecified
	other impact via a crafted audio file.</p>
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/">
	<p>CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in
	libsndfile 1.0.28 allows remote attackers to cause a denial of service
	(invalid read and application crash) via a crafted audio file.</p>
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/">
	<p>CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in
	libsndfile 1.0.28 allows remote attackers to cause a denial of service
	(heap-based buffer over-read and application crash) via a crafted audio
	file.</p>
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/">
	<p>CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile
	1.0.28 allows remote attackers to cause a denial of service (buffer
	over-read and application crash) via a crafted audio file.</p>
	</blockquote>
	<p>manxorist on Github reports:</p>
	<blockquote cite="https://github.com/erikd/libsndfile/issues/292">
	<p>CVE-2017-12562 (High): Heap-based Buffer Overflow in the
	psf_binheader_writef function in common.c in libsndfile through
	1.0.28 allows remote attackers to cause a denial of service
	(application crash) or possibly have unspecified other impact.</p>
	</blockquote>
	<p>Xin-Jiang on Github reports:</p>
	<blockquote cite="https://github.com/erikd/libsndfile/issues/318">
	<p>CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero
	error exists in the function double64_init() in double64.c, which
	may lead to DoS when playing a crafted audio file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-8361</cvename>
	<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
	<url>https://github.com/erikd/libsndfile/issues/232</url>
	<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
	<cvename>CVE-2017-8362</cvename>
	<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/</url>
	<url>https://github.com/erikd/libsndfile/issues/231</url>
	<url>https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808</url>
	<cvename>CVE-2017-8363</cvename>
	<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
	<url>https://github.com/erikd/libsndfile/issues/233</url>
	<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
	<url>https://github.com/erikd/libsndfile/commit/cd7da8dbf6ee4310d21d9e44b385d6797160d9e8</url>
	<cvename>CVE-2017-8365</cvename>
	<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/</url>
	<url>https://github.com/erikd/libsndfile/issues/230</url>
	<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
	<cvename>CVE-2017-12562</cvename>
	<url>https://github.com/erikd/libsndfile/issues/292/</url>
	<url>https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8</url>
	<cvename>CVE-2017-14634</cvename>
	<url>https://github.com/erikd/libsndfile/issues/318</url>
	<url>https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788</url>
	</references>
	<dates>
	<discovery>2017-04-12</discovery>
	<entry>2018-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="e3eeda2e-1d67-11e8-a2ec-6cc21735f730">
	<topic>PostgreSQL vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.22</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.17</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.12</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.8</lt></range>
	</package>
	<package>
	<name>postgresql10-server</name>
	<range><ge>10.0</ge><lt>10.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/1834/">
	<ul>
	<li>CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path</url>
	<cvename>CVE-2018-1058</cvename>
	</references>
	<dates>
	<discovery>2018-03-01</discovery>
	<entry>2018-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="6a449a37-1570-11e8-8e00-000c294a5758">
	<topic>strongswan - Insufficient input validation in RSASSA-PSS signature parser</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><eq>5.6.1</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Strongswan Release Notes reports:</p>
	<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
	<p>Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that
	was caused by insufficient input validation. One of the configurable
	parameters in algorithm identifier structures for RSASSA-PSS signatures is the
	mask generation function (MGF). Only MGF1 is currently specified for this
	purpose. However, this in turn takes itself a parameter that specifies the
	underlying hash function. strongSwan's parser did not correctly handle the
	case of this parameter being absent, causing an undefined data read.
	his vulnerability has been registered as CVE-2018-6459.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6459</cvename>
	<url>https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68675eb44806668</url>
	</references>
	<dates>
	<discovery>2018-01-31</discovery>
	<entry>2018-02-19</entry>
	</dates>
	</vuln>

	<vuln vid="004debf9-1d16-11e8-b6aa-4ccc6adda413">
	<topic>libsndfile -- out-of-bounds read memory access</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><le>1.0.28</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Laurent Delosieres, Secunia Research at Flexera Software reports:</p>
	<blockquote cite="https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/">
	<p>Secunia Research has discovered a vulnerability in libsndfile, which can be
	exploited by malicious people to disclose potentially sensitive information.
	The vulnerability is caused due to an error in the "aiff_read_chanmap()" function
	(src/aiff.c), which can be exploited to cause an out-of-bounds read memory access
	via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28.
	Other versions may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6892</cvename>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6892</url>
	<url>https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/</url>
	<url>https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748</url>
	</references>
	<dates>
	<discovery>2017-05-23</discovery>
	<entry>2018-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="af485ef4-1c58-11e8-8477-d05099c0ae8c">
	<topic>ntp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_7</lt></range>
	<range><ge>10.4</ge><lt>10.4_6</lt></range>
	<range><ge>10.3</ge><lt>10.3_27</lt></range>
	</package>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p11</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Network Time Foundation reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S">
	<p>The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.</p>
	<p>This release addresses five security issues in ntpd:</p>
	<ul>
	<li>LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil
	vulnerability: ephemeral association attack</li>
	<li>INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909:
	ctl_getitem(): buffer read overrun leads to undefined
	behavior and information leak</li>
	<li>LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple
	authenticated ephemeral associations</li>
	<li>LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved
	symmetric mode cannot recover from bad state</li>
	<li>LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909:
	Unauthenticated packet can reset authenticated interleaved
	association</li>
	</ul>
	<p>one security issue in ntpq:</p>
	<ul>
	<li>MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909:
	ntpq:decodearr() can write beyond its buffer limit</li>
	</ul>
	<p>and provides over 33 bugfixes and 32 other improvements.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1549</cvename>
	<cvename>CVE-2018-7182</cvename>
	<cvename>CVE-2018-7170</cvename>
	<cvename>CVE-2018-7184</cvename>
	<cvename>CVE-2018-7185</cvename>
	<cvename>CVE-2018-7183</cvename>
	<freebsdsa>SA-18:02.ntp</freebsdsa>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S</url>
	</references>
	<dates>
	<discovery>2018-02-27</discovery>
	<entry>2018-02-28</entry>
	<modified>2018-03-14</modified>
	</dates>
	</vuln>

	<vuln vid="abfc932e-1ba8-11e8-a944-54ee754af08e">
	<topic>chromium -- vulnerability</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>64.0.3282.167</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html">
	<p>1 security fix in this release:</p>
	<ul>
	<li>[806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6056</cvename>
	<url>https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html</url>
	</references>
	<dates>
	<discovery>2018-01-26</discovery>
	<entry>2018-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>64.0.3282.119</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">
	<p>Several security fixes in this release, including:</p>
	<ul>
	<li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li>
	<li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li>
	<li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li>
	<li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li>
	<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
	<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
	<li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on
	2017-08-09</li>
	<li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li>
	<li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li>
	<li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li>
	<li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li>
	<li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li>
	<li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li>
	<li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
	<li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li>
	<li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li>
	<li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li>
	<li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li>
	<li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li>
	<li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li>
	<li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li>
	<li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li>
	<li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li>
	<li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6031</cvename>
	<cvename>CVE-2018-6032</cvename>
	<cvename>CVE-2018-6033</cvename>
	<cvename>CVE-2018-6034</cvename>
	<cvename>CVE-2018-6035</cvename>
	<cvename>CVE-2018-6036</cvename>
	<cvename>CVE-2018-6037</cvename>
	<cvename>CVE-2018-6038</cvename>
	<cvename>CVE-2018-6039</cvename>
	<cvename>CVE-2018-6040</cvename>
	<cvename>CVE-2018-6041</cvename>
	<cvename>CVE-2018-6042</cvename>
	<cvename>CVE-2018-6043</cvename>
	<cvename>CVE-2018-6045</cvename>
	<cvename>CVE-2018-6046</cvename>
	<cvename>CVE-2018-6047</cvename>
	<cvename>CVE-2018-6048</cvename>
	<cvename>CVE-2017-15420</cvename>
	<cvename>CVE-2018-6049</cvename>
	<cvename>CVE-2018-6050</cvename>
	<cvename>CVE-2018-6051</cvename>
	<cvename>CVE-2018-6052</cvename>
	<cvename>CVE-2018-6053</cvename>
	<cvename>CVE-2018-6054</cvename>
	<url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>
	</references>
	<dates>
	<discovery>2017-08-09</discovery>
	<entry>2018-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="55c4233e-1844-11e8-a712-0025908740c2">
	<topic>tomcat -- Security constraints ignored or applied too late</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><ge>7.0.0</ge><le>7.0.84</le></range>
	<range><ge>8.0.0</ge><le>8.0.49</le></range>
	<range><ge>8.5.0</ge><le>8.5.27</le></range>
	<range><ge>9.0.0</ge><le>9.0.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781@%3Cannounce.tomcat.apache.org%3E">
	<p>Security constraints defined by annotations of Servlets were only
	applied once a Servlet had been loaded. Because security constraints
	defined in this way apply to the URL pattern and any URLs below that
	point, it was possible - depending on the order Servlets were loaded -
	for some security constraints not to be applied. This could have exposed
	resources to users who were not authorised to access them.</p>
	</blockquote>
	<blockquote cite="https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb@%3Cannounce.tomcat.apache.org%3E">
	<p>The URL pattern of "" (the empty string) which exactly maps to the
	context root was not correctly handled when used as part of a security
	constraint definition. This caused the constraint to be ignored. It was,
	therefore, possible for unauthorised users to gain access to web
	application resources that should have been protected. Only security
	constraints with a URL pattern of the empty string were affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://tomcat.apache.org/security-9.html</url>
	<url>http://tomcat.apache.org/security-8.html</url>
	<url>http://tomcat.apache.org/security-7.html</url>
	<cvename>CVE-2018-1304</cvename>
	<cvename>CVE-2018-1305</cvename>
	</references>
	<dates>
	<discovery>2018-02-23</discovery>
	<entry>2018-02-23</entry>
	</dates>
	</vuln>

	<vuln vid="22438240-1bd0-11e8-a2ec-6cc21735f730">
	<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
	<affects>
	<package>
	<name>xmltooling</name>
	<range><lt>1.6.4</lt></range>
	</package>
	<package>
	<name>xerces-c3</name>
	<range><lt>3.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Shibboleth consortium reports:</p>
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180227.txt">
	<p>
	Shibboleth SP software vulnerable to additional data forgery flaws
	</p>
	<p>
	The XML processing performed by the Service Provider software has
	been found to be vulnerable to new flaws similar in nature to the
	one addressed in an advisory last month.
	</p>
	<p>
	These bugs involve the use of other XML constructs rather than
	entity references, and therefore required additional mitigation once
	discovered. As with the previous issue, this flaw allows for
	changes to an XML document that do not break a digital signature but
	can alter the user data passed through to applications behind the SP
	and result in impersonation attacks and exposure of protected
	information.
	</p>
	<p>
	As before, the use of XML Encryption is a significant mitigation,
	but we have not dismissed the possibility that attacks on the
	Response "envelope" may be possible, in both the original and this
	new case. No actual attacks of this nature are known, so deployers
	should prioritize patching systems that expect to handle unencrypted
	SAML assertions.
	</p>
	<p>
	An updated version of XMLTooling-C (V1.6.4) is available that
	protects against these new attacks, and should help prevent similar
	vulnerabilities in the future.
	</p>
	<p>
	Unlike the previous case, these bugs are NOT prevented by any
	existing Xerces-C parser version on any platform and cannot be
	addressed by any means other than the updated XMLTooling-C library.
	</p>
	<p>
	The Service Provider software relies on a generic XML parser to
	process SAML responses and there are limitations in older versions
	of the parser that make it impossible to fully disable Document Type
	Definition (DTD) processing.
	</p>
	<p>
	Through addition/manipulation of a DTD, it's possible to make
	changes to an XML document that do not break a digital signature but
	are mishandled by the SP and its libraries. These manipulations can
	alter the user data passed through to applications behind the SP and
	result in impersonation attacks and exposure of protected
	information.
	</p>
	<p>
	While newer versions of the xerces-c3 parser are configured by the
	SP into disallowing the use of a DTD via an environment variable,
	this feature is not present in the xerces-c3 parser before version
	3.1.4, so an additional fix is being provided now that an actual DTD
	exploit has been identified. Xerces-c3-3.1.4 was committed to the
	ports tree already on 2016-07-26.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://shibboleth.net/community/advisories/secadv_20180227.txt</url>
	<cvename>CVE-2018-0489</cvename>
	</references>
	<dates>
	<discovery>2018-02-27</discovery>
	<entry>2018-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="57580fcc-1a61-11e8-97e0-00e04c1ea73d">
	<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.56</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><lt>8.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2018-001">
	<p>CVE-2017-6926: Comment reply form allows access to restricted content</p>
	<p>CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete</p>
	<p>CVE-2017-6928: Private file access bypass - Moderately Critical</p>
	<p>CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical</p>
	<p>CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions</p>
	<p>CVE-2017-6931: Settings Tray access bypass</p>
	<p>CVE-2017-6932: External link injection on 404 pages when linking to the current page</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6926</cvename>
	<cvename>CVE-2017-6927</cvename>
	<cvename>CVE-2017-6928</cvename>
	<cvename>CVE-2017-6929</cvename>
	<cvename>CVE-2017-6930</cvename>
	<cvename>CVE-2017-6931</cvename>
	<cvename>CVE-2017-6932</cvename>
	</references>
	<dates>
	<discovery>2018-02-21</discovery>
	<entry>2018-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="d9fe59ea-1940-11e8-9eb8-5404a68ad561">
	<topic>cvs -- Remote code execution via ssh command injection</topic>
	<affects>
	<package>
	<name>cvs</name>
	<range><lt>1.20120905_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hank Leininger reports:</p>
	<blockquote cite="http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html">
	<p>Bugs in Git, Subversion, and Mercurial were just announced and patched
	which allowed arbitrary local command execution if a malicious name was
	used for the remote server, such as starting with - to pass options to
	the ssh client:
	git clone ssh://-oProxyCommand=some-command...
	CVS has a similar problem with the -d option:</p>
	<p>Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html</url>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10</url>
	<cvename>CVE-2017-12836</cvename>
	<freebsdpr>ports/226088</freebsdpr>
	</references>
	<dates>
	<discovery>2017-08-10</discovery>
	<entry>2018-02-24</entry>
	</dates>
	</vuln>

	<vuln vid="289269f1-0def-11e8-99b0-d017c2987f9a">
	<topic>LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula</topic>
	<affects>
	<package>
	<name>libreoffice</name>
	<range><lt>5.4.5</lt></range>
	<range><ge>6.0.0</ge><lt>6.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>LibreOffice reports:</p>
	<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/">
	<p>LibreOffice Calc supports a WEBSERVICE function to obtain data by URL.
	Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file
	URL (e.g file://) which can be used to inject local files into the
	spreadsheet without warning the user. Subsequent formulas can operate on
	that inserted data and construct a remote URL whose path leaks the local
	data to a remote attacker.</p>
	<p>In later versions of LibreOffice without this flaw, WEBSERVICE has now
	been limited to accessing http and https URLs along with bringing
	WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.</p>
	<p><strong>Note:</strong> This vulnerability has been identified upstream
	as CVE-2018-1055, but NVD/Mitre are advising it's a reservation
	duplicate of CVE-2018-6871 which should be used instead.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/</url>
	<url>https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure</url>
	<cvename>CVE-2018-6871</cvename>
	<freebsdpr>ports/225797</freebsdpr>
	</references>
	<dates>
	<discovery>2018-02-09</discovery>
	<entry>2018-02-23</entry>
	</dates>
	</vuln>

	<vuln vid="d5b6d151-1887-11e8-94f7-9c5c8e75236a">
	<topic>squid -- Vulnerable to Denial of Service attack</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>3.5.27_3</lt></range>
	</package>
	<package>
	<name>squid-devel</name>
	<range><lt>4.0.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Louis Dion-Marcil reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_1.txt">
	<p>Due to incorrect pointer handling Squid is vulnerable to denial
	of service attack when processing ESI responses.</p>
	<p>This problem allows a remote server delivering certain ESI
	response syntax to trigger a denial of service for all clients
	accessing the Squid service.</p>
	<p>Due to unrelated changes Squid-3.5 has become vulnerable to some
	regular ESI server responses also triggering this issue.</p>
	<p>This problem is limited to the Squid custom ESI parser.
	Squid built to use libxml2 or libexpat XML parsers do not have
	this problem.</p>
	</blockquote>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_2.txt">
	<p>Due to incorrect pointer handling Squid is vulnerable to denial
	of service attack when processing ESI responses or downloading
	intermediate CA certificates.</p>
	<p>This problem allows a remote client delivering certain HTTP
	requests in conjunction with certain trusted server responses to
	trigger a denial of service for all clients accessing the Squid
	service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.squid-cache.org/Advisories/SQUID-2018_1.txt</url>
	<url>http://www.squid-cache.org/Advisories/SQUID-2018_2.txt</url>
	<cvename>CVE-2018-1000024</cvename>
	<cvename>CVE-2018-1000027</cvename>
	<url>https://www.debian.org/security/2018/dsa-4122</url>
	<freebsdpr>ports/226138</freebsdpr>
	</references>
	<dates>
	<discovery>2017-12-13</discovery>
	<entry>2018-02-23</entry>
	</dates>
	</vuln>

	<vuln vid="933654ce-17b8-11e8-90b8-001999f8d30b">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.19.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>AST-2018-004 - When processing a SUBSCRIBE request the
	res_pjsip_pubsub module stores the accepted formats present
	in the Accept headers of the request. This code did not
	limit the number of headers it processed despite having
	a fixed limit of 32. If more than 32 Accept headers were
	present the code would write outside of its memory and
	cause a crash.</p>
	<p>AST-2018-005 - A crash occurs when a number of
	authenticated INVITE messages are sent over TCP or TLS
	and then the connection is suddenly closed. This issue
	leads to a segmentation fault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-004.html</url>
	<cvename>CVE-2018-7284</cvename>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-005.html</url>
	<cvename>CVE-2018-7286</cvename>
	</references>
	<dates>
	<discovery>2018-02-21</discovery>
	<entry>2018-02-22</entry>
	<modified>2018-06-12</modified>
	</dates>
	</vuln>

	<vuln vid="f9f5c5a2-17b5-11e8-90b8-001999f8d30b">
	<topic>asterisk and pjsip -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.19.2</lt></range>
	</package>
	<package>
	<name>pjsip</name>
	<range><lt>2.7.2</lt></range>
	</package>
	<package>
	<name>pjsip-extsrtp</name>
	<range><lt>2.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	<p>AST-2018-002 - By crafting an SDP message with an
	invalid media format description Asterisk crashes when
	using the pjsip channel driver because pjproject's sdp
	parsing algorithm fails to catch the invalid media format
	description.</p>
	<p>AST-2018-003 - By crafting an SDP message body with
	an invalid fmtp attribute Asterisk crashes when using the
	pjsip channel driver because pjproject's fmtp retrieval
	function fails to check if fmtp value is empty (set empty
	if previously parsed as invalid).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-002.html</url>
	<url>https://downloads.asterisk.org/pub/security/AST-2018-003.html</url>
	</references>
	<dates>
	<discovery>2018-02-21</discovery>
	<entry>2018-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="261ca31c-179f-11e8-b8b9-6805ca0b3d42">
	<topic>phpMyAdmin -- self XSS in central columns feature</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-1/">
	<h3>Summary</h3>
	<p>Self XSS in central columns feature</p>
	<h3>Description</h3>
	<p>A self-cross site scripting (XSS) vulnerability has been
	reported relating to the central columns feature.</p>
	<h3>Severity</h3>
	<p>We consider this vulnerability to be of moderate severity.</p>
	<h3>Mitigation factor</h3>
	<p>A valid token must be used in the attack</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2018-1/</url>
	<cvename>CVE-2018-7260</cvename>
	</references>
	<dates>
	<discovery>2018-02-21</discovery>
	<entry>2018-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="86291013-16e6-11e8-ae9f-d43d7e971a1b">
	<topic>GitLab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>6.1.0</ge><le>10.2.7</le></range>
	<range><ge>10.3.0</ge><le>10.3.6</le></range>
	<range><ge>10.4.0</ge><le>10.4.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/">
	<h1>SnippetFinder information disclosure</h1>
	<p>The GitLab SnippetFinder component contained an information disclosure
	which allowed access to snippets restricted to Only team members or
	configured as disabled. The issue is now resolved in the latest version.</p>
	<h1>LDAP API authorization issue</h1>
	<p>An LDAP API endpoint contained an authorization vulnerability which
	unintentionally disclosed bulk LDAP groups data. This issue is now fixed in
	the latest release.</p>
	<h1>Persistent XSS mermaid markdown</h1>
	<p>The mermaid markdown feature contained a persistent XSS issue that is now
	resolved in the latest release.</p>
	<h1>Insecure direct object reference Todo API</h1>
	<p>The Todo API was vulnerable to an insecure direct object reference issue
	which resulted in an information disclosure of confidential data.</p>
	<h1>GitHub import access control issue</h1>
	<p>An improper access control weakness issue was discovered in the GitHub
	import feature. The issue allowed an attacker to create projects under other
	accounts which they shouldn't have access to. The issue is now resolved in
	the latest version.</p>
	<h1>Protected variables information disclosure</h1>
	<p>The CI jobs protected tag feature contained a vulnerability which
	resulted in an information disclosure of protected variables. The issue is
	now resolved in the latest release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/</url>
	</references>
	<dates>
	<discovery>2018-02-07</discovery>
	<entry>2018-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="7afc5e56-156d-11e8-95f2-005056925db4">
	<topic>irssi -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>1.1.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Irssi reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2018_02.txt">
	<p>Use after free when server is disconnected during netsplits.
	Found by Joseph Bisch.</p>
	<p>Use after free when SASL messages are received in unexpected order.
	Found by Joseph Bisch.</p>
	<p>Null pointer dereference when an “empty” nick has been observed by
	Irssi. Found by Joseph Bisch.</p>
	<p>When the number of windows exceed the available space, Irssi would
	crash due to Null pointer dereference. Found by Joseph Bisch.</p>
	<p>Certain nick names could result in out of bounds access when printing
	theme strings. Found by Oss-Fuzz.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://irssi.org/security/irssi_sa_2018_02.txt</url>
	<cvename>CVE-2018-7054</cvename>
	<cvename>CVE-2018-7053</cvename>
	<cvename>CVE-2018-7052</cvename>
	<cvename>CVE-2018-7051</cvename>
	<cvename>CVE-2018-7050</cvename>
	<freebsdpr>ports/226001</freebsdpr>
	</references>
	<dates>
	<discovery>2018-02-15</discovery>
	<entry>2018-02-19</entry>
	<modified>2018-02-22</modified>
	</dates>
	</vuln>

	<vuln vid="a183acb5-1414-11e8-9542-002590acae31">
	<topic>p5-Mojolicious -- cookie-handling vulnerability</topic>
	<affects>
	<package>
	<name>p5-Mojolicious</name>
	<range><lt>7.66</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Upstream commit:</p>
	<blockquote cite="https://github.com/kraih/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149">
	<p>Vulnerabilities existed in cookie handling.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/kraih/mojo/issues/1185</url>
	</references>
	<dates>
	<discovery>2018-01-31</discovery>
	<entry>2018-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="22283b8c-13c5-11e8-a861-20cf30e32f6d">
	<topic>Bugzilla security issues</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.13</lt></range>
	</package>
	<package>
	<name>bugzilla50</name>
	<range><lt>5.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bugzilla Security Advisory</p>
	<blockquote cite="https://www.bugzilla.org/security/4.4.12/">
	<p>A CSRF vulnerability in report.cgi would allow a third-party site
	to extract confidential information from a bug the victim had access to.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5123</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1433400</url>
	</references>
	<dates>
	<discovery>2018-02-16</discovery>
	<entry>2018-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="044cff62-ed8b-4e72-b102-18a7d58a669f">
	<topic>bro -- integer overflow allows remote DOS</topic>
	<affects>
	<package>
	<name>bro</name>
	<range><lt>2.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Philippe Antoine of Catena cyber:</p>
	<blockquote cite="http://blog.bro.org/2018/02/bro-253-released-security-update.html">
	<p>This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.bro.org/2018/02/bro-253-released-security-update.html</url>
	</references>
	<dates>
	<discovery>2018-02-14</discovery>
	<entry>2018-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="ad2eeab6-ca68-4f06-9325-1937b237df60">
	<topic>consul -- vulnerability in embedded DNS library</topic>
	<affects>
	<package>
	<name>consul</name>
	<range><lt>1.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Consul developers report:</p>
	<blockquote cite="https://github.com/hashicorp/consul/issues/3859">
	<p>A flaw was found in the embedded DNS library used in consul which
	may allow a denial of service attack. Consul was updated to include
	the fixed version.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/hashicorp/consul/issues/3859</url>
	<url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#105-february-7-2018</url>
	<url>https://github.com/miekg/dns/pull/631</url>
	<url>https://github.com/miekg/dns/issues/627</url>
	<cvename>CVE-2017-15133</cvename>
	</references>
	<dates>
	<discovery>2018-01-17</discovery>
	<entry>2018-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="746d04dc-507e-4450-911f-4c41e48bb07a">
	<topic>bro -- out of bounds write allows remote DOS</topic>
	<affects>
	<package>
	<name>bro</name>
	<range><lt>2.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Frank Meier:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000458">
	<p>Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.bro.org/2017/10/bro-252-242-release-security-update.html</url>
	</references>
	<dates>
	<discovery>2017-10-16</discovery>
	<entry>2018-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="e15a22ce-f16f-446b-9ca7-6859350c2e75">
	<topic>quagga -- several security issues</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>1.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Quagga reports:</p>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-0543.txt">
	<p>The Quagga BGP daemon, bgpd, does not properly bounds
	check the data sent with a NOTIFY to a peer, if an attribute
	length is invalid. Arbitrary data from the bgpd process
	may be sent over the network to a peer and/or it may crash.</p>
	</blockquote>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-1114.txt">
	<p>The Quagga BGP daemon, bgpd, can double-free memory
	when processing certain forms of UPDATE message, containing
	cluster-list and/or unknown attributes.</p>
	</blockquote>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-1550.txt">
	<p>The Quagga BGP daemon, bgpd, can overrun internal BGP
	code-to-string conversion tables used for debug by 1
	pointer value, based on input.</p>
	</blockquote>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-1975.txt">
	<p>The Quagga BGP daemon, bgpd, can enter an infinite
	loop if sent an invalid OPEN message by a configured peer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.quagga.net/security/Quagga-2018-0543.txt</url>
	<url>https://www.quagga.net/security/Quagga-2018-1114.txt</url>
	<url>https://www.quagga.net/security/Quagga-2018-1550.txt</url>
	<url>https://www.quagga.net/security/Quagga-2018-1975.txt</url>
	<cvename>CVE-2018-5378</cvename>
	<cvename>CVE-2018-5379</cvename>
	<cvename>CVE-2018-5380</cvename>
	<cvename>CVE-2018-5381</cvename>
	</references>
	<dates>
	<discovery>2018-01-31</discovery>
	<entry>2018-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="6f0b0cbf-1274-11e8-8b5b-4ccc6adda413">
	<topic>libraw -- multiple DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><lt>0.18.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="https://www.securityfocus.com/archive/1/541732">
	<p>CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()"
	function (internal/dcraw_common.cpp) can be exploited to cause a heap-based
	buffer overflow and subsequently cause a crash.</p>
	<p>CVE-2017-5801: An error within the "LibRaw::unpack()" function
	(src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.</p>
	<p>CVE-2017-5802: An error within the "kodak_radc_load_raw()" function
	(internal/dcraw_common.cpp) related to the "buf" variable can be exploited
	to cause an out-of-bounds read memory access and subsequently cause a crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.securityfocus.com/archive/1/541732</url>
	<cvename>CVE-2018-5800</cvename>
	<cvename>CVE-2018-5801</cvename>
	<cvename>CVE-2018-5802</cvename>
	</references>
	<dates>
	<discovery>2018-01-16</discovery>
	<entry>2018-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="c60804f1-126f-11e8-8b5b-4ccc6adda413">
	<topic>libraw -- multiple DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><lt>0.18.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="https://www.securityfocus.com/archive/1/541583">
	<p>CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()"
	function (dcraw_common.cpp) can be exploited to cause a heap-based buffer
	overflow and subsequently cause a crash via a specially crafted TIFF image.</p>
	<p>CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function
	(internal/dcraw_common.cpp) can be exploited to cause an invalid read
	memory access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.securityfocus.com/archive/1/541583</url>
	<cvename>CVE-2017-16909</cvename>
	<cvename>CVE-2017-16910</cvename>
	</references>
	<dates>
	<discovery>2017-12-04</discovery>
	<entry>2018-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="1a75c84a-11c8-11e8-83e7-485b3931c969">
	<topic>bitmessage -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>bitmessage</name>
	<range><le>0.6.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bitmessage developers report:</p>
	<blockquote cite="https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3">
	<p>A remote code execution vulnerability has been spotted in use
	against some users running PyBitmessage v0.6.2. The cause was
	identified and a fix has been added and released as 0.6.3.2. (Will be
	updated if/when CVE will be available.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3</url>
	<url>https://bitmessage.org/wiki/Main_Page</url>
	</references>
	<dates>
	<discovery>2018-02-13</discovery>
	<entry>2018-02-14</entry>
	</dates>
	</vuln>

	<vuln vid="5d374fbb-bae3-45db-afc0-795684ac7353">
	<topic>jenkins -- Path traversal vulnerability allows access to files outside plugin resources</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>2.106</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>2.89.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins developers report:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2018-02-14/">
	<p>Jenkins did not properly prevent specifying relative paths that
	escape a base directory for URLs accessing plugin resource files. This
	allowed users with Overall/Read permission to download files from the
	Jenkins master they should not have access to.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2018-02-14/</url>
	<url>https://jenkins.io/blog/2018/02/14/security-updates/</url>
	<cvename>CVE-2018-6356</cvename>
	</references>
	<dates>
	<discovery>2018-02-14</discovery>
	<entry>2018-02-14</entry>
	</dates>
	</vuln>

	<vuln vid="279f682c-0e9e-11e8-83e7-485b3931c969">
	<topic>bchunk -- access violation near NULL on destination operand and crash</topic>
	<affects>
	<package>
	<name>bchunk</name>
	<range><ge>1.2.0</ge><le>1.2.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15955">
	<p>bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near
	NULL on destination operand" and crash when processing a malformed CUE
	(.cue) file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15955</cvename>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15955</url>
	</references>
	<dates>
	<discovery>2017-10-28</discovery>
	<entry>2018-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="8ba2819c-0e9d-11e8-83e7-485b3931c969">
	<topic>bchunk -- heap-based buffer overflow (with invalid free) and crash</topic>
	<affects>
	<package>
	<name>bchunk</name>
	<range><ge>1.2.0</ge><le>1.2.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15954">
	<p>bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer
	overflow (with a resultant invalid free) and crash when processing a
	malformed CUE (.cue) file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15954</cvename>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15954</url>
	</references>
	<dates>
	<discovery>2017-10-28</discovery>
	<entry>2018-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="1ec1c59b-0e98-11e8-83e7-485b3931c969">
	<topic>bchunk -- heap-based buffer overflow and crash</topic>
	<affects>
	<package>
	<name>bchunk</name>
	<range><ge>1.2.0</ge><le>1.2.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15953">
	<p>bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow
	and crash when processing a malformed CUE (.cue) file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15953</cvename>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15953</url>
	</references>
	<dates>
	<discovery>2017-10-28</discovery>
	<entry>2018-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="a8f25565-109e-11e8-8d41-97657151f8c2">
	<topic>uwsgi -- a stack-based buffer overflow</topic>
	<affects>
	<package>
	<name>uwsgi</name>
	<range><lt>2.0.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Uwsgi developers report:</p>
	<blockquote cite="http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html">
	<p>It was discovered that the uwsgi_expand_path function in utils.c in
	Unbit uWSGI, an application container server, has a stack-based buffer
	overflow via a large directory length that can cause a
	denial-of-service (application crash) or stack corruption.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html</url>
	<url>https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html</url>
	<cvename>CVE-2018-6758</cvename>
	</references>
	<dates>
	<discovery>2018-02-06</discovery>
	<entry>2018-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="0fe70bcd-2ce3-46c9-a64b-4a7da097db07">
	<topic>python -- possible integer overflow vulnerability</topic>
	<affects>
	<package>
	<name>python34</name>
	<range><lt>3.4.8</lt></range>
	</package>
	<package>
	<name>python35</name>
	<range><lt>3.5.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Python issue:</p>
	<blockquote cite="https://bugs.python.org/issue30657">
	<p>There is a possible integer overflow in PyString_DecodeEscape
	function of the file stringobject.c, which can be abused to gain
	a heap overflow, possibly leading to arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.python.org/issue30657</url>
	<url>https://docs.python.org/3.4/whatsnew/changelog.html</url>
	<url>https://docs.python.org/3.5/whatsnew/changelog.html</url>
	<cvename>CVE-2017-1000158</cvename>
	</references>
	<dates>
	<discovery>2017-06-03</discovery>
	<entry>2018-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="aa743ee4-0f16-11e8-8fd2-10bf48e1088e">
	<topic>electrum -- JSONRPC vulnerability</topic>
	<affects>
	<package>
	<name>electrum-py36</name>
	<range><ge>2.6</ge><lt>3.0.5</lt></range>
	</package>
	<package>
	<name>electrum2</name>
	<range><ge>2.6</ge><lt>3.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6353">
	<p>JSONRPC vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-6353</cvename>
	<url>https://github.com/spesmilo/electrum-docs/blob/master/cve.rst</url>
	<url>https://bitcointalk.org/index.php?topic=2702103.0</url>
	</references>
	<dates>
	<discovery>2018-01-27</discovery>
	<entry>2018-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="e4dd787e-0ea9-11e8-95f2-005056925db4">
	<topic>libtorrent -- remote DoS</topic>
	<affects>
	<package>
	<name>libtorrent</name>
	<range><lt>0.13.6_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>X-cela reports:</p>
	<blockquote cite="https://github.com/rakshasa/libtorrent/pull/99">
	<p>Calls into build_benocde that use %zu could crash on 64 bit
	machines due to the size change of size_t. Someone can force
	READ_ENC_IA to fail allowing an internal_error to be thrown
	and bring down the client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/rakshasa/libtorrent/pull/99</url>
	<freebsdpr>ports/224664</freebsdpr>
	</references>
	<dates>
	<discovery>2015-12-01</discovery>
	<entry>2018-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="316b3c3e-0e98-11e8-8d41-97657151f8c2">
	<topic>exim -- a buffer overflow vulnerability, remote code execution</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><lt>4.90.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Exim developers report:</p>
	<blockquote cite="https://exim.org/static/doc/security/CVE-2018-6789.txt">
	<p>There is a buffer overflow in base64d(), if some pre-conditions are met.
	Using a handcrafted message, remote code execution seems to be possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://exim.org/static/doc/security/CVE-2018-6789.txt</url>
	</references>
	<dates>
	<discovery>2018-02-05</discovery>
	<entry>2018-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="7a2e0063-0e4e-11e8-94c0-5453ed2e2b49">
	<topic>p7zip-codec-rar -- insufficient error handling</topic>
	<affects>
	<package>
	<name>p7zip-codec-rar</name>
	<range><lt>16.02_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996">
	<p>Insufficient exception handling in the method
	NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip
	can lead to multiple memory corruptions within the PPMd code,
	alows remote attackers to cause a denial of service (segmentation
	fault) or execute arbitrary code via a crafted RAR archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5996</cvename>
	<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5996</url>
	</references>
	<dates>
	<discovery>2018-01-23</discovery>
	<entry>2018-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="6d337396-0e4a-11e8-94c0-5453ed2e2b49">
	<topic>p7zip -- heap-based buffer overflow</topic>
	<affects>
	<package>
	<name>p7zip</name>
	<range><lt>16.02_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969">
	<p>Heap-based buffer overflow in the
	NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before
	18.00 and p7zip allows remote attackers to cause a denial of
	service (out-of-bounds write) or potentially execute arbitrary
	code via a crafted ZIP archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-17969</cvename>
	<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17969</url>
	<url>https://marc.info/?l=bugtraq&=151782582216805&=2</url>
	</references>
	<dates>
	<discovery>2018-01-23</discovery>
	<entry>2018-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a">
	<topic>mpv -- arbitrary code execution via crafted website</topic>
	<affects>
	<package>
	<name>mpv</name>
	<range><lt>0.27.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mpv developers report:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6360">
	<p>mpv through 0.28.0 allows remote attackers to execute arbitrary code
	via a crafted web site, because it reads HTML documents containing
	VIDEO elements, and accepts arbitrary URLs in a src attribute without
	a protocol whitelist in player/lua/ytdl_hook.lua. For example, an
	av://lavfi:ladspa=file= URL signifies that the product should call
	dlopen on a shared object file located at an arbitrary local pathname.
	The issue exists because the product does not consider that youtube-dl
	can provide a potentially unsafe URL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/mpv-player/mpv/issues/5456</url>
	<cvename>CVE-2018-6360</cvename>
	</references>
	<dates>
	<discovery>2018-01-28</discovery>
	<entry>2018-02-09</entry>
	<modified>2018-02-11</modified>
	</dates>
	</vuln>

	<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a">
	<topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic>
	<affects>
	<package>
	<name>mailman</name>
	<range><lt>2.1.26</lt></range>
	</package>
	<package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.26</lt></range>
	</package>
	<package>
	<name>ja-mailman</name>
	<range><le>2.1.14.j7_3,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Sapiro reports:</p>
	<blockquote cite="https://www.mail-archive.com/mailman-users@python.org/msg70478.html">
	<p>An XSS vulnerability in the user options CGI could allow a crafted URL
	to execute arbitrary javascript in a user's browser. A related issue
	could expose information on a user's options page without requiring
	login.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mail-archive.com/mailman-users@python.org/msg70478.html</url>
	<cvename>CVE-2018-5950</cvename>
	</references>
	<dates>
	<discovery>2018-01-20</discovery>
	<entry>2018-02-08</entry>
	</dates>
	</vuln>

	<vuln vid="c602c791-0cf4-11e8-a2ec-6cc21735f730">
	<topic>PostgreSQL vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.21</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.16</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.11</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.7</lt></range>
	</package>
	<package>
	<name>postgresql10-server</name>
	<range><ge>10.0</ge><lt>10.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/1829/">
	<ul>
	<li>CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)</li>
	<li>CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1052</cvename>
	<cvename>CVE-2018-1053</cvename>
	</references>
	<dates>
	<discovery>2018-02-05</discovery>
	<entry>2018-02-08</entry>
	</dates>
	</vuln>

	<vuln vid="b38e8150-0535-11e8-96ab-0800271d4b9c">
	<topic>tiff -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><le>4.0.9</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Security Advisory reports:</p>
	<blockquote cite="https://www.debian.org/security/2018/dsa-4100">
	<p>Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-9935</cvename>
	<url>http://bugzilla.maptools.org/show_bug.cgi?id=2704</url>
	<cvename>CVE-2017-18013</cvename>
	<url>http://bugzilla.maptools.org/show_bug.cgi?id=2770</url>
	<bid>225544</bid>
	</references>
	<dates>
	<discovery>2017-06-22</discovery>
	<entry>2018-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="756a8631-0b84-11e8-a986-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>28.0.0.161</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html">
	<ul>
	<li>This update resolves use-after-free vulnerabilities that
	could lead to remote code execution (CVE-2018-4877,
	CVE-2018-4878).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4877</cvename>
	<cvename>CVE-2018-4878</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsa18-01.html</url>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-03.html</url>
	</references>
	<dates>
	<discovery>2018-01-31</discovery>
	<entry>2018-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="f5524753-67b1-4c88-8114-29c2d258b383">
	<topic>mini_httpd,thttpd -- Buffer overflow in htpasswd</topic>
	<affects>
	<package>
	<name>mini_httpd</name>
	<range><lt>1.28</lt></range>
	</package>
	<package>
	<name>thttpd</name>
	<range><lt>2.28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alessio Santoru reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17663">
	<p>Buffer overflow in htpasswd.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://acme.com/updates/archive/199.html</url>
	</references>
	<dates>
	<discovery>2017-12-13</discovery>
	<entry>2018-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="3746de31-0a1a-11e8-83e7-485b3931c969">
	<topic>shadowsocks-libev -- command injection via shell metacharacters</topic>
	<affects>
	<package>
	<name>shadowsocks-libev</name>
	<range><ge>3.1.0</ge><lt>3.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15924">
	<p>Improper parsing allows command injection via shell metacharacters in
	a JSON configuration request received via 127.0.0.1 UDP traffic.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15924</url>
	</references>
	<dates>
	<discovery>2017-10-27</discovery>
	<entry>2018-02-05</entry>
	</dates>
	</vuln>

	<vuln vid="5044bd23-08cb-11e8-b08f-00012e582166">
	<topic>palemoon -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>palemoon</name>
	<range><lt>27.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pale Moon reports:</p>
	<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
	<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
	<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5102</cvename>
	<cvename>CVE-2018-5122</cvename>
	</references>
	<dates>
	<discovery>2018-01-23</discovery>
	<entry>2018-02-03</entry>
	</dates>
	</vuln>

	<vuln vid="d696473f-9f32-42c5-a106-bf4536fb1f74">
	<topic>Django -- information leakage</topic>
	<affects>
	<package>
	<name>py27-django111</name>
	<name>py34-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<range><lt>1.11.10</lt></range>
	</package>
	<package>
	<name>py27-django20</name>
	<name>py34-django20</name>
	<name>py35-django20</name>
	<name>py36-django20</name>
	<range><lt>2.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django release notes:</p>
	<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.10/">
	<p>CVE-2018-6188: Information leakage in AuthenticationForm</p>
	<p>A regression in Django 1.11.8 made AuthenticationForm run its
	confirm_login_allowed() method even if an incorrect password is entered.
	This can leak information about a user, depending on what messages
	confirm_login_allowed() raises. If confirm_login_allowed() isn't
	overridden, an attacker enter an arbitrary username and see if that user
	has been set to is_active=False. If confirm_login_allowed() is
	overridden, more sensitive details could be leaked.</p>
	<p>This issue is fixed with the caveat that AuthenticationForm can no
	longer raise the "This account is inactive." error if the authentication
	backend rejects inactive users (the default authentication backend,
	ModelBackend, has done that since Django 1.10). This issue will be
	revisited for Django 2.1 as a fix to address the caveat will likely be too
	invasive for inclusion in older versions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://docs.djangoproject.com/en/1.11/releases/1.11.10/</url>
	<url>https://docs.djangoproject.com/en/2.0/releases/2.0.2/</url>
	<cvename>CVE-2018-6188</cvename>
	</references>
	<dates>
	<discovery>2018-02-01</discovery>
	<entry>2018-02-02</entry>
	</dates>
	</vuln>

	<vuln vid="e72d5bf5-07a0-11e8-8248-0021ccb9e74d">
	<topic>w3m - multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>w3m</name>
	<name>w3m-img</name>
	<name>ja-w3m</name>
	<name>ja-w3m-img</name>
	<range><lt>0.5.3.20180125</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tatsuya Kinoshita reports:</p>
	<blockquote cite="https://github.com/tats/w3m/commit/01d41d49b273a8cc75b27c6ab42291b46004fc0c">
	<p>CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().</p>
	<p>CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().</p>
	<p>CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/tats/w3m/commit/e773a0e089276f82c546447c0fd1e6c0f9156628</url>
	<cvename>CVE-2018-6196</cvename>
	<cvename>CVE-2018-6197</cvename>
	<cvename>CVE-2018-6198</cvename>
	</references>
	<dates>
	<discovery>2018-01-25</discovery>
	<entry>2018-02-01</entry>
	<modified>2018-02-03</modified>
	</dates>
	</vuln>

	<vuln vid="103bf96a-6211-45ab-b567-1555ebb3a86a">
	<topic>firefox -- Arbitrary code execution through unsanitized browser UI</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>58.0.1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.3.65</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/">
	<p>Mozilla developer <strong>Johann Hofmann</strong> reported that
	unsanitized output in the browser UI can lead to arbitrary
	code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1432966</url>
	</references>
	<dates>
	<discovery>2018-01-29</discovery>
	<entry>2018-01-29</entry>
	<modified>2018-01-31</modified>
	</dates>
	</vuln>

	<vuln vid="2cceb80e-c482-4cfd-81b3-2088d2c0ad53">
	<topic>gcab -- stack overflow</topic>
	<affects>
	<package>
	<name>gcab</name>
	<range><lt>0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Upstream reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5345">
	<p>A stack-based buffer overflow within GNOME gcab through
	0.7.4 can be exploited by malicious attackers to cause a
	crash or, potentially, execute arbitrary code via a
	crafted .cab file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5345</url>
	<url>https://mail.gnome.org/archives/ftp-release-list/2018-January/msg00066.html</url>
	<cvename>CVE-2018-5345</cvename>
	</references>
	<dates>
	<discovery>2018-01-23</discovery>
	<entry>2018-01-27</entry>
	</dates>
	</vuln>

	<vuln vid="92b8b284-a3a2-41b1-956c-f9cf8b74f500">
	<topic>dovecot -- abort of SASL authentication results in a memory leak</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<range><gt>2.0</gt><le>2.2.33.2_3</le></range>
	<range><ge>2.3</ge><le>2.3.0</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> Pedro Sampaio reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1532768">
	<p>A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of
	SASL authentication results in a memory leak in Dovecot auth client
	used by login processes. The leak has impact in high performance
	configuration where same login processes are reused and can cause the
	process to crash due to memory exhaustion.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15132</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1532768</url>
	<url>https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch</url>
	</references>
	<dates>
	<discovery>2018-01-09</discovery>
	<entry>2018-01-26</entry>
	<modified>2018-02-01</modified>
	</dates>
	</vuln>

	<vuln vid="0cbf0fa6-dcb7-469c-b87a-f94cffd94583">
	<topic>cURL -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.58.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000007">
	<p>libcurl 7.1 through 7.57.0 might accidentally leak authentication
	data to third parties. When asked to send custom headers in its HTTP
	requests, libcurl will send that set of headers first to the host in
	the initial URL but also, if asked to follow redirects and a 30X HTTP
	response code is returned, to the host mentioned in URL in the
	`Location:` response header value. Sending the same set of headers to
	subsequest hosts is in particular a problem for applications that pass
	on custom `Authorization:` headers, as this header often contains
	privacy sensitive information or data that could allow others to
	impersonate the libcurl-using client's request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_2018-b3bf.html</url>
	<cvename>CVE-2018-1000007</cvename>
	</references>
	<dates>
	<discovery>2018-01-24</discovery>
	<entry>2018-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="b464f61b-84c7-4e1c-8ad4-6cf9efffd025">
	<topic>clamav -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.99.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ClamAV project reports:</p>
	<blockquote cite="http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html">
	<p>Join us as we welcome ClamAV 0.99.3 to the family!.</p>
	<p>This release is a security release and is recommended for
	all ClamAV users.</p>
	<p>CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities</p>
	<p>CVE-2017-12375 ClamAV Buffer Overflow Vulnerability</p>
	<p>CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname
	Vulnerability</p>
	<p>CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability</p>
	<p>CVE-2017-12378 ClamAV Buffer Over Read Vulnerability</p>
	<p>CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument
	Vulnerability</p>
	<p>CVE-2017-12380 ClamAV Null Dereference Vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html</url>
	<cvename>CVE-2017-12374</cvename>
	<cvename>CVE-2017-12375</cvename>
	<cvename>CVE-2017-12376</cvename>
	<cvename>CVE-2017-12377</cvename>
	<cvename>CVE-2017-12378</cvename>
	<cvename>CVE-2017-12379</cvename>
	<cvename>CVE-2017-12380</cvename>
	</references>
	<dates>
	<discovery>2018-01-25</discovery>
	<entry>2018-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="a891c5b4-3d7a-4de9-9c71-eef3fd698c77">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>58.0_1,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.3.63</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.2</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.6.0_1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.6.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/">
	<p>CVE-2018-5091: Use-after-free with DTMF timers</p>
	<p>CVE-2018-5092: Use-after-free in Web Workers</p>
	<p>CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing</p>
	<p>CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory</p>
	<p>CVE-2018-5095: Integer overflow in Skia library during edge builder allocation</p>
	<p>CVE-2018-5097: Use-after-free when source document is manipulated during XSLT</p>
	<p>CVE-2018-5098: Use-after-free while manipulating form input elements</p>
	<p>CVE-2018-5099: Use-after-free with widget listener</p>
	<p>CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory</p>
	<p>CVE-2018-5101: Use-after-free with floating first-letter style elements</p>
	<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
	<p>CVE-2018-5103: Use-after-free during mouse event handling</p>
	<p>CVE-2018-5104: Use-after-free during font face manipulation</p>
	<p>CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts</p>
	<p>CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker</p>
	<p>CVE-2018-5107: Printing process will follow symlinks for local file access</p>
	<p>CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs</p>
	<p>CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution</p>
	<p>CVE-2018-5110: Cursor can be made invisible on OS X</p>
	<p>CVE-2018-5111: URL spoofing in addressbar through drag and drop</p>
	<p>CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel</p>
	<p>CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow</p>
	<p>CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts</p>
	<p>CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs</p>
	<p>CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access</p>
	<p>CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right</p>
	<p>CVE-2018-5118: Activity Stream images can attempt to load local content through file:</p>
	<p>CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers</p>
	<p>CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar</p>
	<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
	<p>CVE-2018-5090: Memory safety bugs fixed in Firefox 58</p>
	<p>CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-5089</cvename>
	<cvename>CVE-2018-5090</cvename>
	<cvename>CVE-2018-5091</cvename>
	<cvename>CVE-2018-5092</cvename>
	<cvename>CVE-2018-5093</cvename>
	<cvename>CVE-2018-5094</cvename>
	<cvename>CVE-2018-5095</cvename>
	<cvename>CVE-2018-5097</cvename>
	<cvename>CVE-2018-5098</cvename>
	<cvename>CVE-2018-5099</cvename>
	<cvename>CVE-2018-5100</cvename>
	<cvename>CVE-2018-5101</cvename>
	<cvename>CVE-2018-5102</cvename>
	<cvename>CVE-2018-5103</cvename>
	<cvename>CVE-2018-5104</cvename>
	<cvename>CVE-2018-5105</cvename>
	<cvename>CVE-2018-5106</cvename>
	<cvename>CVE-2018-5107</cvename>
	<cvename>CVE-2018-5108</cvename>
	<cvename>CVE-2018-5109</cvename>
	<cvename>CVE-2018-5110</cvename>
	<cvename>CVE-2018-5111</cvename>
	<cvename>CVE-2018-5112</cvename>
	<cvename>CVE-2018-5113</cvename>
	<cvename>CVE-2018-5114</cvename>
	<cvename>CVE-2018-5115</cvename>
	<cvename>CVE-2018-5116</cvename>
	<cvename>CVE-2018-5117</cvename>
	<cvename>CVE-2018-5118</cvename>
	<cvename>CVE-2018-5119</cvename>
	<cvename>CVE-2018-5121</cvename>
	<cvename>CVE-2018-5122</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-02/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-03/</url>
	</references>
	<dates>
	<discovery>2018-01-23</discovery>
	<entry>2018-01-23</entry>
	<modified>2018-01-29</modified>
	</dates>
	</vuln>

	<vuln vid="24a82876-002e-11e8-9a95-0cc47a02c232">
	<topic>powerdns-recursor -- insufficient validation of DNSSEC signatures</topic>
	<affects>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>4.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS Security Advisory reports:</p>
	<blockquote cite="https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html">
	<p>An issue has been found in the DNSSEC validation component of
	PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3
	record to be used to wrongfully prove the non-existence of a RR
	below the owner name of that record. This would allow an attacker in
	position of man-in-the-middle to send a NXDOMAIN answer for a name
	that does exist.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-1000003</cvename>
	<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html</url>
	</references>
	<dates>
	<discovery>2018-01-22</discovery>
	<entry>2018-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="e264e74e-ffe0-11e7-8b91-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>63.0.3239.108</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html">
	<p>2 security fixes in this release, including:</p>
	<ul>
	<li>[788453] High CVE-2017-15429: UXSS in V8. Reported by
	Anonymous on 2017-11-24</li>
	<li>[794792] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15429</cvename>
	<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html</url>
	</references>
	<dates>
	<discovery>2017-12-14</discovery>
	<entry>2018-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="1d951e85-ffdb-11e7-8b91-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>63.0.3239.84</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html">
	<p>37 security fixes in this release, including:</p>
	<ul>
	<li>[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by
	Ned Williamson on 2017-10-26</li>
	<li>[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by
	Ke Liu of Tencent's Xuanwu LAB on 2017-09-06</li>
	<li>[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by
	Anonymous on 2017-09-11</li>
	<li>[765921] High CVE-2017-15410: Use after free in PDFium. Reported by
	Luat Nguyen of KeenLab, Tencent on 2017-09-16</li>
	<li>[770148] High CVE-2017-15411: Use after free in PDFium. Reported by
	Luat Nguyen of KeenLab, Tencent on 2017-09-29</li>
	<li>[727039] High CVE-2017-15412: Use after free in libXML. Reported by
	Nick Wellnhofer on 2017-05-27</li>
	<li>[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by
	Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19</li>
	<li>[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.
	Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15</li>
	<li>[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by
	Ned Williamson on 2017-10-28</li>
	<li>[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.
	Reported by Max May on 2017-03-07</li>
	<li>[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by
	Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15</li>
	<li>[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.
	Reported by Jun Kokatsu on 2017-10-31</li>
	<li>[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by
	WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23</li>
	<li>[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by
	Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13</li>
	<li>[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.
	Reported by jinmo123 on 2017-01-11</li>
	<li>[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.
	Reported by Greg Hudson on 2017-10-25</li>
	<li>[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by
	Khalil Zhani on 2017-08-16</li>
	<li>[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by
	xisigr of Tencent's Xuanwu Lab on 2017-08-17</li>
	<li>[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by
	WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18</li>
	<li>[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.
	Reported by Junaid Farhan on 2017-09-26</li>
	<li>[792099] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15407</cvename>
	<cvename>CVE-2017-15408</cvename>
	<cvename>CVE-2017-15409</cvename>
	<cvename>CVE-2017-15410</cvename>
	<cvename>CVE-2017-15411</cvename>
	<cvename>CVE-2017-15412</cvename>
	<cvename>CVE-2017-15413</cvename>
	<cvename>CVE-2017-15415</cvename>
	<cvename>CVE-2017-15416</cvename>
	<cvename>CVE-2017-15417</cvename>
	<cvename>CVE-2017-15418</cvename>
	<cvename>CVE-2017-15419</cvename>
	<cvename>CVE-2017-15420</cvename>
	<cvename>CVE-2017-15422</cvename>
	<cvename>CVE-2017-15430</cvename>
	<cvename>CVE-2017-15423</cvename>
	<cvename>CVE-2017-15424</cvename>
	<cvename>CVE-2017-15425</cvename>
	<cvename>CVE-2017-15426</cvename>
	<cvename>CVE-2017-15427</cvename>
	<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-12-06</discovery>
	<entry>2018-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="82894193-ffd4-11e7-8b91-e8e0b747a45a">
	<topic>chromium -- out of bounds read</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>62.0.3202.94</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html">
	<p>1 security fix in this release, including:</p>
	<ul>
	<li>[782145] High CVE-2017-15428: Out of bounds read in V8. Reported by
	Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15428</cvename>
	<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html</url>
	</references>
	<dates>
	<discovery>2017-11-13</discovery>
	<entry>2018-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="8d3bae09-fd28-11e7-95f2-005056925db4">
	<topic>unbound -- vulnerability in the processing of wildcard synthesized NSEC records</topic>
	<affects>
	<package>
	<name>unbound</name>
	<range><lt>1.6.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unbound reports:</p>
	<blockquote cite="https://unbound.net/downloads/CVE-2017-15105.txt">
	<p>We discovered a vulnerability in the processing of wildcard synthesized
	NSEC records. While synthesis of NSEC records is allowed by RFC4592,
	these synthesized owner names should not be used in the NSEC processing.
	This does, however, happen in Unbound 1.6.7 and earlier versions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://unbound.net/downloads/CVE-2017-15105.txt</url>
	<cvename>CVE-2017-15105</cvename>
	<freebsdpr>ports/225313</freebsdpr>
	</references>
	<dates>
	<discovery>2017-10-08</discovery>
	<entry>2018-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="8e89a89a-fd15-11e7-bdf6-00e04c1ea73d">
	<topic>phpbb3 -- multiple issues</topic>
	<affects>
	<package>
	<name>phpbb3</name>
	<range><lt>3.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpbb developers reports:</p>
	<blockquote cite="https://wiki.phpbb.com/Release_Highlights/3.2.2">
	<p>Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.</p>
	<p>Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.</p>
	<p>Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.</p>
	<p>Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.</p>
	<p>Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.phpbb.com/Release_Highlights/3.2.2</url>
	</references>
	<dates>
	<discovery>2018-01-07</discovery>
	<entry>2018-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="e3445736-fd01-11e7-ac58-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.59</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.34</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.31</lt></range>
	</package>
	<package>
	<name>mariadb102-server</name>
	<range><lt>10.2.13</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.59</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.39</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.21</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.59</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.39</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL">
	<p>Not all vulnerabilities are relevant for all flavors/versions of the
	servers and clients</p>
	<ul>
	<li>Vulnerability allows low privileged attacker with network access
	via multiple protocols to compromise MySQL Server. Successful attacks
	of this vulnerability can result in unauthorized ability to cause a
	hang or frequently repeatable crash (complete DOS) of MySQL Server.
	GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640,
	CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703,
	Partition: CVE-2018-2562.</li>
	<li>Vulnerability allows high privileged attacker with network access
	via multiple protocols to compromise MySQL Server. Successful attacks
	of this vulnerability can result in unauthorized ability to cause a
	hang or frequently repeatable crash (complete DOS) of MySQL Server.
	InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576,
	CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema:
	CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600,
	CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication:
	CVE-2018-2647.</li>
	<li>Vulnerability allows a low or high privileged attacker with network
	access via multiple protocols to compromise MySQL Server with
	unauthorized creation, deletion, modification or access to data/
	critical data. InnoDB: CVE-2018-2612, Performance Schema:
	CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562.
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL</url>
	<url>https://mariadb.com/kb/en/library/mariadb-5559-release-notes/</url>
	<cvename>CVE-2018-2562</cvename>
	<cvename>CVE-2018-2565</cvename>
	<cvename>CVE-2018-2573</cvename>
	<cvename>CVE-2018-2576</cvename>
	<cvename>CVE-2018-2583</cvename>
	<cvename>CVE-2018-2586</cvename>
	<cvename>CVE-2018-2590</cvename>
	<cvename>CVE-2018-2591</cvename>
	<cvename>CVE-2018-2600</cvename>
	<cvename>CVE-2018-2612</cvename>
	<cvename>CVE-2018-2622</cvename>
	<cvename>CVE-2018-2640</cvename>
	<cvename>CVE-2018-2645</cvename>
	<cvename>CVE-2018-2646</cvename>
	<cvename>CVE-2018-2647</cvename>
	<cvename>CVE-2018-2665</cvename>
	<cvename>CVE-2018-2667</cvename>
	<cvename>CVE-2018-2668</cvename>
	<cvename>CVE-2018-2696</cvename>
	<cvename>CVE-2018-2703</cvename>
	</references>
	<dates>
	<discovery>2017-01-18</discovery>
	<entry>2018-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="c04dc18f-fcde-11e7-bdf6-00e04c1ea73d">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.2,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpress developers reports:</p>
	<blockquote cite="https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/">
	<p>JavaScript errors that prevented saving posts in Firefox have been fixed.</p>
	<p>The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.</p>
	<p>Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2018-01-16</discovery>
	<entry>2018-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="65fab89f-2231-46db-8541-978f4e87f32a">
	<topic>gitlab -- Remote code execution on project import</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><lt>10.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab developers report:</p>
	<blockquote cite="https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/">
	<p>Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for
	GitLab Community Edition (CE) and Enterprise Edition (EE).</p>
	<p>These versions contain a number of important security fixes,
	including two that prevent remote code execution, and we strongly
	recommend that all GitLab installations be upgraded to one of these
	versions immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/</url>
	<cvename>CVE-2017-0915</cvename>
	<cvename>CVE-2018-3710</cvename>
	</references>
	<dates>
	<discovery>2018-01-16</discovery>
	<entry>2018-01-17</entry>
	</dates>
	</vuln>

	<vuln vid="3e5b8bd3-0c32-452f-a60e-beab7b762351">
	<topic>transmission-daemon -- vulnerable to dns rebinding attacks</topic>
	<affects>
	<package>
	<name>transmission-daemon</name>
	<range><le>2.92_3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Project Zero reports:</p>
	<blockquote cite="https://bugs.chromium.org/p/project-zero/issues/detail?id=1447">
	<p>The transmission bittorrent client uses a client/server
	architecture, the user interface is the client which communicates
	to the worker daemon using JSON RPC requests.</p>
	<p>As with all HTTP RPC schemes like this, any website can send
	requests to the daemon listening on localhost with XMLHttpRequest(),
	but the theory is they will be ignored because clients must prove
	they can read and set a specific header, X-Transmission-Session-Id.
	Unfortunately, this design doesn't work because of an attack called
	"DNS rebinding". Any website can simply create a dns name that they
	are authorized to communicate with, and then make it resolve to
	localhost.</p>
	<p>Exploitation is simple, you could set script-torrent-done-enabled
	and run any command, or set download-dir to /home/user/ and then
	upload a torrent for .bashrc.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1447</url>
	<url>https://github.com/transmission/transmission/pull/468</url>
	</references>
	<dates>
	<discovery>2017-11-30</discovery>
	<entry>2018-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="3dbe9492-f7b8-11e7-a12d-6cc21735f730">
	<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
	<affects>
	<package>
	<name>xmltooling</name>
	<range><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>xerces-c3</name>
	<range><lt>3.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Shibboleth consortium reports:</p>
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180112.txt">
	<p>
	Shibboleth SP software vulnerable to forged user attribute data
	</p>
	<p>
	The Service Provider software relies on a generic XML parser to
	process SAML responses and there are limitations in older versions
	of the parser that make it impossible to fully disable Document Type
	Definition (DTD) processing.
	</p>
	<p>
	Through addition/manipulation of a DTD, it's possible to make
	changes to an XML document that do not break a digital signature but
	are mishandled by the SP and its libraries. These manipulations can
	alter the user data passed through to applications behind the SP and
	result in impersonation attacks and exposure of protected
	information.
	</p>
	<p>
	While newer versions of the xerces-c3 parser are configured by the
	SP into disallowing the use of a DTD via an environment variable,
	this feature is not present in the xerces-c3 parser before version
	3.1.4, so an additional fix is being provided now that an actual DTD
	exploit has been identified. Xerces-c3-3.1.4 was committed to the
	ports tree already on 2016-07-26.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://shibboleth.net/community/advisories/secadv_20180112.txt</url>
	<cvename>CVE-2018-0486</cvename>
	</references>
	<dates>
	<discovery>2018-01-12</discovery>
	<entry>2018-01-12</entry>
	</dates>
	</vuln>

	<vuln vid="9c016563-f582-11e7-b33c-6451062f0f7a">
	<topic>Flash Player -- information disclosure</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>28.0.0.137</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-01.html">
	<ul>
	<li>This update resolves an out-of-bounds read vulnerability that
	could lead to information disclosure (CVE-2018-4871).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2018-4871</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb18-01.html</url>
	</references>
	<dates>
	<discovery>2018-01-09</discovery>
	<entry>2018-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="4055aee5-f4c6-11e7-95f2-005056925db4">
	<topic>awstats -- remote code execution</topic>
	<affects>
	<package>
	<name>awstats</name>
	<range><lt>7.7,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501">
	<p>Awstats version 7.6 and earlier is vulnerable to a path traversal
	flaw in the handling of the "config" and "migrate" parameters resulting
	in unauthenticated remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501</url>
	<cvename>CVE-2017-1000501</cvename>
	<freebsdpr>ports/225007</freebsdpr>
	</references>
	<dates>
	<discovery>2018-01-03</discovery>
	<entry>2018-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="a3764767-f31e-11e7-95f2-005056925db4">
	<topic>irssi -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>1.0.6,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Irssi reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2018_01.txt">
	<p>When the channel topic is set without specifying a sender, Irssi
	may dereference NULL pointer. Found by Joseph Bisch.</p>
	<p>When using incomplete escape codes, Irssi may access data beyond
	the end of the string. Found by Joseph Bisch.</p>
	<p>A calculation error in the completion code could cause a heap
	buffer overflow when completing certain strings.
	Found by Joseph Bisch.</p>
	<p>When using an incomplete variable argument, Irssi may access data
	beyond the end of the string. Found by Joseph Bisch.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://irssi.org/security/irssi_sa_2018_01.txt</url>
	<cvename>CVE-2018-5205</cvename>
	<cvename>CVE-2018-5206</cvename>
	<cvename>CVE-2018-5207</cvename>
	<cvename>CVE-2018-5208</cvename>
	<freebsdpr>ports/224954</freebsdpr>
	</references>
	<dates>
	<discovery>2018-01-03</discovery>
	<entry>2018-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="8429711b-76ca-474e-94a0-6b980f1e2d47">
	<topic>mozilla -- Speculative execution side-channel attack</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>57.0.4,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/">
	<p><strong>Jann Horn</strong> of Google Project Zero
	Security reported that speculative execution performed
	by modern CPUs could leak information through a timing
	side-channel attack. Microsoft Vulnerability Research
	extended this attack to browser JavaScript engines and
	demonstrated that code on a malicious web page could
	read data from other web sites (violating the
	same-origin policy) or private data from the browser
	itself.</p>
	<p>Since this new class of attacks involves measuring
	precise time intervals, as a parti al, short-term,
	mitigation we are disabling or reducing the precision of
	several time sources in Firefox. The precision of
	<code>performance.now()</code> has been reduced from 5μs
	to 20μs, and the <code>SharedArrayBuffer</code> feature
	has been disabled because it can be used to construct a
	high-resolution timer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mozilla.org/security/advisories/mfsa2018-01/</url>
	</references>
	<dates>
	<discovery>2018-01-04</discovery>
	<entry>2018-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="cebd05d6-ed7b-11e7-95f2-005056925db4">
	<topic>OTRS -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>5.0.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS reports:</p>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/">
	<p>An attacker who is logged into OTRS as an agent can request special URLs
	from OTRS which can lead to the execution of shell commands with the
	permissions of the web server user.</p>
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/">
	<p>An attacker who is logged into OTRS as a customer can use the ticket search
	form to disclose internal article information of their customer tickets.</p>
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/">
	<p>An attacker who is logged into OTRS as an agent can manipulate form
	parameters and execute arbitrary shell commands with the permissions of the
	OTRS or web server user.</p>
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/">
	<p>An attacker can send a specially prepared email to an OTRS system. If this
	system has cookie support disabled, and a logged in agent clicks a link in this
	email, the session information could be leaked to external systems, allowing the
	attacker to take over the agent’s session.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-16664</cvename>
	<cvename>CVE-2017-16854</cvename>
	<cvename>CVE-2017-16921</cvename>
	<freebsdpr>ports/224729</freebsdpr>
	<url>https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/</url>
	<url>https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/</url>
	<url>https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/</url>
	<url>https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/</url>
	</references>
	<dates>
	<discovery>2017-11-21</discovery>
	<entry>2017-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b">
	<topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic>
	<affects>
	<package>
	<name>bouncycastle15</name>
	<range><lt>1.59</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Legion of the Bouncy Castle reports:</p>
	<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
	<p>Release: 1.59</p>
	<p>CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS
	when RSA key exchange is negotiated. This potentially affected
	BCJSSE servers and any other TLS servers configured to use JCE
	for the underlying crypto - note the two TLS implementations
	using the BC lightweight APIs are not affected by this.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-13098</cvename>
	<url>https://www.bouncycastle.org/releasenotes.html</url>
	</references>
	<dates>
	<discovery>2017-12-12</discovery>
	<entry>2017-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="6a09c80e-6ec7-442a-bc65-d72ce69fd887">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
	<p>CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9</p>
	<p>CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin</p>
	<p>CVE-2017-7847: Local path string can be leaked from RSS feed</p>
	<p>CVE-2017-7848: RSS Feed vulnerable to new line Injection</p>
	<p>CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7829</cvename>
	<cvename>CVE-2017-7845</cvename>
	<cvename>CVE-2017-7846</cvename>
	<cvename>CVE-2017-7847</cvename>
	<cvename>CVE-2017-7848</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-30/</url>
	</references>
	<dates>
	<discovery>2017-12-22</discovery>
	<entry>2017-12-25</entry>
	</dates>
	</vuln>

	<vuln vid="63eb2b11-e802-11e7-a58c-6805ca0b3d42">
	<topic>phpMyAdmin -- XSRF/CSRF vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.7.0</ge><lt>4.7.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-9/">
	<h3>Description</h3>
	<p>By deceiving a user to click on a crafted URL, it is
	possible to perform harmful database operations such as
	deleting records, dropping/truncating tables etc.</p>
	<h3>Severity</h3>
	<p>We consider this vulnerability to be critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-9/</url>
	</references>
	<dates>
	<discovery>2017-12-23</discovery>
	<entry>2017-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b">
	<topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.18.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	<p>A select set of SIP messages create a dialog in Asterisk.
	Those SIP messages must contain a contact header. For
	those messages, if the header was not present and using
	the PJSIP channel driver, it would cause Asterisk to
	crash. The severity of this vulnerability is somewhat
	mitigated if authentication is enabled. If authentication
	is enabled a user would have to first be authorized before
	reaching the crash point.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url>
	<cvename>CVE-2017-17850</cvename>
	</references>
	<dates>
	<discovery>2017-12-12</discovery>
	<entry>2017-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf">
	<topic>MariaDB -- unspecified vulnerability</topic>
	<affects>
	<package>
	<name>mariadb101-client</name>
	<range><lt>10.1.30</lt></range>
	</package>
	<package>
	<name>mariadb102-client</name>
	<range><lt>10.2.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MariaDB project reports:</p>
	<blockquote cite="https://mariadb.com/kb/en/library/mariadb-10130-release-notes/">
	<p>Fixes for the following security vulnerabilities:
	CVE-2017-15365</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mariadb.com/kb/en/library/mariadb-10130-release-notes/</url>
	<cvename>CVE-2017-15365</cvename>
	</references>
	<dates>
	<discovery>2017-12-23</discovery>
	<entry>2017-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="72fff788-e561-11e7-8097-0800271d4b9c">
	<topic>rsync -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rsync</name>
	<range><ge>3.1.2</ge><le>3.1.2_7</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jeriko One reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548">
	<p>The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433">
	<p>The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434">
	<p>The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.debian.org/security/2017/dsa-4068</url>
	<cvename>CVE-2017-16548</cvename>
	<cvename>CVE-2017-17433</cvename>
	<cvename>CVE-2017-17434</cvename>
	<freebsdpr>ports/224477</freebsdpr>
	</references>
	<dates>
	<discovery>2017-12-17</discovery>
	<entry>2017-12-20</entry>
	<modified>2017-12-31</modified>
	</dates>
	</vuln>

	<vuln vid="dd644964-e10e-11e7-8097-0800271d4b9c">
	<topic>ruby -- Command injection vulnerability in Net::FTP</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>2.2.0,1</ge><lt>2.2.9,1</lt></range>
	<range><ge>2.3.0,1</ge><lt>2.3.6,1</lt></range>
	<range><ge>2.4.0,1</ge><lt>2.4.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Etienne Stalmans from the Heroku product security team reports:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/">
	<p>There is a command injection vulnerability in Net::FTP bundled with Ruby.</p>
	<p><code>Net::FTP#get</code>, <code>getbinaryfile</code>, <code>gettextfile</code>, <code>put</code>, <code>putbinaryfile</code>, and <code>puttextfile</code> use <code>Kernel#open</code> to open a local file. If the <code>localfile</code> argument starts with the pipe character <code>"\|"</code>, the command following the pipe character is executed. The default value of <code>localfile</code> is <code>File.basename(remotefile)</code>, so malicious FTP servers could cause arbitrary command execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/</url>
	<cvename>CVE-2017-17405</cvename>
	</references>
	<dates>
	<discovery>2017-12-14</discovery>
	<entry>2017-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="8cf25a29-e063-11e7-9b2c-001e672571bc">
	<topic>rubygem-passenger -- arbitrary file read vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-passenger</name>
	<range><ge>5.0.10</ge><lt>5.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Phusion reports:</p>
	<blockquote cite="https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/">
	<p>The cPanel Security Team discovered a vulnerability in Passenger
	that allows users to list the contents of arbitrary files on the
	system. CVE-2017-16355 has been assigned to this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/</url>
	<cvename>CVE-2017-16355</cvename>
	</references>
	<dates>
	<discovery>2017-10-13</discovery>
	<entry>2017-12-18</entry>
	</dates>
	</vuln>

	<vuln vid="08a125f3-e35a-11e7-a293-54e1ad3d6335">
	<topic>libXfont -- permission bypass when opening files through symlinks</topic>
	<affects>
	<package>
	<name>libXfont</name>
	<range><lt>1.5.4</lt></range>
	</package>
	<package>
	<name>libXfont2</name>
	<range><lt>2.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>the freedesktop.org project reports:</p>
	<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8">
	<p>A non-privileged X client can instruct X server running under root
	to open any file by creating own directory with "fonts.dir",
	"fonts.alias" or any font file being a symbolic link to any other
	file in the system. X server will then open it. This can be issue
	with special files such as /dev/watchdog.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8</url>
	<cvename>CVE-2017-16611</cvename>
	</references>
	<dates>
	<discovery>2017-11-25</discovery>
	<entry>2017-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="3b9590a1-e358-11e7-a293-54e1ad3d6335">
	<topic>libXfont -- multiple memory leaks</topic>
	<affects>
	<package>
	<name>libXfont</name>
	<range><lt>1.5.3</lt></range>
	</package>
	<package>
	<name>libXfont2</name>
	<range><lt>2.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The freedesktop.org project reports:</p>
	<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608">
	<p>If a pattern contains '?' character, any character in the string
	is skipped, even if it is '\0'. The rest of the matching then reads
	invalid memory.</p>
	</blockquote>
	<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902906bcd">
	<p>Without the checks a malformed PCF file can cause the library to
	make atom from random heap memory that was behind the `strings`
	buffer. This may crash the process or leak information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608</url>
	<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd</url>
	<cvename>CVE-2017-13720</cvename>
	<cvename>CVE-2017-13722</cvename>
	</references>
	<dates>
	<discovery>2017-10-04</discovery>
	<entry>2017-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="ddecde18-e33b-11e7-a293-54e1ad3d6335">
	<topic>libXcursor -- integer overflow that can lead to heap buffer overflow</topic>
	<affects>
	<package>
	<name>libXcursor</name>
	<range><lt>1.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The freedesktop.org project reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q4/339">
	<p>It is possible to trigger heap overflows due to an integer
	overflow while parsing images and a signedness issue while
	parsing comments.</p>
	<p>The integer overflow occurs because the chosen limit 0x10000
	for dimensions is too large for 32 bit systems, because each pixel
	takes 4 bytes. Properly chosen values allow an overflow which in
	turn will lead to less allocated memory than needed for subsequent
	reads.</p>
	<p>The signedness bug is triggered by reading the length of a comment
	as unsigned int, but casting it to int when calling the function
	XcursorCommentCreate. Turning length into a negative value allows
	the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
	addition of sizeof (XcursorComment) + 1 makes it possible to
	allocate less memory than needed for subsequent reads.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2017/q4/339</url>
	<url>https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8</url>
	<cvename>CVE-2017-16612</cvename>
	</references>
	<dates>
	<discovery>2017-11-28</discovery>
	<entry>2017-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="48cca164-e269-11e7-be51-6599c735afc8">
	<topic>global -- gozilla vulnerability</topic>
	<affects>
	<package>
	<name>global</name>
	<range><ge>4.8.6</ge><lt>6.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531">
	<p>gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching
	the program specified by the BROWSER environment variable, which might
	allow remote attackers to conduct argument-injection attacks via a crafted
	URL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531</url>
	<url>http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html</url>
	<cvename>CVE-2017-17531</cvename>
	</references>
	<dates>
	<discovery>2017-12-11</discovery>
	<entry>2017-12-16</entry>
	</dates>
	</vuln>

	<vuln vid="7136e6b7-e1b3-11e7-a4d3-000c292ee6b8">
	<topic>jenkins -- Two startup race conditions</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.95</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.89.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Jenkins project reports:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2017-12-14/">
	<p>A race condition during Jenkins startup could result in the wrong
	order of execution of commands during initialization.</p>
	<p>On Jenkins 2.81 and newer, including LTS 2.89.1, this could in
	rare cases (we estimate less than 20% of new instances) result in
	failure to initialize the setup wizard on the first startup.</p>
	<p>There is a very short window of time after startup during which
	Jenkins may no longer show the "Please wait while Jenkins is
	getting ready to work" message, but Cross-Site Request Forgery
	(CSRF) protection may not yet be effective.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2017-12-14/</url>
	</references>
	<dates>
	<discovery>2017-12-14</discovery>
	<entry>2017-12-15</entry>
	</dates>
	</vuln>

	<vuln vid="bea84a7a-e0c9-11e7-b4f3-11baa0c2df21">
	<topic>node.js -- Data Confidentiality/Integrity Vulnerability, December 2017</topic>
	<affects>
	<package>
	<name>node4</name>
	<range><lt>4.8.7</lt></range>
	</package>
	<package>
	<name>node6</name>
	<range><lt>6.12.2</lt></range>
	</package>
	<package>
	<name>node8</name>
	<range><lt>8.9.3</lt></range>
	</package>
	<package>
	<name>node</name>
	<range><lt>9.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js reports:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/">
	<h1>Data Confidentiality/Integrity Vulnerability - CVE-2017-15896</h1>
	<p>Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.</p>
	<h1>Uninitialized buffer vulnerability - CVE-2017-15897</h1>
	<p>Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.</p>
	<h1>Also included in OpenSSL update - CVE 2017-3738</h1>
	<p>Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/</url>
	<cvename>CVE-2017-15896</cvename>
	<cvename>CVE-2017-15897</cvename>
	<cvename>CVE-2017-3738</cvename>
	</references>
	<dates>
	<discovery>2017-12-08</discovery>
	<entry>2017-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b">
	<topic>GitLab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>4.2.0</ge><le>10.0.6</le></range>
	<range><ge>10.1.0</ge><le>10.1.4</le></range>
	<range><ge>10.2.0</ge><le>10.2.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">
	<h1>User without access to private Wiki can see it on the project page</h1>
	<p>Matthias Burtscher reported that it was possible for a user to see a
	private Wiki on the project page without having the corresponding
	permission.</p>
	<h1>E-mail address disclosure through member search fields</h1>
	<p>Hugo Geoffroy reported via HackerOne that it was possible to find out the
	full e-mail address of any user by brute-forcing the member search
	field.</p>
	<h1>Groups API leaks private projects</h1>
	<p>An internal code review discovered that users were able to list private
	projects they had no access to by using the Groups API.</p>
	<h1>Cross-Site Scripting (XSS) possible by editing a comment</h1>
	<p>Sylvain Heiniger reported via HackerOne that it was possible for
	arbitrary JavaScript code to be executed when editing a comment.</p>
	<h1>Issue API allows any user to create a new issue even when issues are
	restricted or disabled</h1>
	<p>Mohammad Hasbini reported that any user could create a new issues in a
	project even when issues were disabled or restricted to team members in the
	project settings.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>
	</references>
	<dates>
	<discovery>2017-12-08</discovery>
	<entry>2017-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2">
	<topic>tor -- Use-after-free in onion service v2</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.3.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Torproject.org reports:</p>
	<blockquote cite="https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516">
	<ul>
	<li>TROVE-2017-009: Replay-cache ineffective for v2 onion services</li>
	<li>TROVE-2017-010: Remote DoS attack against directory authorities</li>
	<li>TROVE-2017-011: An attacker can make Tor ask for a password</li>
	<li>TROVE-2017-012: Relays can pick themselves in a circuit path</li>
	<li>TROVE-2017-013: Use-after-free in onion service v2</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516</url>
	<cvename>CVE-2017-8819</cvename>
	</references>
	<dates>
	<discovery>2017-12-01</discovery>
	<entry>2017-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="4a67450a-e044-11e7-accc-001999f8d30b">
	<topic>asterisk -- Remote Crash Vulnerability in RTCP Stack</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.18.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	<p>If a compound RTCP packet is received containing more
	than one report (for example a Receiver Report and a
	Sender Report) the RTCP stack will incorrectly store
	report information outside of allocated memory potentially
	causing a crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-012.html</url>
	</references>
	<dates>
	<discovery>2017-12-12</discovery>
	<entry>2017-12-13</entry>
	</dates>
	</vuln>

	<vuln vid="76e59f55-4f7a-4887-bcb0-11604004163a">
	<topic>libxml2 -- Multiple Issues</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><le>2.9.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libxml2 developers report:</p>
	<p>The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.</p>
	<p>A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
	<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
	<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.</p>
	<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.</p>
	</body>
	</description>
	<references>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=775200</url>
	<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
	<url>http://www.securityfocus.com/bid/98599</url>
	<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
	<url>http://www.securityfocus.com/bid/98556</url>
	<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
	<url>http://www.securityfocus.com/bid/98601</url>
	<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
	<url>http://www.securityfocus.com/bid/98568</url>
	<cvename>CVE-2017-8872</cvename>
	<cvename>CVE-2017-9047</cvename>
	<cvename>CVE-2017-9048</cvename>
	<cvename>CVE-2017-9049</cvename>
	<cvename>CVE-2017-9050</cvename>
	</references>
	<dates>
	<discovery>2017-05-10</discovery>
	<entry>2017-12-13</entry>
	</dates>
	</vuln>

	<vuln vid="9f7a0f39-ddc0-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_6</lt></range>
	<range><ge>10.4</ge><lt>10.4_5</lt></range>
	<range><ge>10.3</ge><lt>10.3_26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Invoking SSL_read()/SSL_write() while in an error state
	causes data to be passed without being decrypted/encrypted
	directly from the SSL/TLS record layer.</p>
	<p>In order to exploit this issue an application bug would
	have to be present that resulted in a call to
	SSL_read()/SSL_write() being issued after having already
	received a fatal error. [CVE-2017-3737]</p>
	<p>There is an overflow bug in the x86_64 Montgomery
	multiplication procedure used in exponentiation with 1024-bit
	moduli. This only affects processors that support the AVX2
	but not ADX extensions like Intel Haswell (4th generation).
	[CVE-2017-3738] This bug only affects FreeBSD 11.x.</p>
	<h1>Impact:</h1>
	<p>Applications with incorrect error handling may inappropriately
	pass unencrypted data. [CVE-2017-3737]</p>
	<p>Mishandling of carry propagation will produce incorrect
	output, and make it easier for a remote attacker to obtain
	sensitive private-key information. No EC algorithms are
	affected and analysis suggests that attacks against RSA and
	DSA as a result of this defect would be very difficult to
	perform and are not believed likely.</p>
	<p>Attacks against DH1024 are considered just feasible
	(although very difficult) because most of the work necessary
	to deduce information about a private key may be performed
	offline. The amount of resources required for such an attack
	would be very significant and likely only accessible to a
	limited number of attackers. However, for an attack on TLS
	to be meaningful, the server would have to share the DH1024
	private key among multiple clients, which is no longer an
	option since CVE-2016-0701. [CVE-2017-3738]</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0701</cvename>
	<cvename>CVE-2017-3737</cvename>
	<cvename>CVE-2017-3738</cvename>
	<freebsdsa>SA-17:12.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2017-12-09</discovery>
	<entry>2017-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="4b228e69-22e1-4019-afd0-8aa716d0ec0b">
	<topic>wireshark -- multiple security issues</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
	</package>
	<package>
	<name>wireshark-qt5</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
	</package>
	<package>
	<name>tshark</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wireshark developers reports:</p>
	<blockquote cite="https://www.wireshark.org/security/">
	<p>wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)</p>
	<p>wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)</p>
	<p>wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.wireshark.org/security/</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-47.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-48.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-49.html</url>
	<cvename>CVE-2017-17083</cvename>
	<cvename>CVE-2017-17084</cvename>
	<cvename>CVE-2017-17085</cvename>
	</references>
	<dates>
	<discovery>2017-11-30</discovery>
	<entry>2017-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="3bb451fc-db64-11e7-ac58-b499baebfeaf">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><gt>1.0.2</gt><lt>1.0.2n</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20171207.txt">
	<ul><li>Read/write after SSL object in error state (CVE-2017-3737)<br/>
	OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error
	state" mechanism. The intent was that if a fatal error occurred
	during a handshake then OpenSSL would move into the error state and
	would immediately fail if you attempted to continue the handshake.
	This works as designed for the explicit handshake functions
	(SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to
	a bug it does not work correctly if SSL_read() or SSL_write() is
	called directly. In that scenario, if the handshake fails then a
	fatal error will be returned in the initial function call. If
	SSL_read()/SSL_write() is subsequently called by the application for
	the same SSL object then it will succeed and the data is passed
	without being decrypted/encrypted directly from the SSL/TLS record
	layer.</li>
	<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
	There is an overflow bug in the AVX2 Montgomery multiplication
	procedure used in exponentiation with 1024-bit moduli. No EC
	algorithms are affected. Analysis suggests that attacks against
	RSA and DSA as a result of this defect would be very difficult to
	perform and are not believed likely. Attacks against DH1024 are
	considered just feasible, because most of the work necessary to
	deduce information about a private key may be performed offline.
	The amount of resources required for such an attack would be
	significant. However, for an attack on TLS to be meaningful, the
	server would have to share the DH1024 private key among multiple
	clients, which is no longer an option since CVE-2016-0701.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20171207.txt</url>
	<cvename>CVE-2017-3737</cvename>
	<cvename>CVE-2017-3738</cvename>
	</references>
	<dates>
	<discovery>2017-12-07</discovery>
	<entry>2017-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="9442a811-dab3-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_5</lt></range>
	<range><ge>11.0</ge><lt>11.0_16</lt></range>
	<range><ge>10.4</ge><lt>10.4_4</lt></range>
	<range><ge>10.3</ge><lt>10.3_25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>If an X.509 certificate has a malformed IPAddressFamily
	extension, OpenSSL could do a one-byte buffer overread.
	[CVE-2017-3735]</p>
	<p>There is a carry propagating bug in the x86_64 Montgomery
	squaring procedure. This only affects processors that support
	the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th
	generation) and later or AMD Ryzen. [CVE-2017-3736] This
	bug only affects FreeBSD 11.x.</p>
	<h1>Impact:</h1>
	<p>Application using OpenSSL may display erroneous certificate
	in text format. [CVE-2017-3735]</p>
	<p>Mishandling of carry propagation will produce incorrect
	output, and make it easier for a remote attacker to obtain
	sensitive private-key information. No EC algorithms are
	affected, analysis suggests that attacks against RSA and
	DSA as a result of this defect would be very difficult to
	perform and are not believed likely.</p>
	<p>Attacks against DH are considered just feasible (although
	very difficult) because most of the work necessary to deduce
	information about a private key may be performed offline.
	The amount of resources required for such an attack would
	be very significant and likely only accessible to a limited
	number of attackers. An attacker would additionally need
	online access to an unpatched system using the target private
	key in a scenario with persistent DH parameters and a private
	key that is shared between multiple clients. [CVE-2017-3736]</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-3735</cvename>
	<cvename>CVE-2017-3736</cvename>
	<freebsdsa>SA-17:11.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2017-11-29</discovery>
	<entry>2017-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="759059ac-dab3-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- Information leak in kldstat(2)</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_4</lt></range>
	<range><ge>11.0</ge><lt>11.0_15</lt></range>
	<range><ge>10.4</ge><lt>10.4_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The kernel does not properly clear the memory of the
	kld_file_stat structure before filling the data. Since the
	structure filled by the kernel is allocated on the kernel
	stack and copied to userspace, a leak of information from
	the kernel stack is possible.</p>
	<h1>Impact:</h1>
	<p>Some bytes from the kernel stack can be observed in
	userspace.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1088</cvename>
	<freebsdsa>SA-17:10.kldstat</freebsdsa>
	</references>
	<dates>
	<discovery>2017-11-15</discovery>
	<entry>2017-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="5b1463dd-dab3-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- POSIX shm allows jails to access global namespace</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.4</ge><lt>10.4_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Named paths are globally scoped, meaning a process located
	in one jail can read and modify the content of POSIX shared
	memory objects created by a process in another jail or the
	host system.</p>
	<h1>Impact:</h1>
	<p>A malicious user that has access to a jailed system is
	able to abuse shared memory by injecting malicious content
	in the shared memory region. This memory region might be
	executed by applications trusting the shared memory, like
	Squid.</p>
	<p>This issue could lead to a Denial of Service or local
	privilege escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1087</cvename>
	<freebsdsa>SA-17:09.shm</freebsdsa>
	</references>
	<dates>
	<discovery>2017-11-15</discovery>
	<entry>2017-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="34a3f9b5-dab3-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_4</lt></range>
	<range><ge>11.0</ge><lt>11.0_15</lt></range>
	<range><ge>10.4</ge><lt>10.4_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Not all information in the struct ptrace_lwpinfo is
	relevant for the state of any thread, and the kernel does
	not fill the irrelevant bytes or short strings. Since the
	structure filled by the kernel is allocated on the kernel
	stack and copied to userspace, a leak of information of the
	kernel stack of the thread is possible from the debugger.</p>
	<h1>Impact:</h1>
	<p>Some bytes from the kernel stack of the thread using
	ptrace(PT_LWPINFO) call can be observed in userspace.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1086</cvename>
	<freebsdsa>SA-17:08.ptrace</freebsdsa>
	</references>
	<dates>
	<discovery>2017-11-15</discovery>
	<entry>2017-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="1f8de723-dab3-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- WPA2 protocol vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_2</lt></range>
	<range><ge>11.0</ge><lt>11.0_13</lt></range>
	<range><ge>10.4</ge><lt>10.4_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A vulnerability was found in how a number of implementations
	can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK,
	or IGTK) by replaying a specific frame that is used to
	manage the keys.</p>
	<h1>Impact:</h1>
	<p>Such reinstallation of the encryption key can result in
	two different types of vulnerabilities: disabling replay
	protection and significantly reducing the security of
	encryption to the point of allowing frames to be decrypted
	or some parts of the keys to be determined by an attacker
	depending on which cipher is used.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1307</cvename>
	<cvename>CVE-2017-1308</cvename>
	<freebsdsa>SA-17:07.wpa</freebsdsa>
	</references>
	<dates>
	<discovery>2017-10-16</discovery>
	<entry>2017-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="b7e23050-2d5d-4e61-9b48-62e89db222ca">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><ge>57.0,1</ge><lt>57.0.1,1</lt></range>
	<range><lt>56.0.2_11,1</lt></range>
	</package>
	<package>
	<name>waterfox</name>
	<range><lt>56.0.s20171130</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.2</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.5.1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.5.1,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-27/">
	<p>CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data</p>
	<p>CVE-2017-7844: Visited history information leak through SVG image</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7843</cvename>
	<cvename>CVE-2017-7844</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-27/</url>
	</references>
	<dates>
	<discovery>2017-11-29</discovery>
	<entry>2017-12-05</entry>
	</dates>
	</vuln>

	<vuln vid="17133e7e-d764-11e7-b5af-a4badb2f4699">
	<topic>varnish -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>varnish4</name>
	<range><lt>4.1.9</lt></range>
	</package>
	<package>
	<name>varnish5</name>
	<range><lt>5.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Varnish reports:</p>
	<blockquote cite="https://varnish-cache.org/security/VSV00002.html">
	<p>A wrong if statement in the varnishd source code means that
	synthetic objects in stevedores which over-allocate, may leak up to page
	size of data from a malloc(3) memory allocation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://varnish-cache.org/security/VSV00002.html</url>
	<cvename>CVE-2017-8807</cvename>
	</references>
	<dates>
	<discovery>2017-11-15</discovery>
	<entry>2017-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="addad6de-d752-11e7-99bf-00e04c1ea73d">
	<topic>mybb -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.8.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mybb Team reports:</p>
	<blockquote cite="https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/">
	<p>High risk: Language file headers RCE</p>
	<p>Low risk: Language Pack Properties XSS</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2017-11-27</discovery>
	<entry>2017-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="a2589511-d6ba-11e7-88dd-00e04c1ea73d">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpress developers reports:</p>
	<blockquote cite="https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/">
	<p>Use a properly generated hash for the newbloguser key instead of a determinate substring.</p>
	<p>Add escaping to the language attributes used on html elements.</p>
	<p>Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.</p>
	<p>Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2017-11-29</discovery>
	<entry>2017-12-01</entry>
	</dates>
	</vuln>

	<vuln vid="e91cf90c-d6dd-11e7-9d10-001999f8d30b">
	<topic>asterisk -- DOS Vulnerability in Asterisk chan_skinny</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.18.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	<p>If the chan_skinny (AKA SCCP protocol) channel driver
	is flooded with certain requests it can cause the asterisk
	process to use excessive amounts of virtual memory
	eventually causing asterisk to stop processing requests
	of any kind.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-013.html</url>
	<cvename>CVE-2017-17090</cvename>
	</references>
	<dates>
	<discovery>2017-11-30</discovery>
	<entry>2017-12-01</entry>
	<modified>2017-12-13</modified>
	</dates>
	</vuln>

	<vuln vid="75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f">
	<topic>exim -- remote DoS attack in BDAT processing</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><ge>4.88</ge><lt>4.89.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Exim developers team reports:</p>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
	<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
	<cvename>CVE-2017-16944</cvename>
	</references>
	<dates>
	<discovery>2017-11-23</discovery>
	<entry>2017-11-30</entry>
	</dates>
	</vuln>

	<vuln vid="a66f9be2-d519-11e7-9866-c85b763a2f96">
	<topic>xrdp -- local user can cause a denial of service</topic>
	<affects>
	<package>
	<name>xrdp-devel</name>
	<range><le>0.9.3,1</le></range>
	<range><gt>0.9.3_1,1</gt><le>0.9.4,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xrdp reports:</p>
	<blockquote cite="https://github.com/neutrinolabs/xrdp/pull/958">
	<p>The scp_v0s_accept function in the session manager uses an untrusted integer as a write length,
	which allows local users to cause a denial of service (buffer overflow and application crash)
	or possibly have unspecified other impact via a crafted input stream.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-16927</cvename>
	</references>
	<dates>
	<discovery>2017-11-23</discovery>
	<entry>2017-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="301a01b7-d50e-11e7-ac58-b499baebfeaf">
	<topic>cURL -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.21.0</ge><lt>7.57.0</lt></range>
	</package>
	<package>
	<name>linux-c7-curl</name>
	<range><ge>7.21.0</ge><lt>7.29.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/changes.html">
	<ul><li>NTLM buffer overflow via integer overflow
	(CVE-2017-8816)<br/>libcurl contains a buffer overrun flaw
	in the NTLM authentication code.
	The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up
	the lengths of the user name + password (= SUM) and multiplies
	the sum by two (= SIZE) to figure out how large storage to
	allocate from the heap.</li>
	<li>FTP wildcard out of bounds read (CVE-2017-8817)<br/>
	libcurl contains a read out of bounds flaw in the FTP wildcard
	function.
	libcurl's FTP wildcard matching feature, which is enabled with
	the CURLOPT_WILDCARDMATCH option can use a built-in wildcard
	function or a user provided one. The built-in wildcard function
	has a flaw that makes it not detect the end of the pattern
	string if it ends with an open bracket ([) but instead it will
	continue reading the heap beyond the end of the URL buffer that
	holds the wildcard.</li>
	<li>SSL out of buffer access (CVE-2017-8818)<br/>
	libcurl contains an out boundary access flaw in SSL related code.
	When allocating memory for a connection (the internal struct
	called connectdata), a certain amount of memory is allocated at
	the end of the struct to be used for SSL related structs. Those
	structs are used by the particular SSL library libcurl is built
	to use. The application can also tell libcurl which specific SSL
	library to use if it was built to support more than one.
	</li></ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/changes.html</url>
	<cvename>CVE-2017-8816</cvename>
	<cvename>CVE-2017-8817</cvename>
	<cvename>CVE-2017-8818</cvename>
	</references>
	<dates>
	<discovery>2017-11-29</discovery>
	<entry>2017-11-29</entry>
	<modified>2017-12-11</modified>
	</dates>
	</vuln>

	<vuln vid="0d369972-d4ba-11e7-bfca-005056925db4">
	<topic>borgbackup -- remote users can override repository restrictions</topic>
	<affects>
	<package>
	<name>py34-borgbackup</name>
	<name>py35-borgbackup</name>
	<name>py36-borgbackup</name>
	<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BorgBackup reports:</p>
	<blockquote cite="https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27">
	<p>Incorrect implementation of access controls allows remote users to
	override repository restrictions in Borg servers. A user able to
	access a remote Borg SSH server is able to circumvent access controls
	post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases
	1.0.x are NOT affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15914</cvename>
	<url>https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27</url>
	</references>
	<dates>
	<discovery>2017-11-27</discovery>
	<entry>2017-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="6056bf68-f570-4e70-b740-b9f606971283">
	<topic>palemoon -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>palemoon</name>
	<range><lt>27.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pale Moon reports:</p>
	<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
	<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
	<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
	<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7832</cvename>
	<cvename>CVE-2017-7835</cvename>
	<cvename>CVE-2017-7840</cvename>
	</references>
	<dates>
	<discovery>2017-11-14</discovery>
	<entry>2017-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="68b29058-d348-11e7-b9fe-c13eb7bcbf4f">
	<topic>exim -- remote code execution, deny of service in BDAT</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><ge>4.88</ge><lt>4.89_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Exim team reports:</p>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
	<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
	</references>
	<dates>
	<discovery>2017-11-23</discovery>
	<entry>2017-11-27</entry>
	</dates>
	</vuln>

	<vuln vid="7761288c-d148-11e7-87e5-00e04c1ea73d">
	<topic>mybb -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.8.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>myBB Team reports:</p>
	<blockquote cite="https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/">
	<p>High risk: Installer RCE on configuration file write</p>
	<p>High risk: Language file headers RCE</p>
	<p>Medium risk: Installer XSS</p>
	<p>Medium risk: Mod CP Edit Profile XSS</p>
	<p>Low risk: Insufficient moderator permission check in delayed moderation tools</p>
	<p>Low risk: Announcements HTML filter bypass</p>
	<p>Low risk: Language Pack Properties XSS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2017-11-07</discovery>
	<entry>2017-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="50127e44-7b88-4ade-8e12-5d57320823f1">
	<topic>salt -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<range><lt>2016.11.8</lt></range>
	<range><ge>2017.7.0</ge><lt>2017.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SaltStack reports:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html">
	<p>Directory traversal vulnerability in minion id validation in SaltStack.
	Allows remote minions with incorrect credentials to authenticate to a
	master via a crafted minion ID. Credit for discovering the security flaw
	goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists
	because of an incomplete fix for CVE-2017-12791.</p>
	<p>Remote Denial of Service with a specially crafted authentication request.
	Credit for discovering the security flaw goes to: Julian Brost
	(julian@0x4a42.net)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-14695</cvename>
	<cvename>CVE-2017-14696</cvename>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html</url>
	<url>https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html</url>
	<url>https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d</url>
	<url>https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b</url>
	</references>
	<dates>
	<discovery>2017-10-09</discovery>
	<entry>2017-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="ef3423e4-d056-11e7-a52c-002590263bf5">
	<topic>codeigniter -- input validation bypass</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>3.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	<p>Security: Fixed a potential object injection in Cache Library 'apc'
	driver when save() is used with $raw = TRUE.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.codeigniter.com/user_guide/changelog.html</url>
	</references>
	<dates>
	<discovery>2017-09-25</discovery>
	<entry>2017-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="288f7cee-ced6-11e7-8ae9-0050569f0b83">
	<topic>procmail -- Heap-based buffer overflow</topic>
	<affects>
	<package>
	<name>procmail</name>
	<range><lt>3.22_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://www.debian.org/security/2017/dsa-4041">
	<p>A remote attacker could use a flaw to cause formail to crash,
	resulting in a denial of service or data loss.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-16844</cvename>
	<url>https://www.debian.org/security/2017/dsa-4041</url>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511</url>
	</references>
	<dates>
	<discovery>2017-11-16</discovery>
	<entry>2017-11-21</entry>
	<modified>2017-12-08</modified>
	</dates>
	</vuln>

	<vuln vid="bf266183-cec7-11e7-af2d-2047478f2f70">
	<topic>frr -- BGP Mishandled attribute length on Error</topic>
	<affects>
	<package>
	<name>frr</name>
	<range><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>FRR reports:</p>
	<blockquote cite="https://frrouting.org/community/security/cve-2017-15865.html">
	<p>BGP Mishandled attribute length on Error</p>
	<p>A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE
	packet can leak information from the BGP daemon and cause a denial of
	service by crashing the daemon.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15865</cvename>
	<url>https://frrouting.org/community/security/cve-2017-15865.html</url>
	</references>
	<dates>
	<discovery>2017-11-08</discovery>
	<entry>2017-11-21</entry>
	</dates>
	</vuln>

	<vuln vid="db570002-ce06-11e7-804e-c85b763a2f96">
	<topic>cacti -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>1.1.28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cacti reports:</p>
	<blockquote cite="https://www.cacti.net/release_notes.php?version=1.1.28">
	<p>Changelog</p>
	<p>issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions</p>
	<p>issue#1066: CVE-2017-16660 in remote_agent.php logging function</p>
	<p>issue#1066: CVE-2017-16661 in view log file</p>
	<p>issue#1071: CVE-2017-16785 in global_session.php Reflection XSS</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-16641</cvename>
	<cvename>CVE-2017-16660</cvename>
	<cvename>CVE-2017-16661</cvename>
	<cvename>CVE-2017-16785</cvename>
	<url>https://sourceforge.net/p/cacti/mailman/message/36122745/</url>
	</references>
	<dates>
	<discovery>2017-11-01</discovery>
	<entry>2017-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="298829e2-ccce-11e7-92e4-000c29649f92">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki127</name>
	<range><lt>1.27.3</lt></range>
	</package>
	<package>
	<name>mediawiki128</name>
	<range><lt>1.28.2</lt></range>
	</package>
	<package>
	<name>mediawiki129</name>
	<range><lt>1.29.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mediawiki reports:</p>
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html">
	<p>security fixes:</p>
	<p>T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.</p>
	<p>T165846: BotPasswords doesn't throttle login attempts.</p>
	<p>T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.</p>
	<p>T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.</p>
	<p>T176247: It's possible to mangle HTML via raw message parameter expansion.</p>
	<p>T125163: id attribute on headlines allow raw.</p>
	<p>T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.</p>
	<p>T119158: Language converter: unsafe attribute injection via glossary rules.</p>
	<p>T180488: api.log contains passwords in plaintext wasn't correctly fixed.</p>
	<p>T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-8808</cvename>
	<cvename>CVE-2017-8809</cvename>
	<cvename>CVE-2017-8810</cvename>
	<cvename>CVE-2017-8811</cvename>
	<cvename>CVE-2017-8812</cvename>
	<cvename>CVE-2017-8814</cvename>
	<cvename>CVE-2017-8815</cvename>
	<cvename>CVE-2017-0361</cvename>
	<cvename>CVE-2017-9841</cvename>
	<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html</url>
	</references>
	<dates>
	<discovery>2017-11-14</discovery>
	<entry>2017-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="52f10525-caff-11e7-b590-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>27.0.0.187</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html">
	<ul>
	<li>These updates resolve out-of-bounds read vulnerabilities that
	could lead to remote code execution (CVE-2017-3112,
	CVE-2017-3114, CVE-2017-11213).</li>
	<li>These updates resolve use after free vulnerabilities that
	could lead to remote code execution (CVE-2017-11215,
	CVE-2017-11225).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-3112</cvename>
	<cvename>CVE-2017-3114</cvename>
	<cvename>CVE-2017-11213</cvename>
	<cvename>CVE-2017-11215</cvename>
	<cvename>CVE-2017-11225</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-33.html</url>
	</references>
	<dates>
	<discovery>2017-11-14</discovery>
	<entry>2017-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="b4b7ec7d-ca27-11e7-a12d-6cc21735f730">
	<topic>shibboleth2-sp -- "Dynamic" metadata provider plugin issue</topic>
	<affects>
	<package>
	<name>shibboleth2-sp</name>
	<range><lt>2.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Internet2 community reports:</p>
	<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20171115.txt">
	<p>
	The Shibboleth Service Provider software includes a MetadataProvider
	plugin with the plugin type "Dynamic" to obtain metadata on demand
	from a query server, in place of the more typical mode of
	downloading aggregates separately containing all of the metadata to
	load.
	</p><p>
	All the plugin types rely on MetadataFilter plugins to perform
	critical security checks such as signature verification, enforcement
	of validity periods, and other checks specific to deployments.
	</p><p>
	Due to a coding error, the "Dynamic" plugin fails to configure
	itself with the filters provided to it and thus omits whatever
	checks they are intended to perform, which will typically leave
	deployments vulnerable to active attacks involving the substitution
	of metadata if the network path to the query service is
	compromised.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://shibboleth.internet2.edu/secadv/secadv_20171115.txt</url>
	</references>
	<dates>
	<discovery>2017-11-15</discovery>
	<entry>2017-11-15</entry>
	</dates>
	</vuln>

	<vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<!-- 56.0.2_10,1 unlike 57.0,1 has CVE-2017-7827 partially unfixed:
	bug 1384615, 1386490, 1393840, 1403716 -->
	<range><lt>56.0.2_10,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.2</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.5.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.5.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
	<p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p>
	<p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p>
	<p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p>
	<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
	<p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p>
	<p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p>
	<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
	<p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p>
	<p>CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies</p>
	<p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p>
	<p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p>
	<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
	<p>CVE-2017-7842: Referrer Policy is not always respected for <link> elements</p>
	<p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p>
	<p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7826</cvename>
	<cvename>CVE-2017-7827</cvename>
	<cvename>CVE-2017-7828</cvename>
	<cvename>CVE-2017-7830</cvename>
	<cvename>CVE-2017-7831</cvename>
	<cvename>CVE-2017-7832</cvename>
	<cvename>CVE-2017-7833</cvename>
	<cvename>CVE-2017-7834</cvename>
	<cvename>CVE-2017-7835</cvename>
	<cvename>CVE-2017-7836</cvename>
	<cvename>CVE-2017-7837</cvename>
	<cvename>CVE-2017-7838</cvename>
	<cvename>CVE-2017-7839</cvename>
	<cvename>CVE-2017-7840</cvename>
	<cvename>CVE-2017-7842</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
	</references>
	<dates>
	<discovery>2017-11-14</discovery>
	<entry>2017-11-14</entry>
	</dates>
	</vuln>

	<vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
	<topic>rubygem-geminabox -- XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-geminabox</name>
	<range><lt>0.13.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-16792">
	<p>Stored cross-site scripting (XSS) vulnerability in "geminabox"
	(Gem in a Box) before 0.13.10 allows attackers to inject arbitrary
	web script via the "homepage" value of a ".gemspec" file, related
	to views/gem.erb and views/index.erb.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-16792</url>
	<cvename>CVE-2017-16792</cvename>
	</references>
	<dates>
	<discovery>2017-11-13</discovery>
	<entry>2017-11-13</entry>
	</dates>
	</vuln>

	<vuln vid="795ccee1-c7ed-11e7-ad7d-001e2a3f778d">
	<topic>konversation -- crash in IRC message parsing</topic>
	<affects>
	<package>
	<name>konversation</name>
	<range><lt>1.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>KDE reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20171112-1.txt">
	<p>Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15923</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923</url>
	<url>https://www.kde.org/info/security/advisory-20171112-1.txt</url>
	</references>
	<dates>
	<discovery>2017-10-27</discovery>
	<entry>2017-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="f622608c-c53c-11e7-a633-009c02a2ab30">
	<topic>roundcube -- file disclosure vulnerability</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>1.3.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16651">
	<p>Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before
	1.3.3 allows unauthorized access to arbitrary files on the host's filesystem,
	including configuration files, as exploited in the wild in November 2017.
	The attacker must be able to authenticate at the target system with a valid
	username/password as the attack requires an active session.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/roundcube/roundcubemail/issues/6026</url>
	<url>https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10</url>
	<cvename>CVE-2017-16651</cvename>
	<freebsdpr>ports/223557</freebsdpr>
	</references>
	<dates>
	<discovery>2017-11-06</discovery>
	<entry>2017-11-11</entry>
	<modified>2017-12-31</modified>
	</dates>
	</vuln>

	<vuln vid="f8e72cd4-c66a-11e7-bb17-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>62.0.3202.89</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html">
	<p>2 security fixes in this release, including:</p>
	<ul>
	<li>[777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC.
	Reported by Ned Williamson on 2017-10-24</li>
	<li>[776677] High CVE-2017-15399: Use after free in V8. Reported by
	Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15398</cvename>
	<cvename>CVE-2017-15399</cvename>
	<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-11-06</discovery>
	<entry>2017-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="1f02af5d-c566-11e7-a12d-6cc21735f730">
	<topic>PostgreSQL vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.24</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.20</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.15</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.10</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.6</lt></range>
	</package>
	<package>
	<name>postgresql10-server</name>
	<range><ge>10.0</ge><lt>10.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/1801/">
	<ul>
	<li>CVE-2017-15098: Memory disclosure in JSON functions</li>
	<li>CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to
	enforce SELECT privileges</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15099</cvename>
	<cvename>CVE-2017-15098</cvename>
	</references>
	<dates>
	<discovery>2017-10-10</discovery>
	<entry>2017-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="1c2a9d76-9d98-43c3-8f5d-8c059b104d99">
	<topic>jenkins -- multiple issues</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.89</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.73.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/99574">
	<p>Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.</p>
	<p>Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2017-11-08/</url>
	</references>
	<dates>
	<discovery>2017-11-08</discovery>
	<entry>2017-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="be261737-c535-11e7-8da5-001999f8d30b">
	<topic>asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><ge>13.5.0</ge><lt>13.18.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>A memory leak occurs when an Asterisk pjsip session
	object is created and that call gets rejected before the
	session itself is fully established. When this happens
	the session object never gets destroyed. This then leads
	to file descriptors and RTP ports being leaked as well.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-011.html</url>
	<cvename>CVE-2017-16672</cvename>
	</references>
	<dates>
	<discovery>2017-10-15</discovery>
	<entry>2017-11-09</entry>
	<modified>2017-12-13</modified>
	</dates>
	</vuln>

	<vuln vid="ab04cb0b-c533-11e7-8da5-001999f8d30b">
	<topic>asterisk -- Buffer overflow in CDR's set user</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.18.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>No size checking is done when setting the user field
	for Party B on a CDR. Thus, it is possible for someone
	to use an arbitrarily large string and write past the end
	of the user field storage buffer. The earlier AST-2017-001
	advisory for the CDR user field overflow was for the Party
	A buffer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-010.html</url>
	<cvename>CVE-2017-16671</cvename>
	</references>
	<dates>
	<discovery>2017-10-09</discovery>
	<entry>2017-11-09</entry>
	<modified>2017-12-13</modified>
	</dates>
	</vuln>

	<vuln vid="19b052c9-c533-11e7-8da5-001999f8d30b">
	<topic>asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.18.1</lt></range>
	</package>
	<package>
	<name>pjsip</name>
	<range><lt>2.7.1</lt></range>
	</package>
	<package>
	<name>pjsip-extsrtp</name>
	<range><lt>2.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>By carefully crafting invalid values in the Cseq and
	the Via header port, pjprojects packet parsing code can
	create strings larger than the buffer allocated to hold
	them. This will usually cause Asterisk to crash immediately.
	The packets do not have to be authenticated.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-009.html</url>
	</references>
	<dates>
	<discovery>2017-10-05</discovery>
	<entry>2017-11-09</entry>
	<modified>2017-11-15</modified>
	</dates>
	</vuln>

	<vuln vid="f40f07aa-c00f-11e7-ac58-b499baebfeaf">
	<topic>OpenSSL -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2m,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0g</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20171102.txt">
	<p>bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)<br/>
	Severity: Moderate<br/>
	There is a carry propagating bug in the x86_64 Montgomery squaring
	procedure. No EC algorithms are affected. Analysis suggests that
	attacks against RSA and DSA as a result of this defect would be
	very difficult to perform and are not believed likely. Attacks
	against DH are considered just feasible (although very difficult)
	because most of the work necessary to deduce information about a
	private key may be performed offline.</p>
	<p>Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)<br/>
	Severity: Low<br/>
	This issue was previously announced in security advisory
	https://www.openssl.org/news/secadv/20170828.txt, but the fix has
	not previously been included in a release due to its low severity.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20171102.txt</url>
	<cvename>CVE-2017-3735</cvename>
	<cvename>CVE-2017-3736</cvename>
	</references>
	<dates>
	<discovery>2017-11-02</discovery>
	<entry>2017-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="cee3d12f-bf41-11e7-bced-00e04c1ea73d">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.8.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpress developers reports:</p>
	<blockquote cite="https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/">
	<p>WordPress versions 4.8.2 and earlier are affected by an issue
	where $wpdb->prepare() can create unexpected and unsafe queries
	leading to potential SQL injection (SQLi). WordPress core is not
	directly vulnerable to this issue, but we've added hardening to
	prevent plugins and themes from accidentally causing a vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/</url>
	</references>
	<dates>
	<discovery>2017-10-31</discovery>
	<entry>2017-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="4684a426-774d-4390-aa19-b8dd481c4c94">
	<topic>wireshark -- multiple security issues</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><ge>2.2.0</ge><le>2.2.9</le></range>
	<range><ge>2.4.0</ge><le>2.4.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wireshark developers reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/101228">
	<p>In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.</p>
	<p>In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.</p>
	<p>In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.</p>
	<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.</p>
	<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/101227</url>
	<url>http://www.securityfocus.com/bid/101228</url>
	<url>http://www.securityfocus.com/bid/101229</url>
	<url>http://www.securityfocus.com/bid/101235</url>
	<url>http://www.securityfocus.com/bid/101240</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080</url>
	<url>https://code.wireshark.org/review/23470</url>
	<url>https://code.wireshark.org/review/23537</url>
	<url>https://code.wireshark.org/review/23591</url>
	<url>https://code.wireshark.org/review/23635</url>
	<url>https://code.wireshark.org/review/23663</url>
	<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6</url>
	<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8</url>
	<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e</url>
	<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b</url>
	<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-42.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-43.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-44.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-45.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2017-46.html</url>
	<cvename>CVE-2017-15189</cvename>
	<cvename>CVE-2017-15190</cvename>
	<cvename>CVE-2017-15191</cvename>
	<cvename>CVE-2017-15192</cvename>
	<cvename>CVE-2017-15193</cvename>
	</references>
	<dates>
	<discovery>2017-10-10</discovery>
	<entry>2017-10-30</entry>
	</dates>
	</vuln>

	<vuln vid="de7a2b32-bd7d-11e7-b627-d43d7e971a1b">
	<topic>PHP -- denial of service attack</topic>
	<affects>
	<package>
	<name>php56</name>
	<range><lt>5.6.32</lt></range>
	</package>
	<package>
	<name>php70</name>
	<range><lt>7.0.25</lt></range>
	</package>
	<package>
	<name>php71</name>
	<range><lt>7.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-3">
	<p>The PHP development team announces the immediate availability of PHP
	5.6.32. This is a security release. Several security bugs were fixed in this
	release. All PHP 5.6 users are encouraged to upgrade to this version.</p>
	</blockquote>
	<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-1">
	<p>The PHP development team announces the immediate availability of PHP
	7.0.25. This is a security release. Several security bugs were fixed in this
	release. All PHP 7.0 users are encouraged to upgrade to this version.</p>
	</blockquote>
	<blockquote cite="http://php.net/archive/2017.php#id2017-10-27-1">
	<p>The PHP development team announces the immediate availability of PHP
	7.1.11. This is a bugfix release, with several bug fixes included. All PHP
	7.1 users are encouraged to upgrade to this version. </p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/archive/2017.php#id2017-10-26-3</url>
	<url>http://php.net/archive/2017.php#id2017-10-26-1</url>
	<url>http://php.net/archive/2017.php#id2017-10-27-1</url>
	<cvename>CVE-2016-1283</cvename>
	</references>
	<dates>
	<discovery>2017-10-26</discovery>
	<entry>2017-10-30</entry>
	<modified>2017-11-14</modified>
	</dates>
	</vuln>

	<vuln vid="3cd46257-bbc5-11e7-a3bc-e8e0b747a45a">
	<topic>chromium -- Stack overflow in V8</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>62.0.3202.75</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html">
	<p>2 security fixes in this release, including:</p>
	<ul>
	<li>[770452] High CVE-2017-15396: Stack overflow in V8. Reported by
	Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
	<li>[770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by
	Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-15396</cvename>
	<cvename>CVE-2017-15406</cvename>
	<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html</url>
	</references>
	<dates>
	<discovery>2017-10-26</discovery>
	<entry>2017-10-28</entry>
	<modified>2018-01-23</modified>
	</dates>
	</vuln>

	<vuln vid="d77ceb8c-bb13-11e7-8357-3065ec6f3643">
	<topic>wget -- Heap overflow in HTTP protocol handling</topic>
	<affects>
	<package>
	<name>wget</name>
	<range><lt>1.19.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
	<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
	<p>Wget contains two vulnerabilities, a stack overflow and a heap
	overflow, in the handling of HTTP chunked encoding. By convincing
	a user to download a specific link over HTTP, an attacker may be
	able to execute arbitrary code with the privileges of the user.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba</url>
	<cvename>CVE-2017-13090</cvename>
	</references>
	<dates>
	<discovery>2017-10-20</discovery>
	<entry>2017-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="09849e71-bb12-11e7-8357-3065ec6f3643">
	<topic>wget -- Stack overflow in HTTP protocol handling</topic>
	<affects>
	<package>
	<name>wget</name>
	<range><lt>1.19.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
	<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
	<p>Wget contains two vulnerabilities, a stack overflow and a heap
	overflow, in the handling of HTTP chunked encoding. By convincing
	a user to download a specific link over HTTP, an attacker may be
	able to execute arbitrary code with the privileges of the user.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f</url>
	<cvename>CVE-2017-13089</cvename>
	</references>
	<dates>
	<discovery>2017-10-20</discovery>
	<entry>2017-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="d7d1cc94-b971-11e7-af3a-f1035dd0da62">
	<topic>Node.js -- remote DOS security vulnerability</topic>
	<affects>
	<package>
	<name>node</name>
	<range><lt>8.8.0</lt></range>
	</package>
	<package>
	<name>node6</name>
	<range><ge>6.10.2</ge><lt>6.11.5</lt></range>
	</package>
	<package>
	<name>node4</name>
	<range><ge>4.8.2</ge><lt>4.8.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js reports:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2017-dos/">
	<p>Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/oct-2017-dos/</url>
	<cvename>CVE-2017-14919</cvename>
	</references>
	<dates>
	<discovery>2017-10-17</discovery>
	<entry>2017-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="418c172b-b96f-11e7-b627-d43d7e971a1b">
	<topic>GitLab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>2.8.0</ge><le>9.4.6</le></range>
	<range><ge>9.5.0</ge><le>9.5.8</le></range>
	<range><ge>10.0.0</ge><le>10.0.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/">
	<h1>Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization
	filter</h1>
	<p>Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS)
	vulnerability in the GitLab markdown sanitization filter. The sanitization
	filter was not properly stripping invalid characters from URL schemes and
	was therefore vulnerable to persistent XSS attacks anywhere Markdown was
	supported.</p>
	<h1>Cross-Site Scripting (XSS) vulnerability in search bar</h1>
	<p>Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the
	issue search bar. Usernames were not being properly HTML escaped inside the
	author filter would could allow arbitrary script execution.</p>
	<h1>Open redirect in repository git redirects</h1>
	<p>Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an
	open redirect vulnerability when redirecting requests for repository names
	that include the git extension. GitLab was not properly removing dangerous
	parameters from the params field before redirecting which could allow an
	attacker to redirect users to arbitrary hosts.</p>
	<h1>Username changes could leave repositories behind</h1>
	<p>An internal code review discovered that a bug in the code that moves
	repositories during a username change could potentially leave behind
	projects, allowing an attacker who knows the previous username to
	potentially steal the contents of repositories on instances that are not
	configured with hashed namespaces.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/</url>
	</references>
	<dates>
	<discovery>2017-10-17</discovery>
	<entry>2017-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="27229c67-b8ff-11e7-9f79-ac9e174be3af">
	<topic>Apache OpenOffice -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache-openoffice</name>
	<range><lt>4.1.4</lt></range>
	</package>
	<package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1810071_1,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Openofffice project reports:</p>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-3157.html">
	<h1>CVE-2017-3157: Arbitrary file disclosure in Calc and Writer</h1>
	<p>By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.</p>
	<p>The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.</p>
	</blockquote>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-9806.html">
	<h1>CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor</h1>
	<p>A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
	</blockquote>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12607.html">
	<h1>CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter</h1>
	<p>A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
	</blockquote>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12608.html">
	<h1>CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles</h1>
	<p>A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openoffice.org/security/cves/CVE-2017-3157.html</url>
	<url>https://www.openoffice.org/security/cves/CVE-2017-9806.html</url>
	<url>https://www.openoffice.org/security/cves/CVE-2017-12607.html</url>
	<url>https://www.openoffice.org/security/cves/CVE-2017-12608.html</url>
	<cvename>CVE-2017-3157</cvename>
	<cvename>CVE-2017-9806</cvename>
	<cvename>CVE-2017-12607</cvename>
	<cvename>CVE-2017-12608</cvename>
	</references>
	<dates>
	<discovery>2016-09-11</discovery>
	<entry>2017-10-24</entry>
	<modified>2017-10-26</modified>
	</dates>
	</vuln>

	<vuln vid="143ec3d6-b7cf-11e7-ac58-b499baebfeaf">
	<topic>cURL -- out of bounds read</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.20</ge><lt>7.56.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20171023.html">
	<p>libcurl contains a buffer overrun flaw in the IMAP handler.<br/>
	An IMAP FETCH response line indicates the size of the returned data,
	in number of bytes. When that response says the data is zero bytes,
	libcurl would pass on that (non-existing) data with a pointer and
	the size (zero) to the deliver-data function.<br/>
	libcurl's deliver-data function treats zero as a magic number and
	invokes strlen() on the data to figure out the length. The strlen()
	is called on a heap based buffer that might not be zero terminated
	so libcurl might read beyond the end of it into whatever memory lies
	after (or just crash) and then deliver that to the application as if
	it was actually downloaded.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_20171023.html</url>
	<cvename>CVE-2017-1000257</cvename>
	</references>
	<dates>
	<discovery>2017-10-23</discovery>
	<entry>2017-10-23</entry>
	</dates>
	</vuln>

	<vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
	<topic>h2o -- DoS in workers</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range><lt>2.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Frederik Deweerdt reports:</p>
	<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
	<p>Multiple Denial-of-Service vulnerabilities exist in h2o workers -
	see references for full details.</p>
	<p>CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.</p>
	<p>CVE-2017-10869: The stack may overflow when proxying huge requests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-10868</cvename>
	<cvename>CVE-2017-10869</cvename>
	<url>https://github.com/h2o/h2o/issues/1459</url>
	<url>https://github.com/h2o/h2o/issues/1460</url>
	<url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
	</references>
	<dates>
	<discovery>2017-07-19</discovery>
	<entry>2017-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
	<topic>irssi -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>1.0.5,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Irssi reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_10.txt">
	<p>When installing themes with unterminated colour formatting
	sequences, Irssi may access data beyond the end of the string.</p>
	<p>While waiting for the channel synchronisation, Irssi may
	incorrectly fail to remove destroyed channels from the query list,
	resulting in use after free conditions when updating the state later
	on.</p>
	<p>Certain incorrectly formatted DCC CTCP messages could cause NULL
	pointer dereference.</p>
	<p>Overlong nicks or targets may result in a NULL pointer dereference
	while splitting the message.</p>
	<p>In certain cases Irssi may fail to verify that a Safe channel ID
	is long enough, causing reads beyond the end of the string.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://irssi.org/security/irssi_sa_2017_10.txt</url>
	<cvename>CVE-2017-15721</cvename>
	<cvename>CVE-2017-15722</cvename>
	<cvename>CVE-2017-15723</cvename>
	<cvename>CVE-2017-15227</cvename>
	<cvename>CVE-2017-15228</cvename>
	<freebsdpr>ports/223169</freebsdpr>
	</references>
	<dates>
	<discovery>2017-10-10</discovery>
	<entry>2017-10-22</entry>
	<modified>2017-12-31</modified>
	</dates>
	</vuln>

	<vuln vid="a692bffe-b6ad-11e7-a1c2-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>62.0.3202.62</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html">
	<p>35 security fixes in this release, including:</p>
	<ul>
	<li>[762930] High CVE-2017-5124: UXSS with MHTML. Reported by
	Anonymous on 2017-09-07</li>
	<li>[749147] High CVE-2017-5125: Heap overflow in Skia. Reported by
	Anonymous on 2017-07-26</li>
	<li>[760455] High CVE-2017-5126: Use after free in PDFium. Reported by
	Luat Nguyen on KeenLab, Tencent on 2017-08-30</li>
	<li>[765384] High CVE-2017-5127: Use after free in PDFium. Reported by
	Luat Nguyen on KeenLab, Tencent on 2017-09-14</li>
	<li>[765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by
	Omair on 2017-09-14</li>
	<li>[765495] High CVE-2017-5129: Use after free in WebAudio. Reported by
	Omair on 2017-09-15</li>
	<li>[718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by
	Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05</li>
	<li>[722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by
	Pranjal Jumde on 2017-05-14</li>
	<li>[744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by
	Anonymous on 2017-07-16</li>
	<li>[762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by
	Aleksandar Nikolic of Cisco Talos on 2017-09-05</li>
	<li>[752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by
	WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03</li>
	<li>[756040] Medium CVE-2017-15387: Content security bypass. Reported by
	Jun Kokatsu on 2017-08-16</li>
	<li>[756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by
	Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17</li>
	<li>[739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by
	xisigr of Tencent's Xuanwu Lab on 2017-07-06</li>
	<li>[750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by
	Haosheng Wang on 2017-07-28</li>
	<li>[598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by
	Joao Lucas Melo Brasio on 2016-03-28</li>
	<li>[714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration.
	Reported by Xiaoyin Liu on 2017-04-22</li>
	<li>[732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by
	Svyat Mitin on 2017-06-13</li>
	<li>[745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by
	Sam on 2017-07-18</li>
	<li>[759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by
	Johannes Bergman on 2017-08-28</li>
	<li>[775550] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5124</cvename>
	<cvename>CVE-2017-5125</cvename>
	<cvename>CVE-2017-5126</cvename>
	<cvename>CVE-2017-5127</cvename>
	<cvename>CVE-2017-5128</cvename>
	<cvename>CVE-2017-5129</cvename>
	<cvename>CVE-2017-5132</cvename>
	<cvename>CVE-2017-5130</cvename>
	<cvename>CVE-2017-5131</cvename>
	<cvename>CVE-2017-5133</cvename>
	<cvename>CVE-2017-15386</cvename>
	<cvename>CVE-2017-15387</cvename>
	<cvename>CVE-2017-15388</cvename>
	<cvename>CVE-2017-15389</cvename>
	<cvename>CVE-2017-15390</cvename>
	<cvename>CVE-2017-15391</cvename>
	<cvename>CVE-2017-15392</cvename>
	<cvename>CVE-2017-15393</cvename>
	<cvename>CVE-2017-15394</cvename>
	<cvename>CVE-2017-15395</cvename>
	<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-10-17</discovery>
	<entry>2017-10-21</entry>
	</dates>
	</vuln>

	<vuln vid="e1cb9dc9-daa9-44db-adde-e94d900e2f7f">
	<topic>cacti -- Cross Site Scripting issue</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>1.1.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cacti developers report:</p>
	<blockquote cite=" https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd">
	<p>The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securitytracker.com/id/1039569</url>
	<url>https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd</url>
	<url>https://github.com/Cacti/cacti/issues/1010</url>
	<cvename>CVE-2017-15194</cvename>
	</references>
	<dates>
	<discovery>2017-10-10</discovery>
	<entry>2017-10-19</entry>
	</dates>
	</vuln>

	<vuln vid="b95e5674-b4d6-11e7-b895-0cc47a494882">
	<topic>arj -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>arj</name>
	<range><lt>3.10.22_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Several vulnerabilities: symlink directory traversal, absolute path directory
	traversal and buffer overflow were discovered in the arj archiver.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0556</cvename>
	<cvename>CVE-2015-0557</cvename>
	<cvename>CVE-2015-2782</cvename>
	</references>
	<dates>
	<discovery>2015-04-08</discovery>
	<entry>2017-10-19</entry>
	</dates>
	</vuln>

	<vuln vid="3f3837cc-48fb-4414-aa46-5b1c23c9feae">
	<topic>krb5 -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><lt>1.14.6</lt></range>
	<range><ge>1.15</ge><lt>1.15.2</lt></range>
	</package>
	<package>
	<name>krb5-devel</name>
	<range><lt>1.14.6</lt></range>
	<range><ge>1.15</ge><lt>1.15.2</lt></range>
	</package>
	<package>
	<name>krb5-115</name>
	<range><lt>1.15.2</lt></range>
	</package>
	<package>
	<name>krb5-114</name>
	<range><lt>1.14.6</lt></range>
	</package>
	<package>
	<name>krb5-113</name>
	<range><lt>1.14.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MIT reports:</p>
	<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8599">
	<p>CVE-2017-11368:</p>
	<p>In MIT krb5 1.7 and later, an authenticated attacker can cause an
	assertion failure in krb5kdc by sending an invalid S4U2Self or
	S4U2Proxy request.</p>
	</blockquote>
	<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598">
	<p>CVE-2017-11462:</p>
	<p>RFC 2744 permits a GSS-API implementation to delete an existing
	security context on a second or subsequent call to gss_init_sec_context()
	or gss_accept_sec_context() if the call results in an error.
	This API behavior has been found to be dangerous, leading to the
	possibility of memory errors in some callers. For safety, GSS-API
	implementations should instead preserve existing security contexts
	on error until the caller deletes them.</p>
	<p>All versions of MIT krb5 prior to this change may delete acceptor
	contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through
	1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts
	on error.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11368</url>
	<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599</url>
	<url>https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11462</url>
	<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598</url>
	<url>https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf</url>
	<cvename>CVE-2017-11368</cvename>
	<cvename>CVE-2017-11462</cvename>
	</references>
	<dates>
	<discovery>2017-07-14</discovery>
	<entry>2017-10-18</entry>
	</dates>
	</vuln>

	<vuln vid="c41bedfd-b3f9-11e7-ac58-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.58</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.33</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.29</lt></range>
	</package>
	<package>
	<name>mariadb102-server</name>
	<range><lt>10.2.10</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.58</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.38</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.20</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.58</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.38</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL</url>
	<cvename>CVE-2017-10155</cvename>
	<cvename>CVE-2017-10379</cvename>
	<cvename>CVE-2017-10384</cvename>
	<cvename>CVE-2017-10276</cvename>
	<cvename>CVE-2017-10167</cvename>
	<cvename>CVE-2017-10378</cvename>
	<cvename>CVE-2017-10277</cvename>
	<cvename>CVE-2017-10203</cvename>
	<cvename>CVE-2017-10283</cvename>
	<cvename>CVE-2017-10313</cvename>
	<cvename>CVE-2017-10296</cvename>
	<cvename>CVE-2017-10311</cvename>
	<cvename>CVE-2017-10320</cvename>
	<cvename>CVE-2017-10314</cvename>
	<cvename>CVE-2017-10227</cvename>
	<cvename>CVE-2017-10279</cvename>
	<cvename>CVE-2017-10294</cvename>
	<cvename>CVE-2017-10165</cvename>
	<cvename>CVE-2017-10284</cvename>
	<cvename>CVE-2017-10286</cvename>
	<cvename>CVE-2017-10268</cvename>
	<cvename>CVE-2017-10365</cvename>
	</references>
	<dates>
	<discovery>2017-10-18</discovery>
	<entry>2017-10-18</entry>
	<modified>2017-12-23</modified>
	</dates>
	</vuln>

	<vuln vid="ab881a74-c016-4e6d-9f7d-68c8e7cedafb">
	<topic>xorg-server -- Multiple Issues</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><le>1.18.4_6,1</le></range>
	<range><ge>1.19.0,1</ge><le>1.19.3,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xorg-server developers reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/99546">
	<p>In the X.Org X server before 2017-06-19, a user authenticated to
	an X Session could crash or execute code in the context of the X
	Server by exploiting a stack overflow in the endianness conversion
	of X Events.</p>
	<p>Uninitialized data in endianness conversion in the XEvent handling
	of the X.Org X Server before 2017-06-19 allowed authenticated
	malicious users to access potentially privileged data from the X
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/99546</url>
	<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
	<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c</url>
	<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d</url>
	<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455</url>
	<url>http://www.securityfocus.com/bid/99543</url>
	<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
	<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced</url>
	<cvename>CVE-2017-10971</cvename>
	<cvename>CVE-2017-10972</cvename>
	</references>
	<dates>
	<discovery>2017-07-06</discovery>
	<entry>2017-10-17</entry>
	<modified>2018-05-20</modified>
	</dates>
	</vuln>

	<vuln vid="a73518da-b2fa-11e7-98ef-d43d7ef03aa6">
	<topic>Flash Player -- Remote code execution</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>27.0.0.170</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-32.html">
	<ul>
	<li>This update resolves a type confusion vulnerability that
	could lead to remote code execution (CVE-2017-11292).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-11292</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-32.html</url>
	</references>
	<dates>
	<discovery>2017-10-16</discovery>
	<entry>2017-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="d670a953-b2a1-11e7-a633-009c02a2ab30">
	<topic>WPA packet number reuse with replayed messages and key reinstallation</topic>
	<affects>
	<package>
	<name>wpa_supplicant</name>
	<range><le>2.6_1</le></range>
	</package>
	<package>
	<name>hostapd</name>
	<range><le>2.6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wpa_supplicant developers report:</p>
	<blockquote cite="http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt">
	<p>A vulnerability was found in how a number of implementations can be
	triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
	replaying a specific frame that is used to manage the keys.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt</url>
	<url>https://www.kb.cert.org/vuls/id/228519</url>
	<cvename>CVE-2017-13077</cvename>
	<cvename>CVE-2017-13078</cvename>
	<cvename>CVE-2017-13079</cvename>
	<cvename>CVE-2017-13080</cvename>
	<cvename>CVE-2017-13081</cvename>
	<cvename>CVE-2017-13082</cvename>
	<cvename>CVE-2017-13084</cvename>
	<cvename>CVE-2017-13086</cvename>
	<cvename>CVE-2017-13087</cvename>
	<cvename>CVE-2017-13088</cvename>
	</references>
	<dates>
	<discovery>2017-10-16</discovery>
	<entry>2017-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="b0628e53-092a-4037-938b-29805a7cd31b">
	<topic>mercurial -- multiple issues</topic>
	<affects>
	<package>
	<name>mercurial</name>
	<range><lt>4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mercurial developers reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100290">
	<p>Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository</p>
	<p>Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100290</url>
	<url>https://security.gentoo.org/glsa/201709-18</url>
	<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
	<url>http://www.securityfocus.com/bid/100290</url>
	<url>https://security.gentoo.org/glsa/201709-18</url>
	<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
	<cvename>CVE-2017-1000115</cvename>
	<cvename>CVE-2017-1000116</cvename>
	</references>
	<dates>
	<discovery>2017-10-05</discovery>
	<entry>2017-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="555cd806-b031-11e7-a369-14dae9d59f67">
	<topic>Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3</topic>
	<affects>
	<package>
	<name>freexl</name>
	<range><lt>1.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cisco TALOS reports:</p>
	<blockquote cite="http://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430">
	<p>An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
	</blockquote>
	<blockquote cite="https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431">
	<p>An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430</url>
	<cvename>CVE-2017-2923</cvename>
	<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431</url>
	<cvename>CVE-2017-2924</cvename>
	</references>
	<dates>
	<discovery>2017-09-11</discovery>
	<entry>2017-10-13</entry>
	</dates>
	</vuln>

	<vuln vid="ed73829d-af6d-11e7-a633-009c02a2ab30">
	<topic>FFmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range><lt>3.3.4</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-29.x has ffmpeg-3.2 -->
	<range><lt>29.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>FFmpeg security reports:</p>
	<blockquote cite="https://www.ffmpeg.org/security.html">
	<p>Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ffmpeg.org/security.html</url>
	<cvename>CVE-2017-14054</cvename>
	<cvename>CVE-2017-14055</cvename>
	<cvename>CVE-2017-14056</cvename>
	<cvename>CVE-2017-14057</cvename>
	<cvename>CVE-2017-14058</cvename>
	<cvename>CVE-2017-14059</cvename>
	<cvename>CVE-2017-14169</cvename>
	<cvename>CVE-2017-14170</cvename>
	<cvename>CVE-2017-14171</cvename>
	<cvename>CVE-2017-14222</cvename>
	<cvename>CVE-2017-14223</cvename>
	<cvename>CVE-2017-14225</cvename>
	<cvename>CVE-2017-14767</cvename>
	</references>
	<dates>
	<discovery>2017-09-11</discovery>
	<entry>2017-10-12</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="7274e0cc-575f-41bc-8619-14a41b3c2ad0">
	<topic>xorg-server -- multiple vulnabilities</topic>
	<affects>
	<package>
	<name>xephyr</name>
	<range><lt>1.18.4_5,1</lt></range>
	</package>
	<package>
	<name>xorg-dmx</name>
	<range><lt>1.18.4_5,1</lt></range>
	</package>
	<package>
	<name>xorg-nestserver</name>
	<range><lt>1.19.1_2,2</lt></range>
	</package>
	<package>
	<name>xorg-server</name>
	<range><lt>1.18.4_5,1</lt></range>
	</package>
	<package>
	<name>xorg-vfbserver</name>
	<range><lt>1.19.1_2,1</lt></range>
	</package>
	<package>
	<name>xwayland</name>
	<range><lt>1.19.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam Jackson reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002814.html">
	<p>One regression fix since 1.19.4 (mea culpa), and fixes for
	CVEs 2017-12176 through 2017-12187.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.x.org/archives/xorg-announce/2017-October/002814.html</url>
	<cvename>CVE-2017-12176</cvename>
	<cvename>CVE-2017-12177</cvename>
	<cvename>CVE-2017-12178</cvename>
	<cvename>CVE-2017-12179</cvename>
	<cvename>CVE-2017-12180</cvename>
	<cvename>CVE-2017-12181</cvename>
	<cvename>CVE-2017-12182</cvename>
	<cvename>CVE-2017-12183</cvename>
	<cvename>CVE-2017-12184</cvename>
	<cvename>CVE-2017-12185</cvename>
	<cvename>CVE-2017-12186</cvename>
	<cvename>CVE-2017-12187</cvename>
	</references>
	<dates>
	<discovery>2017-10-12</discovery>
	<entry>2017-10-13</entry>
	</dates>
	</vuln>

	<vuln vid="e837390d-0ceb-46b8-9b32-29c1195f5dc7">
	<topic>solr -- Code execution via entity expansion</topic>
	<affects>
	<package>
	<name>apache-solr</name>
	<range><ge>5.1</ge><le>6.6.1</le></range>
	<range><ge>7.0.0</ge><lt>7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Solr developers report:</p>
	<blockquote cite="http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html">
	<p>Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.</p>
	<p>Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html</url>
	<url>https://marc.info/?l=apache-announce&m=150786685013286</url>
	<cvename>CVE-2017-12629</cvename>
	</references>
	<dates>
	<discovery>2017-10-13</discovery>
	<entry>2017-10-13</entry>
	<modified>2017-10-16</modified>
	</dates>
	</vuln>

	<vuln vid="6dc3c61c-e866-4c27-93f7-ae50908594fd">
	<topic>jenkins -- multiple issues</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>2.83</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>2.73.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>jenkins developers report:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2017-10-11/">
	<p>A total of 11 issues are reported, please see reference URL for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://jenkins.io/security/advisory/2017-10-11/</url>
	</references>
	<dates>
	<discovery>2017-10-11</discovery>
	<entry>2017-10-13</entry>
	</dates>
	</vuln>

	<vuln vid="da70d472-af59-11e7-ace2-f8b156b439c5">
	<topic>xen-kernel -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.2_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen project reports multiple vulnerabilities.</p>
	</body>
	</description>
	<references>
	<url>http://xenbits.xen.org/xsa/advisory-237.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-238.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-239.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-240.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-241.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-242.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-243.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-244.html</url>
	</references>
	<dates>
	<discovery>2017-10-12</discovery>
	<entry>2017-10-12</entry>
	</dates>
	</vuln>

	<vuln vid="e71fd9d3-af47-11e7-a633-009c02a2ab30">
	<topic>nss -- Use-after-free in TLS 1.2 generating handshake hashes</topic>
	<affects>
	<package>
	<name>nss</name>
	<range><ge>3.32</ge><lt>3.32.1</lt></range>
	<range><ge>3.28</ge><lt>3.28.6</lt></range>
	</package>
	<package>
	<name>linux-c6-nss</name>
	<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
	</package>
	<package>
	<name>linux-c7-nss</name>
	<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805">
	<p>During TLS 1.2 exchanges, handshake hashes are generated which
	point to a message buffer. This saved data is used for later
	messages but in some cases, the handshake transcript can
	exceed the space available in the current buffer, causing the
	allocation of a new buffer. This leaves a pointer pointing to
	the old, freed buffer, resulting in a use-after-free when
	handshake hashes are then calculated afterwards. This can
	result in a potentially exploitable crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805</url>
	<url>https://hg.mozilla.org/projects/nss/rev/2d7b65b72290</url>
	<url>https://hg.mozilla.org/projects/nss/rev/d3865e2957d0</url>
	<cvename>CVE-2017-7805</cvename>
	</references>
	<dates>
	<discovery>2017-08-04</discovery>
	<entry>2017-10-12</entry>
	<modified>2018-01-29</modified>
	</dates>
	</vuln>

	<vuln vid="15a62f22-098a-443b-94e2-2d26c375b993">
	<topic>osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer</topic>
	<affects>
	<package>
	<name>libosip2</name>
	<range><le>5.0.0</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>osip developers reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/97644">
	<p>In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/97644</url>
	<url>https://savannah.gnu.org/support/index.php?109265</url>
	<cvename>CVE-2017-7853</cvename>
	</references>
	<dates>
	<discovery>2017-04-13</discovery>
	<entry>2017-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="b84dbd94-e894-4c91-b8cd-d328537b1b2b">
	<topic>ncurses -- multiple issues</topic>
	<affects>
	<package>
	<name>ncurses</name>
	<range><le>6.0</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ncurses developers reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1484285">
	<p>There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484274</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484276</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484284</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484285</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484287</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484290</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484291</url>
	<cvename>CVE-2017-13728</cvename>
	<cvename>CVE-2017-13729</cvename>
	<cvename>CVE-2017-13730</cvename>
	<cvename>CVE-2017-13731</cvename>
	<cvename>CVE-2017-13732</cvename>
	<cvename>CVE-2017-13733</cvename>
	<cvename>CVE-2017-13734</cvename>
	</references>
	<dates>
	<discovery>2017-08-29</discovery>
	<entry>2017-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="9164f51e-ae20-11e7-a633-009c02a2ab30">
	<topic>Python 2.7 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>python27</name>
	<range><lt>2.7.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Python reports:</p>
	<blockquote cite="https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS">
	<p>Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS</url>
	<cvename>CVE-2012-0876</cvename>
	<cvename>CVE-2016-0718</cvename>
	<cvename>CVE-2016-4472</cvename>
	<cvename>CVE-2016-5300</cvename>
	<cvename>CVE-2016-9063</cvename>
	<cvename>CVE-2017-9233</cvename>
	</references>
	<dates>
	<discovery>2017-08-26</discovery>
	<entry>2017-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="1257718e-be97-458a-9744-d938b592db42">
	<topic>node -- access to unintended files</topic>
	<affects>
	<package>
	<name>node</name>
	<range><ge>8.5.0</ge><lt>8.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>node developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/101056">
	<p>Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/101056</url>
	<cvename>CVE-2017-14849</cvename>
	</references>
	<dates>
	<discovery>2017-09-27</discovery>
	<entry>2017-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="af61b271-9e47-4db0-a0f6-29fb032236a3">
	<topic>zookeeper -- Denial Of Service</topic>
	<affects>
	<package>
	<name>zookeeper</name>
	<range><lt>3.4.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>zookeeper developers report:</p>
	<blockquote cite="https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E">
	<p>Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E</url>
	<cvename>CVE-2017-5637</cvename>
	</references>
	<dates>
	<discovery>2017-10-09</discovery>
	<entry>2017-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="9b5a905f-e556-452f-a00c-8f070a086181">
	<topic>libtiff -- Improper Input Validation</topic>
	<affects>
	<package>
	<name>libtiff</name>
	<range><le>4.0.8</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libtiff developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100524">
	<p>There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
	<p>There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bugzilla.maptools.org/show_bug.cgi?id=2727</url>
	<url>http://bugzilla.maptools.org/show_bug.cgi?id=2728</url>
	<url>http://www.securityfocus.com/bid/100524</url>
	<cvename>CVE-2017-13726</cvename>
	<cvename>CVE-2017-13727</cvename>
	</references>
	<dates>
	<discovery>2017-08-29</discovery>
	<entry>2017-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="2c8bd00d-ada2-11e7-82af-8dbff7d75206">
	<topic>rubygems -- deserialization vulnerability</topic>
	<affects>
	<package>
	<name>ruby22-gems</name>
	<name>ruby23-gems</name>
	<name>ruby24-gems</name>
	<range><lt>2.6.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oss-security mailing list:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/10/10/2">
	<p>There is a possible unsafe object desrialization vulnerability in
	RubyGems. It is possible for YAML deserialization of gem specifications
	to bypass class white lists. Specially crafted serialized objects can
	possibly be used to escalate to remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2017/10/10/2</url>
	<url>http://blog.rubygems.org/2017/10/09/2.6.14-released.html</url>
	<cvename>CVE-2017-0903</cvename>
	</references>
	<dates>
	<discovery>2017-10-09</discovery>
	<entry>2017-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="4f8ffb9c-f388-4fbd-b90f-b3131559d888">
	<topic>xorg-server -- multiple vulnabilities</topic>
	<affects>
	<package>
	<name>xephyr</name>
	<range><lt>1.18.4_4,1</lt></range>
	</package>
	<package>
	<name>xorg-dmx</name>
	<range><lt>1.18.4_4,1</lt></range>
	</package>
	<package>
	<name>xorg-nestserver</name>
	<range><lt>1.19.1_1,2</lt></range>
	</package>
	<package>
	<name>xorg-server</name>
	<range><lt>1.18.4_4,1</lt></range>
	</package>
	<package>
	<name>xorg-vfbserver</name>
	<range><lt>1.19.1_1,1</lt></range>
	</package>
	<package>
	<name>xwayland</name>
	<range><lt>1.19.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alan Coopersmith reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002809.html">
	<p>X.Org thanks Michal Srb of SuSE for finding these issues
	and bringing them to our attention, Julien Cristau of
	Debian for getting the fixes integrated, and Adam Jackson
	of Red Hat for publishing the release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.x.org/archives/xorg-announce/2017-October/002809.html</url>
	<cvename>CVE-2017-13721</cvename>
	<cvename>CVE-2017-13723</cvename>
	</references>
	<dates>
	<discovery>2017-10-04</discovery>
	<entry>2017-10-09</entry>
	</dates>
	</vuln>

	<vuln vid="c0dae634-4820-4505-850d-b1c975d0f67d">
	<topic>tomcat -- Remote Code Execution</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><ge>7.0.0</ge><le>7.0.81</le></range>
	<range><ge>8.0.0</ge><le>8.0.46</le></range>
	<range><ge>8.5.0</ge><le>8.5.22</le></range>
	<range><ge>9.0.0</ge><lt>9.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>tomcat developers reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100954">
	<p>When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100954</url>
	<url>https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E</url>
	<cvename>CVE-2017-12617</cvename>
	</references>
	<dates>
	<discovery>2017-10-04</discovery>
	<entry>2017-10-06</entry>
	</dates>
	</vuln>

	<vuln vid="ccace707-a8d8-11e7-ac58-b499baebfeaf">
	<topic>cURL -- out of bounds read</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.56.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20171004.html">
	<p>FTP PWD response parser out of bounds read</p>
	<p>libcurl may read outside of a heap allocated buffer when doing FTP.</p>
	<p>When libcurl connects to an FTP server and successfully logs in
	(anonymous or not), it asks the server for the current directory with
	the PWD command. The server then responds with a 257 response containing
	the path, inside double quotes. The returned path name is then kept by
	libcurl for subsequent uses.</p>
	<p>Due to a flaw in the string parser for this directory name, a directory
	name passed like this but without a closing double quote would lead to
	libcurl not adding a trailing NUL byte to the buffer holding the name.
	When libcurl would then later access the string, it could read beyond
	the allocated heap buffer and crash or wrongly access data beyond the
	buffer, thinking it was part of the path.</p>
	<p>A malicious server could abuse this fact and effectively prevent
	libcurl-based clients to work with it - the PWD command is always issued
	on new FTP connections and the mistake has a high chance of causing a
	segfault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_20171004.html</url>
	<cvename>CVE-2017-1000254</cvename>
	</references>
	<dates>
	<discovery>2017-10-04</discovery>
	<entry>2017-10-04</entry>
	</dates>
	</vuln>

	<vuln vid="6ed5c5e3-a840-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- OpenSSH Denial of Service vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_1</lt></range>
	<range><ge>11.0</ge><lt>11.0_12</lt></range>
	<range><ge>10.3</ge><lt>10.3_21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>There is no limit on the password length.</p>
	<h1>Impact:</h1>
	<p>A remote attacker may be able to cause an affected SSH
	server to use excessive amount of CPU by sending very long
	passwords, when PasswordAuthentication is enabled by the
	system administrator.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6515</cvename>
	<freebsdsa>SA-17:06.openssh</freebsdsa>
	</references>
	<dates>
	<discovery>2017-08-10</discovery>
	<entry>2017-10-03</entry>
	</dates>
	</vuln>

	<vuln vid="420243e9-a840-11e7-b5af-a4badb2f4699">
	<topic>FreeBSD -- heimdal KDC-REP service name validation vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_11</lt></range>
	<range><ge>10.3</ge><lt>10.3_20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>There is a programming error in the Heimdal implementation
	that used an unauthenticated, plain-text version of the
	KDC-REP service name found in a ticket.</p>
	<h1>Impact:</h1>
	<p>An attacker who has control of the network between a
	client and the service it talks to will be able to impersonate
	the service, allowing a successful man-in-the-middle (MITM)
	attack that circumvents the mutual authentication.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1110</cvename>
	<freebsdsa>SA-17:05.heimdal</freebsdsa>
	</references>
	<dates>
	<discovery>2017-07-12</discovery>
	<entry>2017-10-03</entry>
	</dates>
	</vuln>

	<vuln vid="b77b5646-a778-11e7-ac58-b499baebfeaf">
	<topic>dnsmasq -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dnsmasq</name>
	<range><lt>2.78,1</lt></range>
	</package>
	<package>
	<name>dnsmasq-devel</name>
	<range><lt>2.78</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Project Zero reports:</p>
	<blockquote cite="https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html">
	<ul>
	<li>CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this
	commit overflow was unrestricted.</li>
	<li>CVE-2017-14492: Heap based overflow.</li>
	<li>CVE-2017-14493: Stack Based overflow.</li>
	<li>CVE-2017-14494: Information Leak</li>
	<li>CVE-2017-14495: Lack of free()</li>
	<li>CVE-2017-14496: Invalid boundary checks. Integer underflow leading
	to a huge memcpy.</li>
	<li>CVE-2017-13704: Crash on large DNS query</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html</url>
	<cvename>CVE-2017-14491</cvename>
	<cvename>CVE-2017-14492</cvename>
	<cvename>CVE-2017-14493</cvename>
	<cvename>CVE-2017-14494</cvename>
	<cvename>CVE-2017-14495</cvename>
	<cvename>CVE-2017-14496</cvename>
	<cvename>CVE-2017-13704</cvename>
	</references>
	<dates>
	<discovery>2017-10-02</discovery>
	<entry>2017-10-02</entry>
	</dates>
	</vuln>

	<vuln vid="33888815-631e-4bba-b776-a9b46fe177b5">
	<topic>phpmyfaq -- multiple issues</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><le>2.9.8</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpmyfaq developers report:</p>
	<blockquote cite="https://www.exploit-db.com/exploits/42761/">
	<p>Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.</p>
	<p>Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.exploit-db.com/exploits/42761/</url>
	<url>https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86</url>
	<cvename>CVE-2017-14618</cvename>
	<cvename>CVE-2017-14619</cvename>
	</references>
	<dates>
	<discovery>2017-09-20</discovery>
	<entry>2017-09-29</entry>
	</dates>
	</vuln>

	<vuln vid="a48d4478-e23f-4085-8ae4-6b3a7b6f016b">
	<topic>wordpress -- multiple issues</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wordpress developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100912">
	<p>Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.</p>
	<p>Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.</p>
	<p>Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.</p>
	<p>Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.</p>
	<p>Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.</p>
	<p>Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.</p>
	<p>Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100912</url>
	<url>https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/</url>
	<url>https://core.trac.wordpress.org/changeset/41393</url>
	<url>https://core.trac.wordpress.org/changeset/41395</url>
	<url>https://core.trac.wordpress.org/changeset/41397</url>
	<url>https://core.trac.wordpress.org/changeset/41412</url>
	<url>https://core.trac.wordpress.org/changeset/41448</url>
	<url>https://core.trac.wordpress.org/changeset/41457</url>
	<url>https://wpvulndb.com/vulnerabilities/8911</url>
	<url>https://wpvulndb.com/vulnerabilities/8912</url>
	<url>https://wpvulndb.com/vulnerabilities/8913</url>
	<url>https://wpvulndb.com/vulnerabilities/8914</url>
	<cvename>CVE-2017-14718</cvename>
	<cvename>CVE-2017-14719</cvename>
	<cvename>CVE-2017-14720</cvename>
	<cvename>CVE-2017-14721</cvename>
	<cvename>CVE-2017-14722</cvename>
	<cvename>CVE-2017-14724</cvename>
	<cvename>CVE-2017-14726</cvename>
	</references>
	<dates>
	<discovery>2017-09-23</discovery>
	<entry>2017-09-29</entry>
	</dates>
	</vuln>

	<vuln vid="1098a15b-b0f6-42b7-b5c7-8a8646e8be07">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>56.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.4.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.4.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
	<p>CVE-2017-7793: Use-after-free with Fetch API</p>
	<p>CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode</p>
	<p>CVE-2017-7818: Use-after-free during ARIA array manipulation</p>
	<p>CVE-2017-7819: Use-after-free while resizing images in design mode</p>
	<p>CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE</p>
	<p>CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes</p>
	<p>CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files</p>
	<p>CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings</p>
	<p>CVE-2017-7813: Integer truncation in the JavaScript parser</p>
	<p>CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces</p>
	<p>CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations</p>
	<p>CVE-2017-7816: WebExtensions can load about: URLs in extension UI</p>
	<p>CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction</p>
	<p>CVE-2017-7823: CSP sandbox directive did not create a unique origin</p>
	<p>CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV</p>
	<p>CVE-2017-7820: Xray wrapper bypass with new tab and web console</p>
	<p>CVE-2017-7811: Memory safety bugs fixed in Firefox 56</p>
	<p>CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7793</cvename>
	<cvename>CVE-2017-7805</cvename>
	<cvename>CVE-2017-7810</cvename>
	<cvename>CVE-2017-7811</cvename>
	<cvename>CVE-2017-7812</cvename>
	<cvename>CVE-2017-7813</cvename>
	<cvename>CVE-2017-7814</cvename>
	<cvename>CVE-2017-7815</cvename>
	<cvename>CVE-2017-7816</cvename>
	<cvename>CVE-2017-7817</cvename>
	<cvename>CVE-2017-7818</cvename>
	<cvename>CVE-2017-7819</cvename>
	<cvename>CVE-2017-7820</cvename>
	<cvename>CVE-2017-7821</cvename>
	<cvename>CVE-2017-7822</cvename>
	<cvename>CVE-2017-7823</cvename>
	<cvename>CVE-2017-7824</cvename>
	<cvename>CVE-2017-7825</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/</url>
	</references>
	<dates>
	<discovery>2017-09-28</discovery>
	<entry>2017-09-29</entry>
	<modified>2017-10-03</modified>
	</dates>
	</vuln>

	<vuln vid="43a1b8f9-3451-4f3c-b4fc-730c0f5876c1">
	<topic>sam2p -- multiple issues</topic>
	<affects>
	<package>
	<name>sam2p</name>
	<range><lt>0.49.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>sam2p developers report:</p>
	<blockquote cite="https://github.com/pts/sam2p/issues/14">
	<p>In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.</p>
	<p>In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.</p>
	<p>In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.</p>
	<p>In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.</p>
	<p>Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.</p>
	<p>In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/pts/sam2p/issues/14</url>
	<cvename>CVE-2017-14628</cvename>
	<cvename>CVE-2017-14629</cvename>
	<cvename>CVE-2017-14630</cvename>
	<cvename>CVE-2017-14631</cvename>
	<cvename>CVE-2017-14636</cvename>
	<cvename>CVE-2017-14637</cvename>
	</references>
	<dates>
	<discovery>2017-09-21</discovery>
	<entry>2017-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="02bee9ae-c5d1-409b-8a79-983a88861509">
	<topic>libraw -- Out-of-bounds Read</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><le>0.18.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libraw developers report:</p>
	<blockquote cite="https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21">
	<p>In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21</url>
	<url>https://github.com/LibRaw/LibRaw/issues/101</url>
	<cvename>CVE-2017-14608</cvename>
	</references>
	<dates>
	<discovery>2017-09-20</discovery>
	<entry>2017-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="3dd6ccf4-a3c6-11e7-a52e-0800279f2ff8">
	<topic>OpenVPN -- out-of-bounds write in legacy key-method 1</topic>
	<affects>
	<package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.18</lt></range>
	</package>
	<package>
	<name>openvpn-mbedtls</name>
	<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
	</package>
	<package>
	<name>openvpn</name>
	<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
	<range><lt>2.3.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Steffan Karger reports:</p>
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2017-12166">
	<p>The bounds check in read_key() was performed after using the value,
	instead of before. If 'key-method 1' is used, this allowed an
	attacker to send a malformed packet to trigger a stack buffer
	overflow. [...]</p>
	<p>Note that 'key-method 1' has been replaced by 'key method 2' as the
	default in OpenVPN 2.0 (released on 2005-04-17), and explicitly
	deprecated in 2.4 and marked for removal in 2.5. This should limit
	the amount of users impacted by this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://community.openvpn.net/openvpn/wiki/CVE-2017-12166</url>
	<url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html</url>
	<cvename>CVE-2017-12166</cvename>
	</references>
	<dates>
	<discovery>2017-09-21</discovery>
	<entry>2017-09-27</entry>
	</dates>
	</vuln>

	<vuln vid="16fb4f83-a2ab-11e7-9c14-009c02a2ab30">
	<topic>ImageMagick -- denial of service via a crafted font file</topic>
	<affects>
	<package>
	<name>ImageMagick7</name>
	<range><lt>7.0.7.4</lt></range>
	</package>
	<package>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.7.4</lt></range>
	</package>
	<package>
	<name>ImageMagick</name>
	<range><le>6.9.8.9_1</le></range>
	</package>
	<package>
	<name>ImageMagick-nox11</name>
	<range><le>6.9.8.9_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741">
	<p>The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741</url>
	<url>https://github.com/ImageMagick/ImageMagick/issues/771</url>
	<url>https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f</url>
	<url>https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d</url>
	<cvename>CVE-2017-14741</cvename>
	</references>
	<dates>
	<discovery>2017-09-21</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="58fafead-cd13-472f-a9bd-d0173ba1b04c">
	<topic>libofx -- exploitable buffer overflow</topic>
	<affects>
	<package>
	<name>libofx</name>
	<range><le>0.9.11_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100828">
	<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100828</url>
	<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317</url>
	<cvename>CVE-2017-2816</cvename>
	</references>
	<dates>
	<discovery>2017-09-13</discovery>
	<entry>2017-09-27</entry>
	</dates>
	</vuln>

	<vuln vid="3b776502-f601-44e0-87cd-b63f1b9ae42a">
	<topic>sugarcrm -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>sugarcrm</name>
	<range><le>6.5.26</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>sugarcrm developers report:</p>
	<blockquote cite="https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/">
	<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.</p>
	<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.</p>
	<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
	<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/</url>
	<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
	<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/</url>
	<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
	<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/</url>
	<cvename>CVE-2017-14508</cvename>
	<cvename>CVE-2017-14509</cvename>
	<cvename>CVE-2017-14510</cvename>
	</references>
	<dates>
	<discovery>2017-09-17</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="b2952517-07e5-4d19-8850-21c5b7e0623f">
	<topic>libzip -- denial of service</topic>
	<affects>
	<package>
	<name>libzip</name>
	<range><lt>1.1.13_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libzip developers report:</p>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/">
	<p>The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/</url>
	<url>https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5</url>
	<cvename>CVE-2017-14107</cvename>
	</references>
	<dates>
	<discovery>2017-09-01</discovery>
	<entry>2017-09-27</entry>
	</dates>
	</vuln>

	<vuln vid="10214bda-0902-4e3b-a2f9-9a68ef206a73">
	<topic>libbson -- Denial of Service</topic>
	<affects>
	<package>
	<name>libbson</name>
	<range><lt>1.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mongodb developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100825">
	<p>In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100825</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489355</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489356</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489362</url>
	<cvename>CVE-2017-14227</cvename>
	</references>
	<dates>
	<discovery>2017-09-09</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="eb03d642-6724-472d-b038-f2bf074e1fc8">
	<topic>tcpdump -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tcpdump</name>
	<range><lt>4.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>tcpdump developers report:</p>
	<blockquote cite="http://www.tcpdump.org/tcpdump-changes.txt">
	<p>Too many issues to detail, see CVE references for details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-11541</cvename>
	<cvename>CVE-2017-11542</cvename>
	<cvename>CVE-2017-11543</cvename>
	<cvename>CVE-2017-12893</cvename>
	<cvename>CVE-2017-12894</cvename>
	<cvename>CVE-2017-12895</cvename>
	<cvename>CVE-2017-12896</cvename>
	<cvename>CVE-2017-12897</cvename>
	<cvename>CVE-2017-12898</cvename>
	<cvename>CVE-2017-12899</cvename>
	<cvename>CVE-2017-12900</cvename>
	<cvename>CVE-2017-12901</cvename>
	<cvename>CVE-2017-12902</cvename>
	<cvename>CVE-2017-12985</cvename>
	<cvename>CVE-2017-12986</cvename>
	<cvename>CVE-2017-12987</cvename>
	<cvename>CVE-2017-12988</cvename>
	<cvename>CVE-2017-12989</cvename>
	<cvename>CVE-2017-12990</cvename>
	<cvename>CVE-2017-12991</cvename>
	<cvename>CVE-2017-12992</cvename>
	<cvename>CVE-2017-12993</cvename>
	<cvename>CVE-2017-12994</cvename>
	<cvename>CVE-2017-12995</cvename>
	<cvename>CVE-2017-12996</cvename>
	<cvename>CVE-2017-12997</cvename>
	<cvename>CVE-2017-12998</cvename>
	<cvename>CVE-2017-12999</cvename>
	<cvename>CVE-2017-13000</cvename>
	<cvename>CVE-2017-13001</cvename>
	<cvename>CVE-2017-13002</cvename>
	<cvename>CVE-2017-13003</cvename>
	<cvename>CVE-2017-13004</cvename>
	<cvename>CVE-2017-13005</cvename>
	<cvename>CVE-2017-13006</cvename>
	<cvename>CVE-2017-13007</cvename>
	<cvename>CVE-2017-13008</cvename>
	<cvename>CVE-2017-13009</cvename>
	<cvename>CVE-2017-13010</cvename>
	<cvename>CVE-2017-13011</cvename>
	<cvename>CVE-2017-13012</cvename>
	<cvename>CVE-2017-13013</cvename>
	<cvename>CVE-2017-13014</cvename>
	<cvename>CVE-2017-13015</cvename>
	<cvename>CVE-2017-13016</cvename>
	<cvename>CVE-2017-13017</cvename>
	<cvename>CVE-2017-13018</cvename>
	<cvename>CVE-2017-13019</cvename>
	<cvename>CVE-2017-13020</cvename>
	<cvename>CVE-2017-13021</cvename>
	<cvename>CVE-2017-13022</cvename>
	<cvename>CVE-2017-13023</cvename>
	<cvename>CVE-2017-13024</cvename>
	<cvename>CVE-2017-13025</cvename>
	<cvename>CVE-2017-13026</cvename>
	<cvename>CVE-2017-13027</cvename>
	<cvename>CVE-2017-13028</cvename>
	<cvename>CVE-2017-13029</cvename>
	<cvename>CVE-2017-13030</cvename>
	<cvename>CVE-2017-13031</cvename>
	<cvename>CVE-2017-13032</cvename>
	<cvename>CVE-2017-13033</cvename>
	<cvename>CVE-2017-13034</cvename>
	<cvename>CVE-2017-13035</cvename>
	<cvename>CVE-2017-13036</cvename>
	<cvename>CVE-2017-13037</cvename>
	<cvename>CVE-2017-13038</cvename>
	<cvename>CVE-2017-13039</cvename>
	<cvename>CVE-2017-13040</cvename>
	<cvename>CVE-2017-13041</cvename>
	<cvename>CVE-2017-13042</cvename>
	<cvename>CVE-2017-13043</cvename>
	<cvename>CVE-2017-13044</cvename>
	<cvename>CVE-2017-13045</cvename>
	<cvename>CVE-2017-13046</cvename>
	<cvename>CVE-2017-13047</cvename>
	<cvename>CVE-2017-13048</cvename>
	<cvename>CVE-2017-13049</cvename>
	<cvename>CVE-2017-13050</cvename>
	<cvename>CVE-2017-13051</cvename>
	<cvename>CVE-2017-13052</cvename>
	<cvename>CVE-2017-13053</cvename>
	<cvename>CVE-2017-13054</cvename>
	<cvename>CVE-2017-13055</cvename>
	<cvename>CVE-2017-13687</cvename>
	<cvename>CVE-2017-13688</cvename>
	<cvename>CVE-2017-13689</cvename>
	<cvename>CVE-2017-13690</cvename>
	<cvename>CVE-2017-13725</cvename>
	</references>
	<dates>
	<discovery>2017-07-22</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="d9f96741-47bd-4426-9aba-8736c0971b24">
	<topic>libraw -- buffer overflow</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><lt>0.18.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libraw developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100866">
	<p>LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100866</url>
	<url>https://github.com/LibRaw/LibRaw/issues/100</url>
	<cvename>CVE-2017-14348</cvename>
	</references>
	<dates>
	<discovery>2017-09-12</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="4cd857d9-26d2-4417-b765-69701938f9e0">
	<topic>libraw -- denial of service and remote code execution</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><lt>0.18.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libraw developers report:</p>
	<blockquote cite="https://github.com/LibRaw/LibRaw/issues/99">
	<p>A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/LibRaw/LibRaw/issues/99</url>
	<cvename>CVE-2017-14265</cvename>
	</references>
	<dates>
	<discovery>2017-09-11</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="a60a2e95-acba-4b11-bc32-ffb47364e07d">
	<topic>libgd -- Denial of servica via double free</topic>
	<affects>
	<package>
	<name>libgd</name>
	<range><lt>2.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libgd developers report:</p>
	<blockquote cite="http://www.debian.org/security/2017/dsa-3961">
	<p>Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.debian.org/security/2017/dsa-3961</url>
	<url>https://github.com/libgd/libgd/issues/381</url>
	<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.5</url>
	<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/</url>
	<cvename>CVE-2017-6362</cvename>
	</references>
	<dates>
	<discovery>2017-09-07</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="5033e2fc-98ec-4ef5-8e0b-87cfbbc73081">
	<topic>php-gd and gd -- Buffer over-read into uninitialized memory</topic>
	<affects>
	<package>
	<name>libgd</name>
	<range><lt>2.2.5</lt></range>
	</package>
	<package>
	<name>php70-gd</name>
	<range><lt>7.0.21</lt></range>
	</package>
	<package>
	<name>php71-gd</name>
	<range><lt>7.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP developers report:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=74435">
	<p>The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=74435</url>
	<cvename>CVE-2017-7890</cvename>
	</references>
	<dates>
	<discovery>2017-08-02</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="d843a984-7f22-484f-ba81-483ddbe30dc3">
	<topic>ledger -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ledger</name>
	<range><le>3.1.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/100543">
	<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.</p>
	<p>An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/100543</url>
	<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303</url>
	<url>http://www.securityfocus.com/bid/100546</url>
	<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304</url>
	<cvename>CVE-2017-2808</cvename>
	<cvename>CVE-2017-2807</cvename>
	</references>
	<dates>
	<discovery>2017-09-05</discovery>
	<entry>2017-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="7801b1e1-99b4-42ac-ab22-7646235e7c16">
	<topic>aacplusenc -- denial of service</topic>
	<affects>
	<package>
	<name>aacplusenc</name>
	<range><le>0.17.5_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo developers report:</p>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/">
	<p>DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/</url>
	<url>https://github.com/teknoraver/aacplusenc/issues/1</url>
	<cvename>CVE-2017-14181</cvename>
	</references>
	<dates>
	<discovery>2017-09-07</discovery>
	<entry>2017-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="478d4102-2319-4026-b3b2-a57c48f159ac">
	<topic>ansible -- information disclosure flaw</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><le>2.2.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ansible developers report:</p>
	<blockquote cite="https://github.com/ansible/ansible/issues/22505">
	<p>Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/ansible/ansible/issues/22505</url>
	<cvename>CVE-2017-7473</cvename>
	</references>
	<dates>
	<discovery>2017-07-21</discovery>
	<entry>2017-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="b63421b6-a1e0-11e7-ac58-b499baebfeaf">
	<topic>weechat -- crash in logger plugin</topic>
	<affects>
	<package>
	<name>weechat</name>
	<range><lt>1.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>WeeChat reports:</p>
	<blockquote cite="https://weechat.org/news/98/20170923-Version-1.9.1-security-release/">
	<p>security problem: a crash can happen in logger plugin when
	converting date/time specifiers in file mask.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://weechat.org/news/98/20170923-Version-1.9.1-security-release/</url>
	<cvename>CVE-2017-14727</cvename>
	</references>
	<dates>
	<discovery>2017-09-23</discovery>
	<entry>2017-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="d9e82328-a129-11e7-987e-4f174049b30a">
	<topic>perl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>perl5</name>
	<range><ge>5.24.0</ge><lt>5.24.3</lt></range>
	<range><ge>5.26.0</ge><lt>5.26.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SO-AND-SO reports:</p>
	<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.1#Security">
	<p>CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows</p>
	<p>A possible stack buffer overflow in the %ENV code on Windows has been
	fixed by removing the buffer completely since it was superfluous anyway.</p>
	<p>CVE-2017-12837: Heap buffer overflow in regular expression compiler</p>
	<p>Compiling certain regular expression patterns with the case-insensitive
	modifier could cause a heap buffer overflow and crash perl. This has now
	been fixed.</p>
	<p>CVE-2017-12883: Buffer over-read in regular expression parser</p>
	<p>For certain types of syntax error in a regular expression pattern, the
	error message could either contain the contents of a random, possibly
	large, chunk of memory, or could crash perl. This has now been fixed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://metacpan.org/changes/release/SHAY/perl-5.24.3</url>
	<url>https://metacpan.org/changes/release/SHAY/perl-5.26.1</url>
	<cvename>CVE-2017-12814</cvename>
	<cvename>CVE-2017-12837</cvename>
	<cvename>CVE-2017-12883</cvename>
	</references>
	<dates>
	<discovery>2017-09-19</discovery>
	<entry>2017-09-24</entry>
	</dates>
	</vuln>

	<vuln vid="917e5519-9fdd-11e7-8b58-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>61.0.3163.100</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html">
	<p>3 security fixes in this release, including:</p>
	<ul>
	<li>[765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by
	Jordan Rabet, Microsoft Offensive Security Research and Microsoft
	ChakraCore team on 2017-09-14</li>
	<li>[752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by
	Choongwoo Han of Naver Corporation on 2017-08-04</li>
	<li>[767508] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5121</cvename>
	<cvename>CVE-2017-5122</cvename>
	<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html</url>
	</references>
	<dates>
	<discovery>2017-09-21</discovery>
	<entry>2017-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="c2ea3b31-9d75-11e7-bb13-001999f8d30b">
	<topic>asterisk -- RTP/RTCP information leak</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.25.3</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.17.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>This is a follow up advisory to AST-2017-005.</p>
	<p>Insufficient RTCP packet validation could allow reading
	stale buffer contents and when combined with the "nat"
	and "symmetric_rtp" options allow redirecting where
	Asterisk sends the next RTCP report.</p>
	<p>The RTP stream qualification to learn the source address
	of media always accepted the first RTP packet as the new
	source and allowed what AST-2017-005 was mitigating. The
	intent was to qualify a series of packets before accepting
	the new source address.</p>
	<p>The RTP/RTCP stack will now validate RTCP packets before processing them.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-008.html</url>
	<cvename>CVE-2017-14099</cvename>
	</references>
	<dates>
	<discovery>2017-09-01</discovery>
	<entry>2017-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="95b01379-9d52-11e7-a25c-471bafc3262f">
	<topic>ruby -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>2.2.0</ge><lt>2.2.8</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby blog:</p>
	<blockquote cite="https://www.ruby-lang.org/en/security/">
	<p>CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf</p>
	<p>If a malicious format string which contains a precious specifier (*)
	is passed and a huge minus value is also passed to the specifier,
	buffer underrun may be caused. In such situation, the result may
	contains heap, or the Ruby interpreter may crash.</p>
	<p>CVE-2017-10784: Escape sequence injection vulnerability in the Basic
	authentication of WEBrick</p>
	<p>When using the Basic authentication of WEBrick, clients can pass an
	arbitrary string as the user name. WEBrick outputs the passed user name
	intact to its log, then an attacker can inject malicious escape
	sequences to the log and dangerous control characters may be executed
	on a victim’s terminal emulator.</p>
	<p>This vulnerability is similar to a vulnerability already fixed, but
	it had not been fixed in the Basic authentication.</p>
	<p>CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode</p>
	<p>If a malicious string is passed to the decode method of OpenSSL::ASN1,
	buffer underrun may be caused and the Ruby interpreter may crash.</p>
	<p>CVE-2017-14064: Heap exposure vulnerability in generating JSON</p>
	<p>The generate method of JSON module optionally accepts an instance of
	JSON::Ext::Generator::State class. If a malicious instance is passed,
	the result may include contents of heap.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/security/</url>
	<url>https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/</url>
	<url>https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/</url>
	<url>https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/</url>
	<url>https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/</url>
	<cvename>CVE-2017-0898</cvename>
	<cvename>CVE-2017-10784</cvename>
	<cvename>CVE-2017-14033</cvename>
	<cvename>CVE-2017-14064</cvename>
	</references>
	<dates>
	<discovery>2017-09-14</discovery>
	<entry>2017-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="2bffdf2f-9d45-11e7-a25c-471bafc3262f">
	<topic>rubygem-geminabox -- XSS & CSRF vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-geminabox</name>
	<range><lt>0.13.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gem in a box XSS vulenrability - CVE-2017-14506:</p>
	<blockquote cite="https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html">
	<p>Malicious attacker create GEM file with crafted homepage value
	(gem.homepage in .gemspec file) includes XSS payload.</p>
	<p>The attacker access geminabox system and uploads the gem file
	(or uses CSRF/SSRF attack to do so).</p>
	<p>From now on, any user access Geminabox web server, executes the
	malicious XSS payload, that will delete any gems on the server,
	and won't let users use the geminabox anymore. (make victim's
	browser crash or redirect them to other hosts).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html</url>
	<cvename>CVE-2017-14506</cvename>
	<cvename>CVE-2017-14683</cvename>
	</references>
	<dates>
	<discovery>2017-09-18</discovery>
	<entry>2017-09-19</entry>
	<modified>2017-09-27</modified>
	</dates>
	</vuln>

	<vuln vid="76b085e2-9d33-11e7-9260-000c292ee6b8">
	<topic>Apache -- HTTP OPTIONS method can leak server memory</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.27_1</lt></range>
	</package>
	<package>
	<name>apache22</name>
	<range><lt>2.2.34_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Fuzzing Project reports:</p>
	<blockquote cite="https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html">
	<p>Apache httpd allows remote attackers to read secret data from
	process memory if the Limit directive can be set in a user's
	.htaccess file, or if httpd.conf has certain misconfigurations,
	aka Optionsbleed. This affects the Apache HTTP Server through
	2.2.34 and 2.4.x through 2.4.27. The attacker sends an
	unauthenticated OPTIONS HTTP request when attempting to read
	secret data. This is a use-after-free issue and thus secret data
	is not always sent, and the specific data depends on many factors
	including configuration. Exploitation with .htaccess can be
	blocked with a patch to the ap_limit_section function in
	server/core.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2017-9798</url>
	<cvename>CVE-2017-9798</cvename>
	</references>
	<dates>
	<discovery>2017-09-18</discovery>
	<entry>2017-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="6a177c87-9933-11e7-93f7-d43d7e971a1b">
	<topic>GitLab -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>1.0.0</ge><le>9.3.10</le></range>
	<range><ge>9.4.0</ge><le>9.4.5</le></range>
	<range><ge>9.5.0</ge><le>9.5.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/</url>
	<cvename>CVE-2017-5029</cvename>
	<cvename>CVE-2016-4738</cvename>
	</references>
	<dates>
	<discovery>2017-09-07</discovery>
	<entry>2017-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="531aae08-97f0-11e7-aadd-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>27.0.0.130</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-28.html">
	<ul>
	<li>These updates resolve memory corruption vulnerabilities that
	could lead to remote code execution (CVE-2017-11281,
	CVE-2017-11282).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-11281</cvename>
	<cvename>CVE-2017-11282</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-28.html</url>
	</references>
	<dates>
	<discovery>2017-09-12</discovery>
	<entry>2017-09-12</entry>
	</dates>
	</vuln>

	<vuln vid="47e2e52c-975c-11e7-942d-5404a68a61a2">
	<topic>emacs -- enriched text remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>emacs25</name>
	<name>emacs-nox11</name>
	<range><lt>25.3,3</lt></range>
	</package>
	<package>
	<name>emacs-devel</name>
	<range><lt>26.0.50.20170912,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Paul Eggert reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q3/422">
	<p>Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.</p>
	<p>When Emacs renders MIME text/enriched data (Internet RFC 1896), it
	is vulnerable to arbitrary code execution. Since Emacs-based mail
	clients decode "Content-Type: text/enriched", this code is exploitable
	remotely. This bug affects GNU Emacs versions 19.29 through 25.2.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2017/q3/422</url>
	<url>https://bugs.gnu.org/28350</url>
	</references>
	<dates>
	<discovery>2017-09-04</discovery>
	<entry>2017-09-12</entry>
	<modified>2017-09-13</modified>
	</dates>
	</vuln>

	<vuln vid="f9f76a50-9642-11e7-ab09-080027b00c2e">
	<topic>cyrus-imapd -- broken "other users" behaviour</topic>
	<affects>
	<package>
	<name>cyrus-imapd30</name>
	<range><ge>3.0.0</ge><lt>3.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cyrus IMAP 3.0.4 Release Notes states:</p>
	<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.html">
	<p>Fixed Issue #2132: Broken "Other Users" behaviour</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-14230</cvename>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230</url>
	</references>
	<dates>
	<discovery>2017-09-07</discovery>
	<entry>2017-09-10</entry>
	</dates>
	</vuln>

	<vuln vid="aaab03be-932d-11e7-92d8-4b26fc968492">
	<topic>Django -- possible XSS in traceback section of technical 500 debug page</topic>
	<affects>
	<package>
	<name>py27-django110</name>
	<name>py34-django110</name>
	<name>py35-django110</name>
	<name>py36-django110</name>
	<range><lt>1.10.8</lt></range>
	</package>
	<package>
	<name>py27-django111</name>
	<name>py34-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<range><lt>1.11.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django blog:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2017/sep/05/security-releases/">
	<p>In older versions, HTML autoescaping was disabled in a portion of the template
	for the technical 500 debug page. Given the right circumstances, this allowed a
	cross-site scripting attack. This vulnerability shouldn't affect most production
	sites since you shouldn't run with DEBUG = True (which makes this page accessible)
	in your production settings.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-12794</cvename>
	<url>https://www.djangoproject.com/weblog/2017/sep/05/security-releases/</url>
	</references>
	<dates>
	<discovery>2017-09-05</discovery>
	<entry>2017-09-06</entry>
	</dates>
	</vuln>

	<vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>61.0.3163.79</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html">
	<p>22 security fixes in this release, including:</p>
	<ul>
	<li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by
	Luat Nguyen on KeenLab, Tencent on 2017-06-27</li>
	<li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by
	Tobias Klein on 2017-07-10</li>
	<li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by
	Anonymous on 2017-07-20</li>
	<li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by
	Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li>
	<li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by
	Marco Giovannini on 2017-07-17</li>
	<li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by
	Anonymous on 2017-08-28</li>
	<li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by
	Tobias Klein on 2017-07-04</li>
	<li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by
	WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li>
	<li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by
	Anonymous on 2017-05-22</li>
	<li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by
	Xiaoyin Liu on 2017-05-05</li>
	<li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5111</cvename>
	<cvename>CVE-2017-5112</cvename>
	<cvename>CVE-2017-5113</cvename>
	<cvename>CVE-2017-5114</cvename>
	<cvename>CVE-2017-5115</cvename>
	<cvename>CVE-2017-5116</cvename>
	<cvename>CVE-2017-5117</cvename>
	<cvename>CVE-2017-5118</cvename>
	<cvename>CVE-2017-5119</cvename>
	<cvename>CVE-2017-5120</cvename>
	<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-09-05</discovery>
	<entry>2017-09-06</entry>
	</dates>
	</vuln>

	<vuln vid="44101b31-8ffd-11e7-b5af-a4badb2f4699">
	<cancelled/>
	</vuln>

	<vuln vid="5a1f1a86-8f4c-11e7-b5af-a4badb2f4699">
	<topic>gdk-pixbuf -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gtk-pixbuf2</name>
	<range><lt>2.36.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TALOS reports:</p>
	<blockquote cite="http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html">
	<ul>
	<li><p>An exploitable integer overflow vulnerability exists in
	the tiff_image_parse functionality.</p></li>
	<li><p>An exploitable heap-overflow vulnerability exists in
	the gdk_pixbuf__jpeg_image_load_increment functionality.</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html</url>
	<cvename>CVE-2017-2862</cvename>
	<cvename>CVE-2017-2870</cvename>
	</references>
	<dates>
	<discovery>2017-08-30</discovery>
	<entry>2017-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="ec1df2a1-8ee6-11e7-8be8-001999f8d30b">
	<topic>asterisk -- Remote Crash Vulerability in res_pjsip</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.17.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-007.html</url>
	<cvename>CVE-2017-14098</cvename>
	</references>
	<dates>
	<discovery>2017-08-31</discovery>
	<entry>2017-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="c599f95c-8ee5-11e7-8be8-001999f8d30b">
	<topic>asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.25.2</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.17.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>AST-2017-005 - A change was made to the strict RTP
	support in the RTP stack to better tolerate late media
	when a reinvite occurs. When combined with the symmetric
	RTP support this introduced an avenue where media could
	be hijacked. Instead of only learning a new address when
	expected the new code allowed a new source address to be
	learned at all times.</p>
	<p>AST-2017-006 - The app_minivm module has an "externnotify"
	program configuration option that is executed by the
	MinivmNotify dialplan application. The application uses
	the caller-id name and number as part of a built string
	passed to the OS shell for interpretation and execution.
	Since the caller-id name and number can come from an
	untrusted source, a crafted caller-id name or number
	allows an arbitrary shell command injection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-005.html</url>
	<cvename>CVE-2017-14099</cvename>
	<url>https://downloads.asterisk.org/pub/security/AST-2017-006.html</url>
	<cvename>CVE-2017-14100</cvename>
	</references>
	<dates>
	<discovery>2017-08-31</discovery>
	<entry>2017-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="22f28bb3-8d98-11e7-8c37-e8e0b747a45a">
	<topic>libgcrypt -- side-channel attack vulnerability</topic>
	<affects>
	<package>
	<name>libgcrypt</name>
	<range><lt>1.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuPG reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379">
	<p>Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-0379</cvename>
	<url>https://eprint.iacr.org/2017/806</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379</url>
	</references>
	<dates>
	<discovery>2017-08-27</discovery>
	<entry>2017-08-30</entry>
	</dates>
	</vuln>

	<vuln vid="3f6de636-8cdb-11e7-9c71-f0def1fd7ea2">
	<topic>rubygems -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ruby22-gems</name>
	<name>ruby23-gems</name>
	<name>ruby24-gems</name>
	<range><lt>2.6.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Official blog of RubyGems reports:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/">
	<p>The following vulnerabilities have been reported: a DNS request
	hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS
	vulnerability in the query command, and a vulnerability in the gem
	installer that allowed a malicious gem to overwrite arbitrary
	files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/</url>
	</references>
	<dates>
	<discovery>2017-08-29</discovery>
	<entry>2017-08-29</entry>
	</dates>
	</vuln>

	<vuln vid="7d7e05fb-64da-435a-84fb-4061493b89b9">
	<topic>kanboard -- multiple privilege escalation vulnerabilities</topic>
	<affects>
	<package>
	<name>kanboard</name>
	<range><lt>1.0.46</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>chbi reports:</p>
	<blockquote cite="https://kanboard.net/news/version-1.0.46">
	<p>an authenticated standard user could reset the password of another
	user (including admin) by altering form data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://kanboard.net/news/version-1.0.46</url>
	<cvename>CVE-2017-12850</cvename>
	<cvename>CVE-2017-12851</cvename>
	</references>
	<dates>
	<discovery>2017-08-15</discovery>
	<entry>2017-08-26</entry>
	</dates>
	</vuln>

	<vuln vid="eca2d861-76f4-42ed-89d2-23a2cb396c87">
	<topic>poppler -- multiple denial of service issues</topic>
	<affects>
	<package>
	<name>poppler</name>
	<range><lt>0.56.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Poppler developers report:</p>
	<blockquote cite="http://www.securityfocus.com/bid/99241/discuss">
	<p>Poppler is prone to a stack-based buffer-overflow
	vulnerability.</p>
	<p>Successful exploits may allow attackers to crash the affected
	application, resulting in denial-of-service condition. Due to the
	nature of this issue, arbitrary code execution may be possible but
	this has not been confirmed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/99241/discuss</url>
	<cvename>CVE-2017-9865</cvename>
	<cvename>CVE-2017-9775</cvename>
	</references>
	<dates>
	<discovery>2017-06-21</discovery>
	<entry>2017-08-24</entry>
	</dates>
	</vuln>

	<vuln vid="c5d79773-8801-11e7-93f7-d43d7e971a1b">
	<topic>phpmailer -- XSS in code example and default exeception handler</topic>
	<affects>
	<package>
	<name>phpmailer</name>
	<range><lt>5.2.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHPMailer reports:</p>
	<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24">
	<p>Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The
	code_generator.phps example did not filter user input prior to output. This
	file is distributed with a .phps extension, so it it not normally executable
	unless it is explicitly renamed, so it is safe by default. There was also an
	undisclosed potential XSS vulnerability in the default exception handler
	(unused by default). Patches for both issues kindly provided by Patrick
	Monnerat of the Fedora Project.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24</url>
	<cvename>CVE-2017-11503</cvename>
	</references>
	<dates>
	<discovery>2017-07-27</discovery>
	<entry>2017-08-23</entry>
	</dates>
	</vuln>

	<vuln vid="3531141d-a708-477c-954a-2a0549e49ca9">
	<topic>salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<range><lt>2016.11.7</lt></range>
	<range><ge>2017.7.0</ge><lt>2017.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SaltStack reports:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html">
	<p>Correct a flaw in minion id validation which could allow certain
	minions to authenticate to a master despite not having the correct
	credentials. To exploit the vulnerability, an attacker must create a
	salt-minion with an ID containing characters that will cause a
	directory traversal.
	Credit for discovering the security flaw goes to: Vernhk@qq.com</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-12791</cvename>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html</url>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html</url>
	</references>
	<dates>
	<discovery>2017-08-16</discovery>
	<entry>2017-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="198d82f3-8777-11e7-950a-e8e0b747a45a">
	<topic>dnsdist -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dnsdist</name>
	<range><lt>1.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS Security Advisory reports:</p>
	<blockquote cite="https://dnsdist.org/security-advisories/index.html">
	<p>The first issue can lead to a denial of service on 32-bit if a backend
	sends crafted answers, and the second to an alteration of dnsdist's ACL
	if the API is enabled, writable and an authenticated user is tricked
	into visiting a crafted website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7069</cvename>
	<cvename>CVE-2017-7557</cvename>
	<url>https://dnsdist.org/security-advisories/index.html</url>
	</references>
	<dates>
	<discovery>2017-08-21</discovery>
	<entry>2017-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="01a197ca-67f1-11e7-a266-28924a333806">
	<topic>evince and atril -- command injection vulnerability in CBT handler</topic>
	<affects>
	<package>
	<name>evince</name>
	<range><le>3.24.0</le></range>
	</package>
	<package>
	<name>evince-lite</name>
	<range><le>3.24.0</le></range>
	</package>
	<package>
	<name>atril</name>
	<range><lt>1.18.1</lt></range>
	<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
	</package>
	<package>
	<name>atril-lite</name>
	<range><lt>1.18.1</lt></range>
	<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNOME reports:</p>
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=784630">
	<p>The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.</p>
	<p>The same vulnerability affects atril, the Evince fork.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=784630</url>
	<url>https://github.com/mate-desktop/atril/issues/257</url>
	<cvename>CVE-2017-1000083</cvename>
	</references>
	<dates>
	<discovery>2017-07-06</discovery>
	<entry>2017-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="e1de77e8-c45e-48d7-8866-5a6f943046de">
	<topic>SquirrelMail -- post-authentication remote code execution</topic>
	<affects>
	<package>
	<name>squirrelmail</name>
	<range><lt>20170705</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SquirrelMail developers report:</p>
	<blockquote cite="http://seclists.org/fulldisclosure/2017/Apr/81">
	<p>SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN)
	allows post-authentication remote code execution via a sendmail.cf
	file that is mishandled in a popen call. It's possible to exploit this
	vulnerability to execute arbitrary shell commands on the remote
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692</url>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="6876b163-8708-11e7-8568-e8e0b747a45a">
	<topic>pspp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>pspp</name>
	<range><lt>1.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE Details reports:</p>
	<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html">
	<ul>
	<li>There is an Integer overflow in the hash_int function of the libpspp library
	in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).</li>
	<li>There is a NULL Pointer Dereference in the function ll_insert() of the libpspp
	library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).</li>
	<li>There is an illegal address access in the function output_hex() in data/data-out.c
	of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).</li>
	<li>There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c
	of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).</li>
	<li>There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c
	of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).</li>
	<li>There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c
	of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-10791</cvename>
	<cvename>CVE-2017-10792</cvename>
	<cvename>CVE-2017-12958</cvename>
	<cvename>CVE-2017-12959</cvename>
	<cvename>CVE-2017-12960</cvename>
	<cvename>CVE-2017-12961</cvename>
	<url>https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html</url>
	</references>
	<dates>
	<discovery>2017-08-18</discovery>
	<entry>2017-08-22</entry>
	<modified>2017-08-30</modified>
	</dates>
	</vuln>

	<vuln vid="473b6a9e-8493-11e7-b24b-6cf0497db129">
	<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal8</name>
	<range><lt>8.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2017-004">
	<p>CVE-2017-6923: Views - Access Bypass - Moderately Critical</p>
	<p>CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica</p>
	<p>CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6923</cvename>
	<cvename>CVE-2017-6924</cvename>
	<cvename>CVE-2017-6925</cvename>
	</references>
	<dates>
	<discovery>2017-08-16</discovery>
	<entry>2017-08-19</entry>
	</dates>
	</vuln>

	<vuln vid="8e7bbddd-8338-11e7-867f-b499baebfeaf">
	<topic>libsoup -- stack based buffer overflow</topic>
	<affects>
	<package>
	<name>libsoup</name>
	<range><lt>2.52.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tobias Mueller reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q3/304">
	<p>libsoup is susceptible to a stack based buffer overflow
	attack when using chunked encoding. Regardless of libsoup
	being used as a server or client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2017/q3/304</url>
	<cvename>CVE-2017-2885</cvename>
	</references>
	<dates>
	<discovery>2017-08-17</discovery>
	<entry>2017-08-17</entry>
	<modified>2017-08-20</modified>
	</dates>
	</vuln>

	<vuln vid="5df8bd95-8290-11e7-93af-005056925db4">
	<topic>Zabbix -- Remote code execution</topic>
	<affects>
	<package>
	<name>zabbix2-server</name>
	<name>zabbix2-proxy</name>
	<range><le>2.0.20</le></range>
	</package>
	<package>
	<name>zabbix22-server</name>
	<name>zabbix22-proxy</name>
	<range><lt>2.2.19</lt></range>
	</package>
	<package>
	<name>zabbix3-server</name>
	<name>zabbix3-proxy</name>
	<range><lt>3.0.10</lt></range>
	</package>
	<package>
	<name>zabbix32-server</name>
	<name>zabbix32-proxy</name>
	<range><lt>3.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824">
	<p>An exploitable code execution vulnerability exists in the trapper command
	functionality of Zabbix Server 2.4.X. A specially crafted set of packets
	can cause a command injection resulting in remote code execution. An attacker
	can make requests from an active Zabbix Proxy to trigger this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2824</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824</url>
	<url>https://support.zabbix.com/browse/ZBX-12349</url>
	</references>
	<dates>
	<discovery>2017-07-05</discovery>
	<entry>2017-08-16</entry>
	</dates>
	</vuln>

	<vuln vid="c9460380-81e3-11e7-93af-005056925db4">
	<topic>Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests</topic>
	<affects>
	<package>
	<name>py27-supervisor</name>
	<range><lt>3.3.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mnaberez reports:</p>
	<blockquote cite="https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606">
	<p>supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket.
	The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been
	enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been
	found where an authenticated client can send a malicious XML-RPC request to supervisord that
	will run arbitrary shell commands on the server. The commands will be run as the same user as
	supervisord. Depending on how supervisord has been configured, this may be root.</p>
	<p>This vulnerability can only be exploited by an authenticated client or if supervisord has been
	configured to run an HTTP server without authentication. If authentication has not been enabled,
	supervisord will log a message at the critical level every time it starts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://supervisord.org/changes.html</url>
	<url>https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606</url>
	<cvename>CVE-2017-11610</cvename>
	</references>
	<dates>
	<discovery>2017-07-24</discovery>
	<entry>2017-08-15</entry>
	</dates>
	</vuln>

	<vuln vid="79bbec7e-8141-11e7-b5af-a4badb2f4699">
	<topic>FreeRadius -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>freeradius3</name>
	<range><lt>3.0.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Guido Vranken reports:</p>
	<blockquote cite="http://freeradius.org/security/fuzzer-2017.html">
	<p>Multiple vulnerabilities found via fuzzing:
	FR-GV-201 (v2,v3) Read / write overflow in make_secret()
	FR-GV-202 (v2) Write overflow in rad_coalesce()
	FR-GV-203 (v2) DHCP - Memory leak in decode_tlv()
	FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode()
	FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options()
	FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
	FR-GV-207 (v2) Zero-length malloc in data2vp()
	FR-GV-301 (v3) Write overflow in data2vp_wimax()
	FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
	FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
	FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
	FR-GV-305 (v3) Decode 'signed' attributes correctly
	FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data
	FR-AD-002 (v3) String lifetime issues in rlm_python
	FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://freeradius.org/security/fuzzer-2017.html</url>
	</references>
	<dates>
	<discovery>2017-06-17</discovery>
	<entry>2017-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="1d33cdee-7f6b-11e7-a9b5-3debb10a6871">
	<topic>Mercurial -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mercurial</name>
	<range><lt>4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mercurial Release Notes:</p>
	<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29">
	<p>CVE-2017-1000115</p>
	<p>Mercurial's symlink auditing was incomplete prior to 4.3, and could be
	abused to write to files outside the repository.</p>
	<p>CVE-2017-1000116</p>
	<p>Mercurial was not sanitizing hostnames passed to ssh, allowing shell
	injection attacks on clients by specifying a hostname starting with
	-oProxyCommand. This is also present in Git (CVE-2017-1000117) and
	Subversion (CVE-2017-9800), so please patch those tools as well if you
	have them installed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
	<cvename>CVE-2017-1000115</cvename>
	<cvename>CVE-2017-1000116</cvename>
	</references>
	<dates>
	<discovery>2017-08-10</discovery>
	<entry>2017-08-12</entry>
	</dates>
	</vuln>

	<vuln vid="6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc">
	<topic>subversion -- Arbitrary code execution vulnerability</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.9.0</ge><le>1.9.6</le></range>
	</package>
	<package>
	<name>subversion18</name>
	<range><ge>1.0.0</ge><le>1.8.18</le></range>
	</package>
	<package>
	<name>subversion-static</name>
	<range><ge>1.0.0</ge><le>1.8.18</le></range>
	<range><ge>1.9.0</ge><le>1.9.6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>subversion team reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
	<p>A Subversion client sometimes connects to URLs provided by the repository.
	This happens in two primary cases: during 'checkout', 'export', 'update', and
	'switch', when the tree being downloaded contains svn:externals properties;
	and when using 'svnsync sync' with one URL argument.</p>
	<p>A maliciously constructed svn+ssh:// URL would cause Subversion clients to
	run an arbitrary shell command. Such a URL could be generated by a malicious
	server, by a malicious user committing to a honest server (to attack another
	user of that server's repositories), or by a proxy server.</p>
	<p>The vulnerability affects all clients, including those that use file://,
	http://, and plain (untunneled) svn://.</p>
	<p>An exploit has been tested.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://subversion.apache.org/security/CVE-2017-9800-advisory.txt</url>
	</references>
	<dates>
	<discovery>2017-08-10</discovery>
	<entry>2017-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b">
	<topic>GitLab -- two vulnerabilities</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>7.9.0</ge><le>8.17.8</le></range>
	<range><ge>9.0.0</ge><le>9.0.12</le></range>
	<range><ge>9.1.0</ge><le>9.1.9</le></range>
	<range><ge>9.2.0</ge><le>9.2.9</le></range>
	<range><ge>9.3.0</ge><le>9.3.9</le></range>
	<range><ge>9.4.0</ge><le>9.4.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/">
	<h1>Remote Command Execution in git client</h1>
	<p>An external code review performed by Recurity-Labs identified a remote
	command execution vulnerability in git that could be exploited via the "Repo
	by URL" import option in GitLab. The command line git client was not
	properly escaping command line arguments in URLs using the SSH protocol
	before invoking the SSH client. A specially crafted URL could be used to
	execute arbitrary shell commands on the GitLab server.<br/>
	To fully patch this vulnerability two fixes were needed. The Omnibus
	versions of GitLab contain a patched git client. For source users who may
	still be running an older version of git, GitLab now also blocks import URLs
	containing invalid host and usernames.<br/>
	This issue has been assigned CVE-2017-12426.</p>
	<h1>Improper sanitization of GitLab export files on import</h1>
	<p>GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a
	patch for a critical directory traversal vulnerability in the GitLab export
	feature that could be exploited by including symlinks in the export file and
	then re-importing it to a GitLab instance. This vulnerability was patched by
	checking for and removing symlinks in these files on import.<br/>
	Recurity-Labs also determined that this fix did not properly remove symlinks for
	hidden files. Though not as dangerous as the original vulnerability hidden file
	symlinks could still be used to steal copies of git repositories belonging to
	other users if the path to the git repository was known by the attacker. An
	updated fix has been included in these releases that properly removes all
	symlinks.<br/>
	This import option was not made available to non-admin users until GitLab
	8.13.0.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/</url>
	<cvename>CVE-2017-12426</cvename>
	</references>
	<dates>
	<discovery>2017-08-10</discovery>
	<entry>2017-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="982872f1-7dd3-11e7-9736-6cc21735f730">
	<topic>PostgreSQL vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.22</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.18</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.8</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/1772/">
	<ul>
	<li>CVE-2017-7546: Empty password accepted in some authentication
	methods</li>
	<li>CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords
	to users lacking server privileges</li>
	<li>CVE-2017-7548: lo_put() function ignores ACLs</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7546</cvename>
	<cvename>CVE-2017-7547</cvename>
	<cvename>CVE-2017-7548</cvename>
	</references>
	<dates>
	<discovery>2017-08-10</discovery>
	<entry>2017-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="7e3d3e9a-7d8f-11e7-a02b-d43d7ef03aa6">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>26.0.0.151</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-23.html">
	<ul>
	<li>These updates resolve security bypass vulnerability that
	could lead to information disclosure (CVE-2017-3085).</li>
	<li>These updates resolve type confusion vulnerability that
	could lead to remote code execution (CVE-2017-3106).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-3085</cvename>
	<cvename>CVE-2017-3106</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-23.html</url>
	</references>
	<dates>
	<discovery>2017-08-08</discovery>
	<entry>2017-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="69cfa386-7cd0-11e7-867f-b499baebfeaf">
	<topic>cURL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.55.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	<ul>
	<li>FILE buffer read out of bounds</li>
	<li>TFTP sends more than buffer size</li>
	<li>URL globbing out of bounds read</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/security.html</url>
	<cvename>CVE-2017-1000099</cvename>
	<cvename>CVE-2017-1000100</cvename>
	<cvename>CVE-2017-1000101</cvename>
	</references>
	<dates>
	<discovery>2017-08-09</discovery>
	<entry>2017-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="c1265e85-7c95-11e7-93af-005056925db4">
	<topic>Axis2 -- Security vulnerability on dependency Apache Commons FileUpload</topic>
	<affects>
	<package>
	<name>axis2</name>
	<range><lt>1.7.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Axis2 reports:</p>
	<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html">
	<p>The commons-fileupload dependency has been updated to a version that fixes
	CVE-2016-1000031 (AXIS2-5853).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html</url>
	<url>https://issues.apache.org/jira/browse/AXIS2-5853</url>
	<url>https://issues.apache.org/jira/browse/FILEUPLOAD-279</url>
	<cvename>CVE-2016-1000031</cvename>
	</references>
	<dates>
	<discovery>2016-11-14</discovery>
	<entry>2017-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="555b244e-6b20-4546-851f-d8eb7d6c1ffa">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>55.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.3.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.3.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7753</cvename>
	<cvename>CVE-2017-7779</cvename>
	<cvename>CVE-2017-7780</cvename>
	<cvename>CVE-2017-7781</cvename>
	<cvename>CVE-2017-7782</cvename>
	<cvename>CVE-2017-7783</cvename>
	<cvename>CVE-2017-7784</cvename>
	<cvename>CVE-2017-7785</cvename>
	<cvename>CVE-2017-7786</cvename>
	<cvename>CVE-2017-7787</cvename>
	<cvename>CVE-2017-7788</cvename>
	<cvename>CVE-2017-7789</cvename>
	<cvename>CVE-2017-7790</cvename>
	<cvename>CVE-2017-7791</cvename>
	<cvename>CVE-2017-7792</cvename>
	<cvename>CVE-2017-7794</cvename>
	<cvename>CVE-2017-7796</cvename>
	<cvename>CVE-2017-7797</cvename>
	<cvename>CVE-2017-7798</cvename>
	<cvename>CVE-2017-7799</cvename>
	<cvename>CVE-2017-7800</cvename>
	<cvename>CVE-2017-7801</cvename>
	<cvename>CVE-2017-7802</cvename>
	<cvename>CVE-2017-7803</cvename>
	<cvename>CVE-2017-7804</cvename>
	<cvename>CVE-2017-7806</cvename>
	<cvename>CVE-2017-7807</cvename>
	<cvename>CVE-2017-7808</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/</url>
	</references>
	<dates>
	<discovery>2017-08-08</discovery>
	<entry>2017-08-08</entry>
	</dates>
	</vuln>

	<vuln vid="9245681c-7c3c-11e7-b5af-a4badb2f4699">
	<topic>sqlite3 -- heap-buffer overflow</topic>
	<affects>
	<package>
	<name>sqlite3</name>
	<range><lt>3.20.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google reports:</p>
	<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937">
	<p>A heap-buffer overflow (sometimes a crash) can arise when
	running a SQL request on malformed sqlite3 databases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937</url>
	<cvename>CVE-2017-10989</cvename>
	</references>
	<dates>
	<discovery>2017-08-08</discovery>
	<entry>2017-08-08</entry>
	<modified>2017-09-19</modified>
	</dates>
	</vuln>

	<vuln vid="88a77ad8-77b1-11e7-b5af-a4badb2f4699">
	<topic>Varnish -- Denial of service vulnerability</topic>
	<affects>
	<package>
	<name>varnish4</name>
	<range><ge>4.0.1</ge><lt>4.0.5</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.8</lt></range>
	</package>
	<package>
	<name>varnish5</name>
	<range><lt>5.0.1</lt></range>
	<range><ge>5.1.0</ge><lt>5.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phk reports:</p>
	<blockquote cite="https://varnish-cache.org/security/VSV00001.html">
	<p>A wrong if statement in the varnishd source code means that
	particular invalid requests from the client can trigger an assert.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://varnish-cache.org/security/VSV00001.html</url>
	</references>
	<dates>
	<discovery>2017-08-02</discovery>
	<entry>2017-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="7d138476-7710-11e7-88a1-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>60.0.3112.78</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html">
	<p>40 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5091</cvename>
	<cvename>CVE-2017-5092</cvename>
	<cvename>CVE-2017-5093</cvename>
	<cvename>CVE-2017-5094</cvename>
	<cvename>CVE-2017-5095</cvename>
	<cvename>CVE-2017-5096</cvename>
	<cvename>CVE-2017-5097</cvename>
	<cvename>CVE-2017-5098</cvename>
	<cvename>CVE-2017-5099</cvename>
	<cvename>CVE-2017-5100</cvename>
	<cvename>CVE-2017-5101</cvename>
	<cvename>CVE-2017-5102</cvename>
	<cvename>CVE-2017-5103</cvename>
	<cvename>CVE-2017-5104</cvename>
	<cvename>CVE-2017-7000</cvename>
	<cvename>CVE-2017-5105</cvename>
	<cvename>CVE-2017-5106</cvename>
	<cvename>CVE-2017-5107</cvename>
	<cvename>CVE-2017-5108</cvename>
	<cvename>CVE-2017-5109</cvename>
	<cvename>CVE-2017-5110</cvename>
	<url>https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-07-25</discovery>
	<entry>2017-08-01</entry>
	</dates>
	</vuln>

	<vuln vid="f86d0e5d-7467-11e7-93af-005056925db4">
	<topic>Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><eq>1.1.13</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>kimiizhang reports:</p>
	<blockquote cite="https://github.com/Cacti/cacti/issues/867">
	<p>Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti
	1.1.13 allows remote authenticated users to inject arbitrary web script
	or HTML via specially crafted HTTP Referer headers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/Cacti/cacti/issues/867</url>
	<url>https://www.cacti.net/release_notes.php?version=1.1.14</url>
	<cvename>CVE-2017-11691</cvename>
	</references>
	<dates>
	<discovery>2017-07-20</discovery>
	<entry>2017-07-29</entry>
	</dates>
	</vuln>

	<vuln vid="770d7e91-72af-11e7-998a-08606e47f965">
	<topic>proftpd -- user chroot escape vulnerability</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<range><lt>1.3.5e</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7418">
	<p>ProFTPD ... controls whether the home directory of a user could
	contain a symbolic link through the AllowChrootSymlinks
	configuration option, but checks only the last path component when
	enforcing AllowChrootSymlinks. Attackers with local access could
	bypass the AllowChrootSymlinks control by replacing a path
	component (other than the last one) with a symbolic link.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bugs.proftpd.org/show_bug.cgi?id=4295</url>
	<cvename>CVE-2017-7418</cvename>
	</references>
	<dates>
	<discovery>2017-03-06</discovery>
	<entry>2017-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="76d80b33-7211-11e7-998a-08606e47f965">
	<topic>jabberd -- authentication bypass vulnerability</topic>
	<affects>
	<package>
	<name>jabberd</name>
	<range><lt>2.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/99511/discuss">
	<p>JabberD is prone to an authentication-bypass vulnerability.
	An attacker can exploit this issue to bypass the authentication
	mechanism and perform unauthorized actions. This may lead to
	further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032</url>
	<url>http://www.securityfocus.com/bid/99511</url>
	<cvename>CVE-2017-10807</cvename>
	</references>
	<dates>
	<discovery>2017-07-03</discovery>
	<entry>2017-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="0f66b901-715c-11e7-ad1f-bcaec565249c">
	<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>webkit2-gtk3</name>
	<range><lt>2.16.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Webkit gtk team reports:</p>
	<blockquote cite="https://webkitgtk.org/security/WSA-2017-0006.html">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://webkitgtk.org/security/WSA-2017-0006.html</url>
	<cvename>CVE-2017-7006</cvename>
	<cvename>CVE-2017-7011</cvename>
	<cvename>CVE-2017-7012</cvename>
	<cvename>CVE-2017-7018</cvename>
	<cvename>CVE-2017-7019</cvename>
	<cvename>CVE-2017-7020</cvename>
	<cvename>CVE-2017-7030</cvename>
	<cvename>CVE-2017-7034</cvename>
	<cvename>CVE-2017-7037</cvename>
	<cvename>CVE-2017-7038</cvename>
	<cvename>CVE-2017-7039</cvename>
	<cvename>CVE-2017-7040</cvename>
	<cvename>CVE-2017-7041</cvename>
	<cvename>CVE-2017-7042</cvename>
	<cvename>CVE-2017-7043</cvename>
	<cvename>CVE-2017-7046</cvename>
	<cvename>CVE-2017-7048</cvename>
	<cvename>CVE-2017-7049</cvename>
	<cvename>CVE-2017-7052</cvename>
	<cvename>CVE-2017-7055</cvename>
	<cvename>CVE-2017-7056</cvename>
	<cvename>CVE-2017-7059</cvename>
	<cvename>CVE-2017-7061</cvename>
	<cvename>CVE-2017-7064</cvename>
	</references>
	<dates>
	<discovery>2017-07-24</discovery>
	<entry>2017-07-25</entry>
	<modified>2018-03-28</modified>
	</dates>
	</vuln>

	<vuln vid="8745c67e-7dd1-4165-96e2-fcf9da2dc5b5">
	<topic>gsoap -- remote code execution via via overflow</topic>
	<affects>
	<package>
	<name>gsoap</name>
	<range><lt>2.8.47</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Senrio reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/99868/discuss">
	<p>Genivia gSOAP is prone to a stack-based buffer-overflow
	vulnerability because it fails to properly bounds check user-supplied
	data before copying it into an insufficiently sized buffer.</p>
	<p>A remote attacker may exploit this issue to execute arbitrary code
	in the context of the affected device. Failed attempts will likely
	cause a denial-of-service condition.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/99868/discuss</url>
	<url>http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions</url>
	<url>http://blog.senr.io/devilsivy.html</url>
	<url>https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29</url>
	<url>https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29</url>
	<cvename>CVE-2017-9765</cvename>
	</references>
	<dates>
	<discovery>2017-07-18</discovery>
	<entry>2017-07-25</entry>
	</dates>
	</vuln>

	<vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
	<topic>GitLab -- Various security issues</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>8.0.0</ge><le>8.17.6</le></range>
	<range><ge>9.0.0</ge><le>9.0.10</le></range>
	<range><ge>9.1.0</ge><le>9.1.7</le></range>
	<range><ge>9.2.0</ge><le>9.2.7</le></range>
	<range><ge>9.3.0</ge><le>9.3.7</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
	<cvename>CVE-2017-11438</cvename>
	</references>
	<dates>
	<discovery>2017-07-20</discovery>
	<entry>2017-07-20</entry>
	<modified>2017-08-15</modified>
	</dates>
	</vuln>

	<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.57</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.32</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.26</lt></range>
	</package>
	<package>
	<name>mariadb102-server</name>
	<range><lt>10.2.6</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.57</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.37</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.19</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.57</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.37</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL</url>
	<cvename>CVE-2017-3529</cvename>
	<cvename>CVE-2017-3633</cvename>
	<cvename>CVE-2017-3634</cvename>
	<cvename>CVE-2017-3635</cvename>
	<cvename>CVE-2017-3636</cvename>
	<cvename>CVE-2017-3637</cvename>
	<cvename>CVE-2017-3638</cvename>
	<cvename>CVE-2017-3639</cvename>
	<cvename>CVE-2017-3640</cvename>
	<cvename>CVE-2017-3641</cvename>
	<cvename>CVE-2017-3642</cvename>
	<cvename>CVE-2017-3643</cvename>
	<cvename>CVE-2017-3644</cvename>
	<cvename>CVE-2017-3645</cvename>
	<cvename>CVE-2017-3646</cvename>
	<cvename>CVE-2017-3647</cvename>
	<cvename>CVE-2017-3648</cvename>
	<cvename>CVE-2017-3649</cvename>
	<cvename>CVE-2017-3650</cvename>
	<cvename>CVE-2017-3651</cvename>
	<cvename>CVE-2017-3652</cvename>
	<cvename>CVE-2017-3653</cvename>
	</references>
	<dates>
	<discovery>2017-07-19</discovery>
	<entry>2017-07-19</entry>
	<modified>2017-08-12</modified>
	</dates>
	</vuln>

	<vuln vid="08a2df48-6c6a-11e7-9b01-2047478f2f70">
	<topic>collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures</topic>
	<affects>
	<package>
	<name>collectd5</name>
	<range><lt>5.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>marcinguy reports:</p>
	<blockquote cite="https://github.com/collectd/collectd/issues/2174">
	<p>After sending this payload, collectd seems to be entering endless while()
	loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/collectd/collectd/issues/2174</url>
	<cvename>CVE-2017-7401</cvename>
	</references>
	<dates>
	<discovery>2017-02-13</discovery>
	<entry>2017-07-19</entry>
	</dates>
	</vuln>

	<vuln vid="e6ccaf8a-6c63-11e7-9b01-2047478f2f70">
	<topic>strongswan -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><ge>4.4.0</ge><le>5.5.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>strongSwan security team reports:</p>
	<blockquote cite="https://www.strongswan.org/blog/2017/05/30/strongswan-5.5.3-released.html">
	<ul>
	<li>RSA public keys passed to the gmp plugin aren't validated sufficiently
	before attempting signature verification, so that invalid input might
	lead to a floating point exception. [CVE-2017-9022]</li>
	<li>ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when
	parsing X.509 certificates with extensions that use such types. This
	could lead to infinite looping of the thread parsing a specifically crafted certificate.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html</url>
	<cvename>CVE-2017-9022</cvename>
	<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html</url>
	<cvename>CVE-2017-9023</cvename>
	</references>
	<dates>
	<discovery>2017-05-30</discovery>
	<entry>2017-07-19</entry>
	</dates>
	</vuln>

	<vuln vid="c7e8e955-6c61-11e7-9b01-2047478f2f70">
	<cancelled superseded="e6ccaf8a-6c63-11e7-9b01-2047478f2f70"/>
	</vuln>

	<vuln vid="dc3c66e8-6a18-11e7-93af-005056925db4">
	<topic>Cacti -- Cross-site scripting (XSS) vulnerability in link.php</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><ge>1.0.0</ge><lt>1.1.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>kimiizhang reports:</p>
	<blockquote cite="https://github.com/Cacti/cacti/issues/838">
	<p>Cross-site scripting (XSS) vulnerability in link.php in Cacti<br/>
	1.1.12 allows remote anonymous users to inject arbitrary web<br/>
	script or HTML via the id parameter.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/Cacti/cacti/issues/838</url>
	<url>https://www.cacti.net/release_notes.php?version=1.1.13</url>
	<cvename>CVE-2017-10970</cvename>
	</references>
	<dates>
	<discovery>2017-07-05</discovery>
	<entry>2017-07-17</entry>
	</dates>
	</vuln>

	<vuln vid="457ce015-67fa-11e7-867f-b499baebfeaf">
	<topic>Apache httpd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache httpd project reports:</p>
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	<p>important: Read after free in mod_http2 (CVE-2017-9789)<br/>
	When under stress, closing many connections, the HTTP/2 handling
	code would sometimes access memory after it has been freed,
	resulting in potentially erratic behaviour.</p>
	<p>important: Uninitialized memory reflection in mod_auth_digest
	(CVE-2017-9788)<br/>The value placeholder in [Proxy-]Authorization
	headers of type 'Digest' was not initialized or reset before or
	between successive key=value assignments. by mod_auth_digest.<br/>
	Providing an initial key with no '=' assignment could reflect
	the stale value of uninitialized pool memory used by the prior
	request, leading to leakage of potentially confidential
	information, and a segfault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
	<cvename>CVE-2017-9789</cvename>
	<cvename>CVE-2017-9788</cvename>
	</references>
	<dates>
	<discovery>2017-07-11</discovery>
	<entry>2017-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="a03e043a-67f1-11e7-beff-6451062f0f7a">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>26.0.0.137</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-21.html">
	<ul>
	<li>These updates resolve security bypass vulnerability that
	could lead to information disclosure (CVE-2017-3080).</li>
	<li>These updates resolve memory corruption vulnerability that
	could lead to remote code execution (CVE-2017-3099).</li>
	<li>These updates resolve memory corruption vulnerability that
	could lead to memory address disclosure (CVE-2017-3100).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-3080</cvename>
	<cvename>CVE-2017-3099</cvename>
	<cvename>CVE-2017-3100</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-21.html</url>
	</references>
	<dates>
	<discovery>2017-07-11</discovery>
	<entry>2017-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="85851e4f-67d9-11e7-bc37-00505689d4ae">
	<topic>samba -- Orpheus Lyre mutual authentication validation bypass</topic>
	<affects>
	<package>
	<name>samba42</name>
	<range><lt>4.2.15</lt></range>
	</package>
	<package>
	<name>samba43</name>
	<range><lt>4.3.14</lt></range>
	</package>
	<package>
	<name>samba44</name>
	<range><lt>4.4.15</lt></range>
	</package>
	<package>
	<name>samba45</name>
	<range><lt>4.5.12</lt></range>
	</package>
	<package>
	<name>samba46</name>
	<range><lt>4.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The samba project reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2017-11103.html">
	<p>A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by
	returning malicious replication or authorization data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.samba.org/samba/security/CVE-2017-11103.html</url>
	<cvename>CVE-2017-11103</cvename>
	</references>
	<dates>
	<discovery>2017-07-12</discovery>
	<entry>2017-07-12</entry>
	</dates>
	</vuln>

	<vuln vid="3eff66c5-66c9-11e7-aa1d-3d2e663cef42">
	<topic>node.js -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node</name>
	<range><lt>8.1.4</lt></range>
	</package>
	<package>
	<name>node4</name>
	<range><lt>4.8.4</lt></range>
	</package>
	<package>
	<name>node6</name>
	<range><lt>6.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Updates are now available for all active Node.js release lines as
	well as the 7.x line. These include the fix for the high severity
	vulnerability identified in the initial announcement, one additional
	lower priority Node.js vulnerability in the 4.x release line, as well
	as some lower priority fixes for Node.js dependencies across the
	current release lines.</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/">
	<h2>Constant Hashtable Seeds (CVE pending)</h2>
	<p>Node.js was susceptible to hash flooding remote DoS attacks as the
	HashTable seed was constant across a given released version of
	Node.js. This was a result of building with V8 snapshots enabled by
	default which caused the initially randomized seed to be overwritten
	on startup. Thanks to Jann Horn of Google Project Zero for reporting
	this vulnerability.</p>
	<p>This is a high severity vulnerability and applies to all active
	release lines (4.x, 6.x, 8.x) as well as the 7.x line.</p>
	<h2>http.get with numeric authorization options creates uninitialized
	buffers</h2>
	<p>Application code that allows the auth field of the options object
	used with http.get() to be set to a number can result in an
	uninitialized buffer being created/used as the authentication
	string.</p>
	<p>This is a low severity defect and only applies to the 4.x release
	line.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/</url>
	</references>
	<dates>
	<discovery>2017-06-27</discovery>
	<entry>2017-07-12</entry>
	</dates>
	</vuln>

	<vuln vid="b28adc5b-6693-11e7-ad43-f0def16c5c1b">
	<topic>nginx -- a specially crafted request might result in an integer overflow</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><ge>0.5.6</ge><lt>1.12.1,2</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><ge>0.5.6</ge><lt>1.13.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Maxim Dounin reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html">
	<p>A security issue was identified in nginx range filter. A specially
	crafted request might result in an integer overflow and incorrect
	processing of ranges, potentially resulting in sensitive information
	leak (CVE-2017-7529).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html</url>
	<cvename>CVE-2017-7529</cvename>
	</references>
	<dates>
	<discovery>2017-07-11</discovery>
	<entry>2017-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="aaedf196-6436-11e7-8b49-002590263bf5">
	<topic>codeigniter -- input validation bypass</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>3.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	<p>Form Validation Library rule valid_email could be bypassed if
	idn_to_ascii() is available.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.codeigniter.com/user_guide/changelog.html</url>
	</references>
	<dates>
	<discovery>2017-06-19</discovery>
	<entry>2017-07-08</entry>
	</dates>
	</vuln>

	<vuln vid="31001c6b-63e7-11e7-85aa-a4badb2f4699">
	<topic>irssi -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>1.0.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>irssi reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_07.txt">
	<p>When receiving messages with invalid time stamps, Irssi
	would try to dereference a NULL pointer.</p>
	<p>While updating the internal nick list, Irssi may
	incorrectly use the GHashTable interface and free the nick while
	updating it. This will then result in use-after-free conditions on each
	access of the hash table.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://irssi.org/security/irssi_sa_2017_07.txt</url>
	<cvename>CVE-2017-10965</cvename>
	<cvename>CVE-2017-10966</cvename>
	<freebsdpr>ports/220544</freebsdpr>
	</references>
	<dates>
	<discovery>2017-07-05</discovery>
	<entry>2017-07-08</entry>
	</dates>
	</vuln>

	<vuln vid="b396cf6c-62e6-11e7-9def-b499baebfeaf">
	<topic>oniguruma -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libevhtp</name>
	<range><lt>1.2.14</lt></range>
	</package>
	<package>
	<name>oniguruma4</name>
	<range><lt>4.7.2</lt></range>
	</package>
	<package>
	<name>oniguruma5</name>
	<range><lt>5.9.7</lt></range>
	</package>
	<package>
	<name>oniguruma6</name>
	<range><lt>6.4.0</lt></range>
	</package>
	<package>
	<name>php56-mbstring</name>
	<range><lt>5.6.31</lt></range>
	</package>
	<package>
	<name>php70-mbstring</name>
	<range><lt>7.0.21</lt></range>
	</package>
	<package>
	<name>php71-mbstring</name>
	<range><lt>7.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>the PHP project reports:</p>
	<blockquote cite="http://php.net/ChangeLog-7.php">
	<ul>
	<li>A stack out-of-bounds read occurs in match_at() during regular
	expression searching. A logical error involving order of validation
	and access in match_at() could result in an out-of-bounds read from
	a stack buffer (CVE-2017-9224).</li>
	<li>A heap out-of-bounds write or read occurs in next_state_val()
	during regular expression compilation. Octal numbers larger than 0xff
	are not handled correctly in fetch_token() and fetch_token_in_cc().
	A malformed regular expression containing an octal number in the form
	of '\700' would produce an invalid code point value larger than 0xff
	in next_state_val(), resulting in an out-of-bounds write memory
	corruption (CVE-2017-9226).</li>
	<li>A stack out-of-bounds read occurs in mbc_enc_len() during regular
	expression searching. Invalid handling of reg->dmin in
	forward_search_range() could result in an invalid pointer dereference,
	as an out-of-bounds read from a stack buffer (CVE-2017-9227).</li>
	<li>A heap out-of-bounds write occurs in bitset_set_range() during
	regular expression compilation due to an uninitialized variable from
	an incorrect state transition. An incorrect state transition in
	parse_char_class() could create an execution path that leaves a
	critical local variable uninitialized until it's used as an index,
	resulting in an out-of-bounds write memory corruption (CVE-2017-9228).</li>
	<li>A SIGSEGV occurs in left_adjust_char_head() during regular expression
	compilation. Invalid handling of reg->dmax in forward_search_range() could
	result in an invalid pointer dereference, normally as an immediate
	denial-of-service condition (CVE-2017-9228).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-7.php</url>
	<cvename>CVE-2017-9224</cvename>
	<cvename>CVE-2017-9226</cvename>
	<cvename>CVE-2017-9227</cvename>
	<cvename>CVE-2017-9228</cvename>
	<cvename>CVE-2017-9228</cvename>
	</references>
	<dates>
	<discovery>2017-07-06</discovery>
	<entry>2017-07-07</entry>
	<modified>2018-01-04</modified>
	</dates>
	</vuln>

	<vuln vid="4fc2df49-6279-11e7-be0f-6cf0497db129">
	<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.56</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><lt>8.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team Reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2017-003">
	<p>CVE-2017-6920: PECL YAML parser unsafe object handling.</p>
	<p>CVE-2017-6921: File REST resource does not properly validate</p>
	<p>CVE-2017-6922: Files uploaded by anonymous users into a private
	file system can be accessed by other anonymous users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6920</cvename>
	<cvename>CVE-2017-6921</cvename>
	<cvename>CVE-2017-6922</cvename>
	</references>
	<dates>
	<discovery>2017-06-21</discovery>
	<entry>2017-07-06</entry>
	</dates>
	</vuln>

	<vuln vid="60931f98-55a7-11e7-8514-589cfc0654e1">
	<topic>Dropbear -- two vulnerabilities</topic>
	<affects>
	<package>
	<name>dropbear</name>
	<range><lt>2017.75</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matt Johnston reports:</p>
	<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
	<p>Fix double-free in server TCP listener cleanup A double-free in
	the server could be triggered by an authenticated user if dropbear
	is running with -a (Allow connections to forwarded ports from any
	host) This could potentially allow arbitrary code execution as root
	by an authenticated user.</p>
	<p>Fix information disclosure with ~/.ssh/authorized_keys symlink.
	Dropbear parsed authorized_keys as root, even if it were a symlink.
	The fix is to switch to user permissions when opening authorized_keys.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
	<cvename>CVE-2017-9078</cvename>
	<cvename>CVE-2017-9079</cvename>
	</references>
	<dates>
	<discovery>2017-05-18</discovery>
	<entry>2017-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="6e4e35c3-5fd1-11e7-9def-b499baebfeaf">
	<topic>smarty3 -- shell injection in math</topic>
	<affects>
	<package>
	<name>smarty3</name>
	<range><lt>3.1.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The smarty project reports:</p>
	<blockquote cite="https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt">
	<p>bugfix {math} shell injection vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt</url>
	</references>
	<dates>
	<discovery>2016-07-19</discovery>
	<entry>2017-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="ed3bf433-5d92-11e7-aa14-e8e0b747a45a">
	<topic>libgcrypt -- side-channel attack on RSA secret keys</topic>
	<affects>
	<package>
	<name>libgcrypt</name>
	<range><lt>1.7.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuPG reports:</p>
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html">
	<p>Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7526</cvename>
	<url>https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html</url>
	</references>
	<dates>
	<discovery>2017-06-29</discovery>
	<entry>2017-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="85ebfa0c-5d8d-11e7-93f7-d43d7e971a1b">
	<topic>GitLab -- Various security issues</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>4.0.0</ge><le>9.0.9</le></range>
	<range><ge>9.1.0</ge><le>9.1.6</le></range>
	<range><ge>9.2.0</ge><le>9.2.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/</url>
	</references>
	<dates>
	<discovery>2017-06-07</discovery>
	<entry>2017-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="0b9f4b5e-5d82-11e7-85df-14dae9d5a9d2">
	<topic>tor -- security regression</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.3.0.9</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.3.1.4.a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Project reports:</p>
	<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html">
	<p>Tor 0.3.0.9 fixes a path selection bug that would allow a client
	to use a guard that was in the same network family as a chosen exit
	relay. This is a security regression; all clients running earlier
	versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or
	0.3.1.4-alpha.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.torproject.org/blog/tor-0309-released-security-update-clients</url>
	<url>https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients</url>
	<url>https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html</url>
	<cvename>CVE-2017-0377</cvename>
	</references>
	<dates>
	<discovery>2017-06-29</discovery>
	<entry>2017-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f">
	<topic>exim -- Privilege escalation via multiple memory leaks</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><lt>4.89_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Qualsys reports:</p>
	<blockquote cite="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">
	<p>
	Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369</url>
	</references>
	<dates>
	<discovery>2017-06-19</discovery>
	<entry>2017-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="00e4050b-56c1-11e7-8e66-08606e46faad">
	<topic>pear-Horde_Image -- DoS vulnerability</topic>
	<affects>
	<package>
	<name>pear-Horde_Image</name>
	<range><gt>2.3.0</gt><lt>2.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael J Rubinsky reports:</p>
	<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
	<p>The second vulnerability (CVE-2017-9773) is a DOS vulnerability.
	This only affects Horde installations that do not have a configured image
	handling backend, and thus use the "Null" image driver. It is exploitable by
	a logged in user clicking on a maliciously crafted URL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
	<cvename>CVE-2017-9773</cvename>
	</references>
	<dates>
	<discovery>2017-06-21</discovery>
	<entry>2017-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="a7003121-56bf-11e7-8e66-08606e46faad">
	<topic>pear-Horde_Image -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>pear-Horde_Image</name>
	<range><ge>2.0.0</ge><lt>2.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael J Rubinsky reports:</p>
	<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
	<p>The fist vulnerability (CVE-2017-9774) is a Remote Code Execution
	vulnerability and is exploitable by a logged in user sending a
	maliciously crafted GET request to the Horde server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
	<cvename>CVE-2017-9774</cvename>
	</references>
	<dates>
	<discovery>2017-06-21</discovery>
	<entry>2017-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="9f65d382-56a4-11e7-83e3-080027ef73ec">
	<topic>OpenVPN -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>openvpn</name>
	<range><lt>2.3.17</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
	</package>
	<package>
	<name>openvpn-mbedtls</name>
	<range><lt>2.4.3</lt></range>
	</package>
	<package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samuli Seppänen reports:</p>
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243">
	<p>In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In
	the process he found several vulnerabilities and reported them to
	the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.</p>
	<p>This is a list of fixed important vulnerabilities:</p>
	<ul>
	<li>Remotely-triggerable ASSERT() on malformed IPv6 packet</li>
	<li>Pre-authentication remote crash/information disclosure for clients</li>
	<li>Potential double-free in --x509-alt-username</li>
	<li>Remote-triggerable memory leaks</li>
	<li>Post-authentication remote DoS when using the --x509-track option</li>
	<li>Null-pointer dereference in establish_http_proxy_passthru()</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243</url>
	<cvename>CVE-2017-7508</cvename>
	<cvename>CVE-2017-7512</cvename>
	<cvename>CVE-2017-7520</cvename>
	<cvename>CVE-2017-7521</cvename>
	<cvename>CVE-2017-7522</cvename>
	</references>
	<dates>
	<discovery>2017-05-19</discovery>
	<entry>2017-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="0c2db2aa-5584-11e7-9a7d-b499baebfeaf">
	<topic>Apache httpd -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache22</name>
	<range><lt>2.2.33</lt></range>
	</package>
	<package>
	<name>apache24</name>
	<range><lt>2.4.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache httpd project reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	<ul>
	<li>ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):<br/>
	Use of the ap_get_basic_auth_pw() by third-party modules outside
	of the authentication phase may lead to authentication requirements
	being bypassed.</li>
	<li>mod_ssl Null Pointer Dereference (CVE-2017-3169):<br/>mod_ssl may
	dereference a NULL pointer when third-party modules
	call ap_hook_process_connection() during an HTTP request to an HTTPS
	port.</li>
	<li>mod_http2 Null Pointer Dereference (CVE-2017-7659):<br/> A maliciously
	constructed HTTP/2 request could cause mod_http2 to dereference a NULL
	pointer and crash the server process.</li>
	<li>ap_find_token() Buffer Overread (CVE-2017-7668):<br/>The HTTP strict
	parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token
	list parsing, which allows ap_find_token() to search past the end of its
	input string. By maliciously crafting a sequence of request headers, an
	attacker may be able to cause a segmentation fault, or to force
	ap_find_token() to return an incorrect value.</li>
	<li>mod_mime Buffer Overread (CVE-2017-7679):<br/>mod_mime can read one
	byte past the end of a buffer when sending a malicious Content-Type
	response header.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
	<url>https://httpd.apache.org/security/vulnerabilities_22.html</url>
	<cvename>CVE-2017-3167</cvename>
	<cvename>CVE-2017-3169</cvename>
	<cvename>CVE-2017-7659</cvename>
	<cvename>CVE-2017-7668</cvename>
	<cvename>CVE-2017-7679</cvename>
	</references>
	<dates>
	<discovery>2017-06-20</discovery>
	<entry>2017-06-20</entry>
	</dates>
	</vuln>

	<vuln vid="f53dd5cc-527f-11e7-a772-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>59.0.3071.104</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html">
	<p>5 security fixes in this release, including:</p>
	<ul>
	<li>[725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by
	Ned Williamson on 2017-05-22</li>
	<li>[729991] High CVE-2017-5088: Out of bounds read in V8. Reported by
	Xiling Gong of Tencent Security Platform Department on 2017-06-06</li>
	<li>[714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by
	Michal Bentkowski on 2017-04-21</li>
	<li>[732498] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5087</cvename>
	<cvename>CVE-2017-5088</cvename>
	<cvename>CVE-2017-5089</cvename>
	<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html</url>
	</references>
	<dates>
	<discovery>2017-06-15</discovery>
	<entry>2017-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="9314058e-5204-11e7-b712-b1a44a034d72">
	<topic>cURL -- URL file scheme drive letter buffer overflow</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.53.0</ge><lt>7.54.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL security advisory:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20170614.html">
	<p>When libcurl is given either</p>
	<p>1. a file: URL that doesn't use two slashes following the colon, or</p>
	<p>2. is told that file is the default scheme to use for URLs without scheme</p>
	<p>... and the given path starts with a drive letter and libcurl is built for
	Windows or DOS, then libcurl would copy the path with a wrong offset, so that
	the end of the given path would write beyond the malloc buffer. Up to seven
	bytes too much.</p>
	<p>We are not aware of any exploit of this flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-9502</cvename>
	<url>https://curl.haxx.se/docs/adv_20170614.html</url>
	</references>
	<dates>
	<discovery>2017-06-14</discovery>
	<entry>2017-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="7a92e958-5207-11e7-8d7c-6805ca0b3d42">
	<topic>rt and dependent modules -- multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.13_1</lt></range>
	</package>
	<package>
	<name>rt44</name>
	<range><ge>4.4.0</ge><lt>4.4.1_1</lt></range>
	</package>
	<package>
	<name>p5-RT-Authen-ExternalAuth</name>
	<range><ge>0.9</ge><lt>0.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BestPractical reports:</p>
	<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html</url>
	<cvename>CVE-2015-7686</cvename>
	<cvename>CVE-2016-6127</cvename>
	<cvename>CVE-2017-5361</cvename>
	<cvename>CVE-2017-5943</cvename>
	<cvename>CVE-2017-5944</cvename>
	</references>
	<dates>
	<discovery>2017-06-15</discovery>
	<entry>2017-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="cd944b3f-51f6-11e7-b7b2-001c25e46b1d">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>26.0.0.126</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-17.html">
	<ul>
	<li>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2017-3075, CVE-2017-3081,
	CVE-2017-3083, CVE-2017-3084).</li>
	<li>These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2017-3076, CVE-2017-3077,
	CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-3075</cvename>
	<cvename>CVE-2017-3076</cvename>
	<cvename>CVE-2017-3077</cvename>
	<cvename>CVE-2017-3078</cvename>
	<cvename>CVE-2017-3079</cvename>
	<cvename>CVE-2017-3081</cvename>
	<cvename>CVE-2017-3082</cvename>
	<cvename>CVE-2017-3083</cvename>
	<cvename>CVE-2017-3084</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-17.html</url>
	</references>
	<dates>
	<discovery>2017-06-13</discovery>
	<entry>2017-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="6cec1b0a-da15-467d-8691-1dea392d4c8d">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>54.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>52.2.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>52.2.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5470</cvename>
	<cvename>CVE-2017-5471</cvename>
	<cvename>CVE-2017-5472</cvename>
	<cvename>CVE-2017-7749</cvename>
	<cvename>CVE-2017-7750</cvename>
	<cvename>CVE-2017-7751</cvename>
	<cvename>CVE-2017-7752</cvename>
	<cvename>CVE-2017-7754</cvename>
	<cvename>CVE-2017-7755</cvename>
	<cvename>CVE-2017-7756</cvename>
	<cvename>CVE-2017-7757</cvename>
	<cvename>CVE-2017-7758</cvename>
	<cvename>CVE-2017-7759</cvename>
	<cvename>CVE-2017-7760</cvename>
	<cvename>CVE-2017-7761</cvename>
	<cvename>CVE-2017-7762</cvename>
	<cvename>CVE-2017-7763</cvename>
	<cvename>CVE-2017-7764</cvename>
	<cvename>CVE-2017-7765</cvename>
	<cvename>CVE-2017-7766</cvename>
	<cvename>CVE-2017-7767</cvename>
	<cvename>CVE-2017-7768</cvename>
	<cvename>CVE-2017-7778</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/</url>
	</references>
	<dates>
	<discovery>2017-06-13</discovery>
	<entry>2017-06-13</entry>
	<modified>2017-09-19</modified>
	</dates>
	</vuln>

	<vuln vid="bce47c89-4d3f-11e7-8080-a4badb2f4699">
	<topic>roundcube -- arbitrary password resets</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>1.2.5,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Roundcube reports:</p>
	<blockquote cite="https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11">
	<p>Roundcube Webmail allows arbitrary password resets by
	authenticated users. The problem is caused by an improperly restricted
	exec call in the virtualmin and sasl drivers of the password plugin.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11</url>
	<cvename>CVE-2017-8114</cvename>
	</references>
	<dates>
	<discovery>2017-04-28</discovery>
	<entry>2017-06-09</entry>
	</dates>
	</vuln>

	<vuln vid="b33fb1e0-4c37-11e7-afeb-0011d823eebd">
	<topic>GnuTLS -- Denial of service vulnerability</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>3.5.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GnuTLS project reports:</p>
	<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2017-4">
	<p>It was found using the TLS fuzzer tools that decoding a status
	response TLS extension with valid contents could lead to a crash
	due to a null pointer dereference. The issue affects GnuTLS server
	applications.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://gnutls.org/security.html#GNUTLS-SA-2017-4</url>
	</references>
	<dates>
	<discovery>2017-06-07</discovery>
	<entry>2017-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="165e8951-4be0-11e7-a539-0050569f7e80">
	<topic>irssi -- remote DoS</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>1.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joseph Bisch reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_06.txt">
	<p>When receiving a DCC message without source nick/host, Irssi would
	attempt to dereference a NULL pointer.</p>
	<p>When receiving certain incorrectly quoted DCC files, Irssi would
	try to find the terminating quote one byte before the allocated
	memory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-9468</cvename>
	<cvename>CVE-2017-9469</cvename>
	<url>https://irssi.org/security/irssi_sa_2017_06.txt</url>
	</references>
	<dates>
	<discovery>2017-06-06</discovery>
	<entry>2017-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="52f4b48b-4ac3-11e7-99aa-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>59.0.3071.86</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html">
	<p>30 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5070</cvename>
	<cvename>CVE-2017-5071</cvename>
	<cvename>CVE-2017-5072</cvename>
	<cvename>CVE-2017-5073</cvename>
	<cvename>CVE-2017-5074</cvename>
	<cvename>CVE-2017-5075</cvename>
	<cvename>CVE-2017-5086</cvename>
	<cvename>CVE-2017-5076</cvename>
	<cvename>CVE-2017-5077</cvename>
	<cvename>CVE-2017-5078</cvename>
	<cvename>CVE-2017-5079</cvename>
	<cvename>CVE-2017-5080</cvename>
	<cvename>CVE-2017-5081</cvename>
	<cvename>CVE-2017-5082</cvename>
	<cvename>CVE-2017-5083</cvename>
	<cvename>CVE-2017-5085</cvename>
	<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-06-05</discovery>
	<entry>2017-06-06</entry>
	</dates>
	</vuln>

	<vuln vid="15a04b9f-47cb-11e7-a853-001fbc0f280f">
	<topic>ansible -- Input validation flaw in jinja2 templating system</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>2.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat security team reports:</p>
	<blockquote cite="https://access.redhat.com/security/cve/cve-2017-7481">
	<p>An input validation flaw was found in Ansible, where it fails to
	properly mark lookup-plugin results as unsafe. If an attacker could
	control the results of lookup() calls, they could inject Unicode
	strings to be parsed by the jinja2 templating system, result in
	code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://access.redhat.com/security/cve/cve-2017-7481</url>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481</url>
	</references>
	<dates>
	<discovery>2017-05-09</discovery>
	<entry>2017-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="738e8ae1-46dd-11e7-a539-0050569f7e80">
	<topic>duo -- Two-factor authentication bypass</topic>
	<affects>
	<package>
	<name>duo</name>
	<range><lt>1.9.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The duo security team reports:</p>
	<blockquote cite="https://duo.com/labs/psa/duo-psa-2017-002">
	<p>An untrusted user may be able to set the http_proxy variable to
	an invalid address. If this happens, this will trigger the
	configured 'failmode' behavior, which defaults to safe. Safe
	mode causes the authentication to report a success.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://duo.com/labs/psa/duo-psa-2017-002</url>
	</references>
	<dates>
	<discovery>2017-05-19</discovery>
	<entry>2017-06-01</entry>
	</dates>
	</vuln>

	<vuln vid="673dce46-46d0-11e7-a539-0050569f7e80">
	<topic>FreeRADIUS -- TLS resumption authentication bypass</topic>
	<affects>
	<package>
	<name>freeradius</name>
	<name>freeradius2</name>
	<name>freeradius3</name>
	<range><lt>3.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Winter reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q2/342">
	<p>The TLS session cache in FreeRADIUS before 3.0.14 fails to
	reliably prevent resumption of an unauthenticated session, which
	allows remote attackers (such as malicious 802.1X supplicants) to
	bypass authentication via PEAP or TTLS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-9148</cvename>
	<url>http://freeradius.org/security.html</url>
	<url>http://seclists.org/oss-sec/2017/q2/342</url>
	<url>http://www.securityfocus.com/bid/98734</url>
	</references>
	<dates>
	<discovery>2017-02-03</discovery>
	<entry>2017-06-01</entry>
	</dates>
	</vuln>

	<vuln vid="40a8d798-4615-11e7-8080-a4badb2f4699">
	<topic>heimdal -- bypass of capath policy</topic>
	<affects>
	<package>
	<name>heimdal</name>
	<range><lt>7.1.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Viktor Dukhovni reports:</p>
	<blockquote cite="https://www.h5l.org/advisories.html?show=2017-04-13">
	<p>Commit f469fc6 (2010-10-02) inadvertently caused the
	previous hop realm to not be added to the transit path of issued
	tickets. This may, in some cases, enable bypass of capath policy in
	Heimdal versions 1.5 through 7.2. Note, this may break sites that rely
	on the bug. With the bug some incomplete [capaths] worked, that should
	not have. These may now break authentication in some cross-realm
	configurations. (CVE-2017-6594)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>CVE-2017-6594</url>
	<freebsdpr>ports/219657</freebsdpr>
	</references>
	<dates>
	<discovery>2017-04-13</discovery>
	<entry>2017-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="51d1282d-420e-11e7-82c5-14dae9d210b8">
	<topic>FreeBSD -- ipfilter(4) fragment handling panic</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.0</ge><lt>11.0_10</lt></range>
	<range><ge>10.3</ge><lt>10.3_19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>ipfilter(4), capable of stateful packet inspection, using
	the "keep state" or "keep frags" rule options, will not
	only maintain the state of connections, such as TCP streams
	or UDP communication, it also maintains the state of
	fragmented packets. When a packet fragments are received
	they are cached in a hash table (and linked list). When a
	fragment is received it is compared with fragments already
	cached in the hash table for a match. If it does not match
	the new entry is used to create a new entry in the hash
	table. If on the other hand it does match, unfortunately
	the wrong entry is freed, the entry in the hash table. This
	results in use after free panic (and for a brief moment
	prior to the panic a memory leak due to the wrong entry
	being freed).</p>
	<h1>Impact:</h1>
	<p>Carefully feeding fragments that are allowed to pass by
	an ipfilter(4) firewall can be used to cause a panic followed
	by reboot loop denial of service attack.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1081</cvename>
	<freebsdsa>SA-17:04.ipfilter</freebsdsa>
	</references>
	<dates>
	<discovery>2017-04-27</discovery>
	<entry>2017-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="3c0237f5-420e-11e7-82c5-14dae9d210b8">
	<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_9</lt></range>
	<range><ge>10.3</ge><lt>10.3_18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A vulnerability was discovered in the NTP server's parsing
	of configuration directives. [CVE-2017-6464]</p>
	<p>A vulnerability was found in NTP, in the parsing of
	packets from the DPTS Clock. [CVE-2017-6462]</p>
	<p>A vulnerability was discovered in the NTP server's parsing
	of configuration directives. [CVE-2017-6463]</p>
	<p>A vulnerability was found in NTP, affecting the origin
	timestamp check function. [CVE-2016-9042]</p>
	<h1>Impact:</h1>
	<p>A remote, authenticated attacker could cause ntpd to
	crash by sending a crafted message. [CVE-2017-6463,
	CVE-2017-6464]</p>
	<p>A malicious device could send crafted messages, causing
	ntpd to crash. [CVE-2017-6462]</p>
	<p>An attacker able to spoof messages from all of the
	configured peers could send crafted packets to ntpd, causing
	later replies from those peers to be discarded, resulting
	in denial of service. [CVE-2016-9042]</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9042</cvename>
	<cvename>CVE-2017-6462</cvename>
	<cvename>CVE-2017-6463</cvename>
	<cvename>CVE-2017-6464</cvename>
	<freebsdsa>SA-17:03.ntp</freebsdsa>
	</references>
	<dates>
	<discovery>2017-04-12</discovery>
	<entry>2017-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="ec6aeb8e-41e4-11e7-aa00-5404a68ad561">
	<topic>vlc -- remote code execution via crafted subtitles</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>2.2.6,4</lt></range>
	</package>
	<package>
	<name>vlc-qt4</name>
	<range><lt>2.2.6,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Check Point research team reports:</p>
	<blockquote cite="http://blog.checkpoint.com/2017/05/23/hacked-in-translation/">
	<p>Remote code execution via crafted subtitles</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.checkpoint.com/2017/05/23/hacked-in-translation/</url>
	</references>
	<dates>
	<discovery>2017-05-23</discovery>
	<entry>2017-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="803879e9-4195-11e7-9b08-080027ef73ec">
	<topic>OpenEXR -- multiple remote code execution and denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>OpenEXR</name>
	<range><lt>2.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Brandon Perry reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/05/12/5">
	<p>[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).</p>
	<ul>
	<li>CVE-2017-9110
	In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.</li>
	<li>CVE-2017-9111
	In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.</li>
	<li>CVE-2017-9112
	In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.</li>
	<li>CVE-2017-9113
	In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.</li>
	<li>CVE-2017-9114
	In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.</li>
	<li>CVE-2017-9115
	In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.</li>
	<li>CVE-2017-9116
	In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2017/05/12/5</url>
	<cvename>CVE-2017-9110</cvename>
	<cvename>CVE-2017-9111</cvename>
	<cvename>CVE-2017-9112</cvename>
	<cvename>CVE-2017-9113</cvename>
	<cvename>CVE-2017-9114</cvename>
	<cvename>CVE-2017-9115</cvename>
	<cvename>CVE-2017-9116</cvename>
	<url>https://github.com/openexr/openexr/issues/232</url>
	</references>
	<dates>
	<discovery>2017-01-12</discovery>
	<entry>2017-05-25</entry>
	</dates>
	</vuln>

	<vuln vid="50776801-4183-11e7-b291-b499baebfeaf">
	<topic>ImageMagick -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.6.4_2,1</lt></range>
	<range><ge>6.9.7.0,1</ge><lt>6.9.8.8,1</lt></range>
	</package>
	<package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.5.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://nvd.nist.gov/vuln/search/results?query=ImageMagick">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nvd.nist.gov/vuln/search/results?query=ImageMagick</url>
	<cvename>CVE-2017-5506</cvename>
	<cvename>CVE-2017-5507</cvename>
	<cvename>CVE-2017-5508</cvename>
	<cvename>CVE-2017-5509</cvename>
	<cvename>CVE-2017-5510</cvename>
	<cvename>CVE-2017-5511</cvename>
	<cvename>CVE-2017-6497</cvename>
	<cvename>CVE-2017-6498</cvename>
	<cvename>CVE-2017-6499</cvename>
	<cvename>CVE-2017-6500</cvename>
	<cvename>CVE-2017-6501</cvename>
	<cvename>CVE-2017-6502</cvename>
	<cvename>CVE-2017-7275</cvename>
	<cvename>CVE-2017-7606</cvename>
	<cvename>CVE-2017-7619</cvename>
	<cvename>CVE-2017-7941</cvename>
	<cvename>CVE-2017-7942</cvename>
	<cvename>CVE-2017-7943</cvename>
	<cvename>CVE-2017-8343</cvename>
	<cvename>CVE-2017-8344</cvename>
	<cvename>CVE-2017-8345</cvename>
	<cvename>CVE-2017-8346</cvename>
	<cvename>CVE-2017-8347</cvename>
	<cvename>CVE-2017-8348</cvename>
	<cvename>CVE-2017-8349</cvename>
	<cvename>CVE-2017-8350</cvename>
	<cvename>CVE-2017-8351</cvename>
	<cvename>CVE-2017-8352</cvename>
	<cvename>CVE-2017-8353</cvename>
	<cvename>CVE-2017-8354</cvename>
	<cvename>CVE-2017-8355</cvename>
	<cvename>CVE-2017-8356</cvename>
	<cvename>CVE-2017-8357</cvename>
	<cvename>CVE-2017-8765</cvename>
	<cvename>CVE-2017-8830</cvename>
	<cvename>CVE-2017-9141</cvename>
	<cvename>CVE-2017-9142</cvename>
	<cvename>CVE-2017-9143</cvename>
	<cvename>CVE-2017-9144</cvename>
	</references>
	<dates>
	<discovery>2017-03-05</discovery>
	<entry>2017-05-25</entry>
	<modified>2017-05-29</modified>
	</dates>
	</vuln>

	<vuln vid="6f4d96c0-4062-11e7-b291-b499baebfeaf">
	<topic>samba -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>samba42</name>
	<range><lt>4.2.15</lt></range>
	</package>
	<package>
	<name>samba43</name>
	<range><lt>4.3.14</lt></range>
	</package>
	<package>
	<name>samba44</name>
	<range><lt>4.4.14</lt></range>
	</package>
	<package>
	<name>samba45</name>
	<range><lt>4.5.10</lt></range>
	</package>
	<package>
	<name>samba46</name>
	<range><lt>4.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The samba project reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2017-7494.html">
	<p>Remote code execution from a writable share.</p>
	<p>All versions of Samba from 3.5.0 onwards are vulnerable to a remote
	code execution vulnerability, allowing a malicious client to upload
	a shared library to a writable share, and then cause the server to
	load and execute it.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.samba.org/samba/security/CVE-2017-7494.html</url>
	<cvename>CVE-2017-7494</cvename>
	</references>
	<dates>
	<discovery>2017-05-24</discovery>
	<entry>2017-05-24</entry>
	</dates>
	</vuln>

	<vuln vid="f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21">
	<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
	<affects>
	<package>
	<name>nvidia-driver</name>
	<range><lt>375.66</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVIDIA Unix security team reports:</p>
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4462">
	<p>NVIDIA GPU Display Driver contains vulnerabilities in the
	kernel mode layer handler where not correctly validated user
	input, NULL pointer dereference, and incorrect access control
	may lead to denial of service or potential escalation of
	privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-0350</cvename>
	<cvename>CVE-2017-0351</cvename>
	<cvename>CVE-2017-0352</cvename>
	<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4462</url>
	</references>
	<dates>
	<discovery>2017-05-15</discovery>
	<entry>2017-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="da1d5d2e-3eca-11e7-8861-0018fe623f2b">
	<topic>miniupnpc -- integer signedness error</topic>
	<affects>
	<package>
	<name>miniupnpc</name>
	<range><lt>2.0.20170509</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tintinweb reports:</p>
	<blockquote cite="https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798">
	<p>An integer signedness error was found in miniupnp's miniwget
	allowing an unauthenticated remote entity typically located on the
	local network segment to trigger a heap corruption or an access
	violation in miniupnp's http response parser when processing a
	specially crafted chunked-encoded response to a request for the
	xml root description url.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-8798</cvename>
	<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798</url>
	</references>
	<dates>
	<discovery>2017-05-09</discovery>
	<entry>2017-05-22</entry>
	</dates>
	</vuln>

	<vuln vid="a5bb7ea0-3e58-11e7-94a2-00e04c1ea73d">
	<topic>Wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.7.5,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://wordpress.org/news/2017/05/wordpress-4-7-5/">
	<p>WordPress versions 4.7.4 and earlier are affected by six security issues</p>
	<ul>
	<li>Insufficient redirect validation in the HTTP class.</li>
	<li>Improper handling of post meta data values in the XML-RPC API.</li>
	<li>Lack of capability checks for post meta data in the XML-RPC API.</li>
	<li>A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.</li>
	<li>A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2017/05/wordpress-4-7-5/</url>
	</references>
	<dates>
	<discovery>2017-05-16</discovery>
	<entry>2017-05-21</entry>
	</dates>
	</vuln>

	<vuln vid="fab87bff-3ce5-11e7-bf9d-001999f8d30b">
	<topic>asterisk -- Memory exhaustion on short SCCP packets</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.15.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>A remote memory exhaustion can be triggered by sending
	an SCCP packet to Asterisk system with "chan_skinny"
	enabled that is larger than the length of the SCCP header
	but smaller than the packet length specified in the header.
	The loop that reads the rest of the packet doesn't detect
	that the call to read() returned end-of-file before the
	expected number of bytes and continues infinitely. The
	"partial data" message logging in that tight loop causes
	Asterisk to exhaust all available memory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2017-004.html</url>
	</references>
	<dates>
	<discovery>2017-04-13</discovery>
	<entry>2017-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="0537afa3-3ce0-11e7-bf9d-001999f8d30b">
	<topic>asterisk -- Buffer Overrun in PJSIP transaction layer</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.15.1</lt></range>
	</package>
	<package>
	<name>pjsip</name>
	<range><lt>2.6_1</lt></range>
	</package>
	<package>
	<name>pjsip-extsrtp</name>
	<range><lt>2.6_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>A remote crash can be triggered by sending a SIP packet
	to Asterisk with a specially crafted CSeq header and a
	Via header with no branch parameter. The issue is that
	the PJSIP RFC 2543 transaction key generation algorithm
	does not allocate a large enough buffer. By overrunning
	the buffer, the memory allocation table becomes corrupted,
	leading to an eventual crash.</p>
	<p>The multi-part body parser in PJSIP contains a logical
	error that can make certain multi-part body parts attempt
	to read memory from outside the allowed boundaries. A
	specially-crafted packet can trigger these invalid reads
	and potentially induce a crash.</p>
	<p>This issues is in PJSIP, and so the issue can be fixed
	without performing an upgrade of Asterisk at all. However,
	we are releasing a new version of Asterisk with the bundled
	PJProject updated to include the fix.</p>
	<p>If you are running Asterisk with chan_sip, this issue
	does not affect you.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2017-002.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2017-003.html</url>
	</references>
	<dates>
	<discovery>2017-04-12</discovery>
	<entry>2017-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="3c2549b3-3bed-11e7-a9f0-a4badb296695">
	<topic>Joomla3 -- SQL Injection</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><eq>3.7.0</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>JSST reports:</p>
	<blockquote cite="https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html">
	<p>Inadequate filtering of request data leads to a SQL Injection vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-8917</cvename>
	<url>https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html</url>
	</references>
	<dates>
	<discovery>2017-05-11</discovery>
	<entry>2017-05-18</entry>
	</dates>
	</vuln>

	<vuln vid="9704930c-3bb7-11e7-93f7-d43d7e971a1b">
	<topic>gitlab -- Various security issues</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>6.6.0</ge><le>8.17.5</le></range>
	<range><ge>9.0.0</ge><le>9.0.6</le></range>
	<range><ge>9.1.0</ge><le>9.1.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/</url>
	</references>
	<dates>
	<discovery>2017-05-08</discovery>
	<entry>2017-05-18</entry>
	<modified>2017-05-30</modified>
	</dates>
	</vuln>

	<vuln vid="5d62950f-3bb5-11e7-93f7-d43d7e971a1b">
	<topic>gitlab -- Various security issues</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>8.7.0</ge><le>8.15.7</le></range>
	<range><ge>8.16.0</ge><le>8.16.7</le></range>
	<range><ge>8.17.0</ge><le>8.17.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/">
	<h1>Information Disclosure in Issue and Merge Request Trackers</h1>
	<p>During an internal code review a critical vulnerability in the GitLab
	Issue and Merge Request trackers was discovered. This vulnerability could
	allow a user with access to assign ownership of an issue or merge request to
	another user to disclose that user's private token, email token, email
	address, and encrypted OTP secret. Reporter-level access to a GitLab project
	is required to exploit this flaw.</p>
	<h1>SSRF when importing a project from a Repo by URL</h1>
	<p>GitLab instances that have enabled project imports using "Repo by URL"
	were vulnerable to Server-Side Request Forgery attacks. By specifying a
	project import URL of localhost an attacker could target services that are
	bound to the local interface of the server. These services often do not
	require authentication. Depending on the service an attacker might be able
	craft an attack using the project import request URL.</p>
	<h1>Links in Environments tab vulnerable to tabnabbing</h1>
	<p>edio via HackerOne reported that user-configured Environment links
	include target=_blank but do not also include rel: noopener
	noreferrer. Anyone clicking on these links may therefore be subjected to
	tabnabbing attacks where a link back to the requesting page is maintained
	and can be manipulated by the target server.</p>
	<h1>Accounts with email set to "Do not show on profile" have addresses
	exposed in public atom feed</h1>
	<p>Several GitLab users reported that even with "Do not show on profile"
	configured for their email addresses those addresses were still being leaked
	in Atom feeds if they commented on a public project.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-0882</cvename>
	<url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
	</references>
	<dates>
	<discovery>2017-03-20</discovery>
	<entry>2017-05-18</entry>
	<modified>2017-05-30</modified>
	</dates>
	</vuln>

	<vuln vid="4a088d67-3af2-11e7-9d75-c86000169601">
	<topic>freetype2 -- buffer overflows</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Lemberg reports:</p>
	<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html">
	<p>CVE-2017-8105, CVE-2017-8287: Older FreeType versions have
	out-of-bounds writes caused by heap-based buffer overflows
	related to Type 1 fonts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html</url>
	<cvename>CVE-2017-8105</cvename>
	<cvename>CVE-2017-8287</cvename>
	</references>
	<dates>
	<discovery>2017-05-17</discovery>
	<entry>2017-05-17</entry>
	</dates>
	</vuln>

	<vuln vid="04cc7bd2-3686-11e7-aa64-080027ef73ec">
	<topic>OpenVPN -- two remote denial-of-service vulnerabilities</topic>
	<affects>
	<package>
	<name>openvpn</name>
	<range><lt>2.3.15</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
	</package>
	<package>
	<name>openvpn23</name>
	<range><lt>2.3.15</lt></range>
	</package>
	<package>
	<name>openvpn-mbedtls</name>
	<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
	</package>
	<package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.15</lt></range>
	</package>
	<package>
	<name>openvpn23-polarssl</name>
	<range><lt>2.3.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samuli Seppänen reports:</p>
	<blockquote cite="https://openvpn.net/index.php/open-source/downloads.html">
	<p>OpenVPN v2.4.0 was audited for security vulnerabilities independently by
	Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by
	Private Internet Access) between December 2016 and April 2017. The
	primary findings were two remote denial-of-service vulnerabilities.
	Fixes to them have been backported to v2.3.15.</p>
	<p>An authenticated client can do the 'three way handshake'
	(P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet
	is the first that is allowed to carry payload. If that payload is
	too big, the OpenVPN server process will stop running due to an
	ASSERT() exception. That is also the reason why servers using
	tls-auth/tls-crypt are protected against this attack - the P_CONTROL
	packet is only accepted if it contains the session ID we specified,
	with a valid HMAC (challenge-response). (CVE-2017-7478)</p>
	<p>An authenticated client can cause the server's the packet-id
	counter to roll over, which would lead the server process to hit an
	ASSERT() and stop running. To make the server hit the ASSERT(), the
	client must first cause the server to send it 2^32 packets (at least
	196 GB).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://openvpn.net/index.php/open-source/downloads.html</url>
	<cvename>CVE-2017-7478</cvename>
	<cvename>CVE-2017-7479</cvename>
	<url>https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits</url>
	<url>https://ostif.org/?p=870&preview=true</url>
	<url>https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/</url>
	</references>
	<dates>
	<discovery>2017-05-10</discovery>
	<entry>2017-05-11</entry>
	</dates>
	</vuln>

	<vuln vid="414c18bf-3653-11e7-9550-6cc21735f730">
	<topic>PostgreSQL vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql92-client</name>
	<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
	</package>
	<package>
	<name>postgresql93-client</name>
	<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
	</package>
	<package>
	<name>postgresql94-client</name>
	<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
	</package>
	<package>
	<name>postgresql95-client</name>
	<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
	</package>
	<package>
	<name>postgresql96-client</name>
	<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
	</package>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
	</package>
	<package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1746/">
	<p>
	Security Fixes nested CASE expressions +
	database and role names with embedded special characters
	</p>
	<ul>
	<li>CVE-2017-7484: selectivity estimators bypass SELECT privilege
	checks.
	</li>
	<li>CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
	</li>
	<li>CVE-2017-7486: pg_user_mappings view discloses foreign server
	passwords. This applies to new databases, see the release notes for
	the procedure to apply the fix to an existing database.
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5423</cvename>
	<cvename>CVE-2016-5424</cvename>
	</references>
	<dates>
	<discovery>2017-05-11</discovery>
	<entry>2017-05-11</entry>
	</dates>
	</vuln>

	<vuln vid="0baee383-356c-11e7-b9a9-50e549ebab6c">
	<topic>kauth: Local privilege escalation</topic>
	<affects>
	<package>
	<name>kdelibs</name>
	<range><lt>4.14.30_4</lt></range>
	</package>
	<package>
	<name>kf5-kauth</name>
	<range><lt>5.33.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Astals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20170510-1.txt">
	<p>KAuth contains a logic flaw in which the service invoking dbus
	is not properly checked.
	This allows spoofing the identity of the caller and with some
	carefully crafted calls can lead to gaining root from an
	unprivileged account.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-8422</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2017/05/10/3</mlist>
	<url>https://www.kde.org/info/security/advisory-20170510-1.txt</url>
	</references>
	<dates>
	<discovery>2017-05-10</discovery>
	<entry>2017-05-10</entry>
	</dates>
	</vuln>

	<vuln vid="57600032-34fe-11e7-8965-bcaec524bf84">
	<topic>libetpan -- null dereference vulnerability in MIME parsing component</topic>
	<affects>
	<package>
	<name>libetpan</name>
	<range><lt>1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>rwhitworth reports:</p>
	<blockquote cite="https://github.com/dinhviethoa/libetpan/issues/274">
	<p>I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the
	mime-parse test program. Is fixing these crashes something you're
	interested in? The input files can be found here:
	https://github.com/rwhitworth/libetpan-fuzz/.

	The files can be executed as ./mime-parse id_filename to cause
	seg faults.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-8825</cvename>
	<url>http://cve.circl.lu/cve/CVE-2017-8825</url>
	</references>
	<dates>
	<discovery>2017-04-29</discovery>
	<entry>2017-05-09</entry>
	</dates>
	</vuln>

	<vuln vid="92e345d0-304d-11e7-8359-e8e0b747a45a">
	<topic>chromium -- race condition vulnerability</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>58.0.3029.96</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html">
	<p>1 security fix in this release:</p>
	</blockquote>
	<ul>
	<li>[679306] High CVE-2017-5068: Race condition in WebRTC. Credit to
	Philipp Hancke</li>
	</ul>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5068</cvename>
	<url>https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-05-02</discovery>
	<entry>2017-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="a8c8001b-216c-11e7-80aa-005056925db4">
	<topic>dovecot -- Dovecot DoS when passdb dict was used for authentication</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<name>dovecot2</name>
	<range><gt>2.2.25_6</gt><lt>2.2.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timo Sirainen reports:</p>
	<blockquote cite="https://dovecot.org/list/dovecot-news/2017-April/000341.html">
	<p>passdb/userdb dict: Don't double-expand %variables in keys. If dict
	was used as the authentication passdb, using specially crafted
	%variables in the username could be used to cause DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2669</cvename>
	<mlist>https://dovecot.org/list/dovecot-news/2017-April/000341.html</mlist>
	<mlist>https://dovecot.org/list/dovecot-news/2017-April/000342.html</mlist>
	</references>
	<dates>
	<discovery>2016-12-01</discovery>
	<entry>2017-04-30</entry>
	</dates>
	</vuln>

	<vuln vid="24673ed7-2bf3-11e7-b291-b499baebfeaf">
	<topic>LibreSSL -- TLS verification vulnerability</topic>
	<affects>
	<package>
	<name>libressl</name>
	<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
	</package>
	<package>
	<name>libressl-devel</name>
	<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> Jakub Jirutka reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q2/145">
	<p>LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if
	SSL_get_verify_result is relied upon for a later check of a
	verification result, in a use case where a user-provided verification
	callback returns 1, as demonstrated by acceptance of invalid
	certificates by nginx.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2017/q2/145</url>
	<url>https://github.com/libressl-portable/portable/issues/307</url>
	<cvename>CVE-2017-8301</cvename>
	</references>
	<dates>
	<discovery>2017-04-27</discovery>
	<entry>2017-04-28</entry>
	</dates>
	</vuln>

	<vuln vid="631c4710-9be5-4a80-9310-eb2847fe24dd">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.57</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.46.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://jenkins.io/security/advisory/2017-04-26/">
	<h1>Description</h1>
	<h5>SECURITY-412 through SECURITY-420 / CVE-2017-1000356</h5>
	<p>CSRF: Multiple vulnerabilities</p>
	<h5>SECURITY-429 / CVE-2017-1000353</h5>
	<p>CLI: Unauthenticated remote code execution</p>
	<h5>SECURITY-466 / CVE-2017-1000354</h5>
	<p>CLI: Login command allowed impersonating any Jenkins user</p>
	<h5>SECURITY-503 / CVE-2017-1000355</h5>
	<p>XStream: Java crash when trying to instantiate void/Void</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-1000356</cvename>
	<cvename>CVE-2017-1000353</cvename>
	<cvename>CVE-2017-1000354</cvename>
	<cvename>CVE-2017-1000355</cvename>
	<url>https://jenkins.io/security/advisory/2017-04-26/</url>
	</references>
	<dates>
	<discovery>2017-04-26</discovery>
	<entry>2017-04-27</entry>
	</dates>
	</vuln>

	<vuln vid="df0144fb-295e-11e7-970f-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>3.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	<p>Fixed a header injection vulnerability in common function
	set_status_header() under Apache (thanks to Guillermo Caminer from
	Flowgate).</p>
	<p>Fixed byte-safety issues in Encrypt Library (DEPRECATED) when
	mbstring.func_overload is enabled.</p>
	<p>Fixed byte-safety issues in Encryption Library when
	mbstring.func_overload is enabled.</p>
	<p>Fixed byte-safety issues in compatibility functions
	password_hash(), hash_pbkdf2() when mbstring.func_overload is
	enabled.</p>
	<p>Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv()
	with MCRYPT_DEV_URANDOM.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.codeigniter.com/user_guide/changelog.html</url>
	</references>
	<dates>
	<discovery>2017-03-23</discovery>
	<entry>2017-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="81433129-2916-11e7-ad3e-00e04c1ea73d">
	<topic>weechat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>weechat</name>
	<range><lt>1.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Common Vulnerabilities and Exposures:</p>
	<blockquote cite="https://weechat.org/download/security/">
	<p>WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to
	the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes
	function during quote removal, with a buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://weechat.org/download/security/</url>
	<cvename>CVE-2017-8073</cvename>
	</references>
	<dates>
	<discovery>2017-04-23</discovery>
	<entry>2017-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="1455c86c-26c2-11e7-9daa-6cf0497db129">
	<topic>drupal8 -- Drupal Core - Critical - Access Bypass</topic>
	<affects>
	<package>
	<name>drupal8</name>
	<range><lt>8.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team Reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2017-002">
	<p>CVE-2017-6919: Access bypass</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6919</cvename>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="95a74a48-2691-11e7-9e2d-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>58.0.3029.81</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html">
	<p>29 security fixes in this release, including:</p>
	<ul>
	<li>[695826] High CVE-2017-5057: Type confusion in PDFium. Credit to
	Guang Gong of Alpha Team, Qihoo 360</li>
	<li>[694382] High CVE-2017-5058: Heap use after free in Print Preview.
	Credit to Khalil Zhani</li>
	<li>[684684] High CVE-2017-5059: Type confusion in Blink. Credit to
	SkyLined working with Trend Micro's Zero Day Initiative</li>
	<li>[683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to
	Xudong Zheng</li>
	<li>[672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to
	Haosheng Wang (@gnehsoah)</li>
	<li>[702896] Medium CVE-2017-5062: Use after free in Chrome Apps.
	Credit to anonymous</li>
	<li>[700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to
	Sweetchip</li>
	<li>[693974] Medium CVE-2017-5064: Use after free in Blink. Credit to
	Wadih Matar</li>
	<li>[704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to
	Khalil Zhani</li>
	<li>[690821] Medium CVE-2017-5066: Incorrect signature handing in Networking.
	Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen
	(ICTT, Xidian University)</li>
	<li>[648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to
	Khalil Zhani</li>
	<li>[691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to
	Michael Reizelman</li>
	<li>[713205] Various fixes from internal audits, fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5057</cvename>
	<cvename>CVE-2017-5058</cvename>
	<cvename>CVE-2017-5059</cvename>
	<cvename>CVE-2017-5060</cvename>
	<cvename>CVE-2017-5061</cvename>
	<cvename>CVE-2017-5062</cvename>
	<cvename>CVE-2017-5063</cvename>
	<cvename>CVE-2017-5064</cvename>
	<cvename>CVE-2017-5065</cvename>
	<cvename>CVE-2017-5066</cvename>
	<cvename>CVE-2017-5067</cvename>
	<cvename>CVE-2017-5069</cvename>
	<url>https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="607f8b57-7454-42c6-a88a-8706f327076d">
	<topic>icu -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>icu</name>
	<range><lt>58.2_2,1</lt></range>
	</package>
	<package>
	<name>linux-c6-icu</name>
	<name>linux-c7-icu</name>
	<range><lt>59.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7867">
	<p>International Components for Unicode (ICU) for C/C++
	before 2017-02-13 has an out-of-bounds write caused by a
	heap-based buffer overflow related to the utf8TextAccess
	function in common/utext.cpp and the utext_setNativeIndex*
	function.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7868">
	<p>International Components for Unicode (ICU) for C/C++
	before 2017-02-13 has an out-of-bounds write caused by a
	heap-based buffer overflow related to the utf8TextAccess
	function in common/utext.cpp and the utext_moveIndex32*
	function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7867</cvename>
	<cvename>CVE-2017-7868</cvename>
	<url>http://bugs.icu-project.org/trac/changeset/39671</url>
	<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437</url>
	</references>
	<dates>
	<discovery>2017-01-21</discovery>
	<entry>2017-04-20</entry>
	<modified>2017-05-04</modified>
	</dates>
	</vuln>

	<vuln vid="2a96e498-3234-4950-a9ad-419bc84a839d">
	<topic>tiff -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tiff</name>
	<name>linux-f8-tiff</name>
	<name>linux-f10-tiff</name>
	<name>linux-c6-tiff</name>
	<name>linux-c7-tiff</name>
	<range><lt>4.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-5225">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5225</cvename>
	<cvename>CVE-2017-7592</cvename>
	<cvename>CVE-2017-7593</cvename>
	<cvename>CVE-2017-7594</cvename>
	<cvename>CVE-2017-7595</cvename>
	<cvename>CVE-2017-7596</cvename>
	<cvename>CVE-2017-7597</cvename>
	<cvename>CVE-2017-7598</cvename>
	<cvename>CVE-2017-7599</cvename>
	<cvename>CVE-2017-7600</cvename>
	<cvename>CVE-2017-7601</cvename>
	<cvename>CVE-2017-7602</cvename>
	<url>https://github.com/vadz/libtiff/commit/5c080298d59e</url>
	<url>https://github.com/vadz/libtiff/commit/48780b4fcc42</url>
	<url>https://github.com/vadz/libtiff/commit/d60332057b95</url>
	<url>https://github.com/vadz/libtiff/commit/2ea32f7372b6</url>
	<url>https://github.com/vadz/libtiff/commit/8283e4d1b7e5</url>
	<url>https://github.com/vadz/libtiff/commit/47f2fb61a3a6</url>
	<url>https://github.com/vadz/libtiff/commit/3cfd62d77c2a</url>
	<url>https://github.com/vadz/libtiff/commit/3144e57770c1</url>
	<url>https://github.com/vadz/libtiff/commit/0a76a8c765c7</url>
	<url>https://github.com/vadz/libtiff/commit/66e7bd595209</url>
	</references>
	<dates>
	<discovery>2017-04-01</discovery>
	<entry>2017-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="d44129d6-b22e-4e9c-b200-6a46e8bd3e60">
	<topic>libsamplerate -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libsamplerate</name>
	<name>linux-c6-libsamplerate</name>
	<name>linux-c7-libsamplerate</name>
	<range><lt>0.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7697">
	<p>In libsamplerate before 0.1.9, a buffer over-read
	occurs in the calc_output_single function in src_sinc.c
	via a crafted audio file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7697</cvename>
	<url>https://github.com/erikd/libsamplerate/commit/c3b66186656d</url>
	</references>
	<dates>
	<discovery>2017-04-11</discovery>
	<entry>2017-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="5a97805e-93ef-4dcb-8d5e-dbcac263bfc2">
	<topic>libsndfile -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><lt>1.0.28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7585">
	<p>In libsndfile before 1.0.28, an error in the
	"flac_buffer_copy()" function (flac.c) can be exploited to
	cause a stack-based buffer overflow via a specially crafted
	FLAC file.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7586">
	<p>In libsndfile before 1.0.28, an error in the
	"header_read()" function (common.c) when handling ID3 tags
	can be exploited to cause a stack-based buffer overflow
	via a specially crafted FLAC file.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7741">
	<p>In libsndfile before 1.0.28, an error in the
	"flac_buffer_copy()" function (flac.c) can be exploited to
	cause a segmentation violation (with write memory access)
	via a specially crafted FLAC file during a resample
	attempt, a similar issue to CVE-2017-7585.</p>
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7742">
	<p>In libsndfile before 1.0.28, an error in the
	"flac_buffer_copy()" function (flac.c) can be exploited to
	cause a segmentation violation (with read memory access)
	via a specially crafted FLAC file during a resample
	attempt, a similar issue to CVE-2017-7585.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7585</cvename>
	<cvename>CVE-2017-7586</cvename>
	<cvename>CVE-2017-7741</cvename>
	<cvename>CVE-2017-7742</cvename>
	<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
	<url>https://github.com/erikd/libsndfile/commit/708e996c87c5</url>
	<url>https://github.com/erikd/libsndfile/commit/f457b7b5ecfe</url>
	<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
	</references>
	<dates>
	<discovery>2017-04-07</discovery>
	<entry>2017-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="3e2e9b44-25ce-11e7-a175-939b30e0836d">
	<topic>cURL -- TLS session resumption client cert bypass (again)</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.52.0</ge><lt>7.54.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL security advisory:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20170419.html">
	<p>libcurl would attempt to resume a TLS session even if the client
	certificate had changed. That is unacceptable since a server by
	specification is allowed to skip the client certificate check on
	resume, and may instead use the old identity which was established
	by the previous certificate (or no certificate).</p>
	<p>libcurl supports by default the use of TLS session id/ticket to
	resume previous TLS sessions to speed up subsequent TLS handshakes.
	They are used when for any reason an existing TLS connection
	couldn't be kept alive to make the next handshake faster.</p>
	<p>This flaw is a regression and identical to CVE-2016-5419 reported
	on August 3rd 2016, but affecting a different version range.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7468</cvename>
	<url>https://curl.haxx.se/docs/adv_20170419.html</url>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="cf133acc-82e7-4755-a66a-5ddf90dacbe6">
	<topic>graphite2 -- out-of-bounds write with malicious font</topic>
	<affects>
	<package>
	<name>graphite2</name>
	<range><lt>1.3.9_1</lt></range>
	</package>
	<package>
	<name>linux-c7-graphite2</name>
	<range><lt>1.3.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	<p>An out-of-bounds write in the Graphite 2 library
	triggered with a maliciously crafted Graphite font. This
	results in a potentially exploitable crash. This issue was
	fixed in the Graphite 2 library as well as Mozilla
	products.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5436</cvename>
	<url>https://github.com/silnrsi/graphite/commit/1ce331d5548b</url>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-04-19</entry>
	<modified>2017-04-20</modified>
	</dates>
	</vuln>

	<vuln vid="b8ee7a81-a879-4358-9b30-7dd1bd4c14b1">
	<topic>libevent -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libevent</name>
	<name>libevent2</name>
	<name>linux-c6-libevent2</name>
	<name>linux-c7-libevent</name>
	<range><lt>2.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Security reports:</p>
	<blockquote cite="https://security-tracker.debian.org/tracker/DSA-3789-1">
	<p>CVE-2016-10195: The name_parse function in evdns.c in
	libevent before 2.1.6-beta allows remote attackers to have
	unspecified impact via vectors involving the label_len
	variable, which triggers an out-of-bounds stack read.</p>
	<p>CVE-2016-10196: Stack-based buffer overflow in the
	evutil_parse_sockaddr_port function in evutil.c in libevent
	before 2.1.6-beta allows attackers to cause a denial of
	service (segmentation fault) via vectors involving a long
	string in brackets in the ip_as_string argument.</p>
	<p>CVE-2016-10197: The search_make_new function in evdns.c
	in libevent before 2.1.6-beta allows attackers to cause a
	denial of service (out-of-bounds read) via an empty
	hostname.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10195</cvename>
	<cvename>CVE-2016-10196</cvename>
	<cvename>CVE-2016-10197</cvename>
	<url>http://www.openwall.com/lists/oss-security/2017/01/31/17</url>
	<url>https://github.com/libevent/libevent/issues/317</url>
	<url>https://github.com/libevent/libevent/issues/318</url>
	<url>https://github.com/libevent/libevent/issues/332</url>
	<url>https://github.com/libevent/libevent/issues/335</url>
	</references>
	<dates>
	<discovery>2017-01-31</discovery>
	<entry>2017-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="4cb165f0-6e48-423e-8147-92255d35c0f7">
	<topic>NSS -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nss</name>
	<name>linux-f10-nss</name>
	<name>linux-c6-nss</name>
	<name>linux-c7-nss</name>
	<range><ge>3.30</ge><lt>3.30.1</lt></range>
	<range><ge>3.29</ge><lt>3.29.5</lt></range>
	<range><ge>3.22</ge><lt>3.28.4</lt></range>
	<range><lt>3.21.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	<p>An out-of-bounds write during Base64 decoding operation
	in the Network Security Services (NSS) library due to
	insufficient memory being allocated to the buffer. This
	results in a potentially exploitable crash. The NSS library
	has been updated to fix this issue to address this issue and
	Firefox 53 has been updated with NSS version 3.29.5.</p>
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	<p>A flaw in DRBG number generation within the Network
	Security Services (NSS) library where the internal state V
	does not correctly carry bits over. The NSS library has been
	updated to fix this issue to address this issue and Firefox
	53 has been updated with NSS version 3.29.5.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5461</cvename>
	<cvename>CVE-2017-5462</cvename>
	<url>https://hg.mozilla.org/projects/nss/rev/99a86619eac9</url>
	<url>https://hg.mozilla.org/projects/nss/rev/e126381a3c29</url>
	</references>
	<dates>
	<discovery>2017-03-17</discovery>
	<entry>2017-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="5e0a038a-ca30-416d-a2f5-38cbf5e7df33">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>53.0_2,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><ge>46.0,1</ge><lt>52.1.0_2,1</lt></range>
	<range><lt>45.9.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><ge>46.0,2</ge><lt>52.1.0,2</lt></range>
	<range><lt>45.9.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><ge>46.0</ge><lt>52.1.0</lt></range>
	<range><lt>45.9.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>46.0</ge><lt>52.1.0</lt></range>
	<range><lt>45.9.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5433</cvename>
	<cvename>CVE-2017-5435</cvename>
	<cvename>CVE-2017-5436</cvename>
	<cvename>CVE-2017-5461</cvename>
	<cvename>CVE-2017-5459</cvename>
	<cvename>CVE-2017-5466</cvename>
	<cvename>CVE-2017-5434</cvename>
	<cvename>CVE-2017-5432</cvename>
	<cvename>CVE-2017-5460</cvename>
	<cvename>CVE-2017-5438</cvename>
	<cvename>CVE-2017-5439</cvename>
	<cvename>CVE-2017-5440</cvename>
	<cvename>CVE-2017-5441</cvename>
	<cvename>CVE-2017-5442</cvename>
	<cvename>CVE-2017-5464</cvename>
	<cvename>CVE-2017-5443</cvename>
	<cvename>CVE-2017-5444</cvename>
	<cvename>CVE-2017-5446</cvename>
	<cvename>CVE-2017-5447</cvename>
	<cvename>CVE-2017-5465</cvename>
	<cvename>CVE-2017-5448</cvename>
	<cvename>CVE-2017-5437</cvename>
	<cvename>CVE-2017-5454</cvename>
	<cvename>CVE-2017-5455</cvename>
	<cvename>CVE-2017-5456</cvename>
	<cvename>CVE-2017-5469</cvename>
	<cvename>CVE-2017-5445</cvename>
	<cvename>CVE-2017-5449</cvename>
	<cvename>CVE-2017-5450</cvename>
	<cvename>CVE-2017-5451</cvename>
	<cvename>CVE-2017-5462</cvename>
	<cvename>CVE-2017-5463</cvename>
	<cvename>CVE-2017-5467</cvename>
	<cvename>CVE-2017-5452</cvename>
	<cvename>CVE-2017-5453</cvename>
	<cvename>CVE-2017-5458</cvename>
	<cvename>CVE-2017-5468</cvename>
	<cvename>CVE-2017-5430</cvename>
	<cvename>CVE-2017-5429</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/</url>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-04-19</entry>
	<modified>2017-09-19</modified>
	</dates>
	</vuln>

	<vuln vid="d9e01c35-2531-11e7-b291-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.55</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.31</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.23</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.55</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.36</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html">
	<p>This Critical Patch Update contains 39 new security fixes for
	Oracle MySQL. 11 of these vulnerabilities may be remotely
	exploitable without authentication, i.e., may be exploited over a
	network without requiring user credentials.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html</url>
	<cvename>CVE-2017-3308</cvename>
	<cvename>CVE-2017-3309</cvename>
	<cvename>CVE-2017-3450</cvename>
	<cvename>CVE-2017-3599</cvename>
	<cvename>CVE-2017-3329</cvename>
	<cvename>CVE-2017-3600</cvename>
	<cvename>CVE-2017-3331</cvename>
	<cvename>CVE-2017-3453</cvename>
	<cvename>CVE-2017-3452</cvename>
	<cvename>CVE-2017-3454</cvename>
	<cvename>CVE-2017-3455</cvename>
	<cvename>CVE-2017-3305</cvename>
	<cvename>CVE-2017-3460</cvename>
	<cvename>CVE-2017-3456</cvename>
	<cvename>CVE-2017-3458</cvename>
	<cvename>CVE-2017-3457</cvename>
	<cvename>CVE-2017-3459</cvename>
	<cvename>CVE-2017-3463</cvename>
	<cvename>CVE-2017-3462</cvename>
	<cvename>CVE-2017-3461</cvename>
	<cvename>CVE-2017-3464</cvename>
	<cvename>CVE-2017-3465</cvename>
	<cvename>CVE-2017-3467</cvename>
	<cvename>CVE-2017-3468</cvename>
	</references>
	<dates>
	<discovery>2017-04-19</discovery>
	<entry>2017-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="c6861494-1ffb-11e7-934d-d05099c0ae8c">
	<topic>BIND -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.9P8</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.4P8</lt></range>
	</package>
	<package>
	<name>bind911</name>
	<range><lt>9.11.0P5</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2017.03.25</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01465/0">
	<p>A query with a specific set of characteristics could
	cause a server using DNS64 to encounter an assertion
	failure and terminate.</p>
	<p>An attacker could deliberately construct a query,
	enabling denial-of-service against a server if it
	was configured to use the DNS64 feature and other
	preconditions were met.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01466/0">
	<p>Mistaken assumptions about the ordering of records in
	the answer section of a response containing CNAME or
	DNAME resource records could lead to a situation in
	which named would exit with an assertion failure when
	processing a response in which records occurred in an
	unusual order.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01471/0">
	<p>named contains a feature which allows operators to
	issue commands to a running server by communicating
	with the server process over a control channel,
	using a utility program such as rndc.</p>
	<p>A regression introduced in a recent feature change
	has created a situation under which some versions of
	named can be caused to exit with a REQUIRE assertion
	failure if they are sent a null command string.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-3136</cvename>
	<cvename>CVE-2017-3137</cvename>
	<cvename>CVE-2017-3138</cvename>
	<url>https://kb.isc.org/article/AA-01465/0</url>
	<url>https://kb.isc.org/article/AA-01466/0</url>
	<url>https://kb.isc.org/article/AA-01471/0</url>
	</references>
	<dates>
	<discovery>2017-04-12</discovery>
	<entry>2017-04-13</entry>
	<modified>2017-04-13</modified>
	</dates>
	</vuln>

	<vuln vid="e48355d7-1548-11e7-8611-0090f5f2f347">
	<topic>id Tech 3 -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>ioquake3</name>
	<range><lt>1.36_16</lt></range>
	</package>
	<package>
	<name>ioquake3-devel</name>
	<range><lt>g2930</lt></range>
	</package>
	<package>
	<name>iourbanterror</name>
	<range><lt>4.3.2,1</lt></range>
	</package>
	<package>
	<name>openarena</name>
	<range><lt>0.8.8.s1910_3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The content auto-download of id Tech 3 can be used to deliver
	maliciously crafted content, that triggers downloading of
	further content and loading and executing it as native code
	with user credentials. This affects ioquake3, ioUrbanTerror,
	OpenArena, the original Quake 3 Arena and other forks.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6903</cvename>
	<url>https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/</url>
	</references>
	<dates>
	<discovery>2017-03-14</discovery>
	<entry>2017-04-07</entry>
	</dates>
	</vuln>

	<vuln vid="90becf7c-1acf-11e7-970f-002590263bf5">
	<topic>xen-kernel -- broken check in memory_exchange() permits PV guest breakout</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
	<p>The XSA-29 fix introduced an insufficient check on XENMEM_exchange
	input, allowing the caller to drive hypervisor memory accesses
	outside of the guest provided input/output arrays.</p>
	<p>A malicious or buggy 64-bit PV guest may be able to access all of
	system memory, allowing for all of privilege escalation, host
	crashes, and information leaks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-7228</cvename>
	<url>https://xenbits.xen.org/xsa/advisory-212.html</url>
	</references>
	<dates>
	<discovery>2017-04-04</discovery>
	<entry>2017-04-06</entry>
	</dates>
	</vuln>

	<vuln vid="04f29189-1a05-11e7-bc6e-b499baebfeaf">
	<topic>cURL -- potential memory disclosure</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>6.5</ge><lt>7.53.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20170403.html">
	<p>There were two bugs in curl's parser for the command line option
	--write-out (or -w for short) that would skip the end of string
	zero byte if the string ended in a % (percent) or \ (backslash),
	and it would read beyond that buffer in the heap memory and it
	could then potentially output pieces of that memory to the
	terminal or the target file etc..</p>
	<p>This flaw only exists in the command line tool.</p>
	<p>We are not aware of any exploit of this flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_20170403.html</url>
	<cvename>CVE-2017-7407</cvename>
	</references>
	<dates>
	<discovery>2017-04-03</discovery>
	<entry>2017-04-05</entry>
	<modified>2017-04-06</modified>
	</dates>
	</vuln>

	<vuln vid="dc880d6c-195d-11e7-8c63-0800277dcc69">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<name>py35-django</name>
	<name>py36-django</name>
	<range><lt>1.8.18</lt></range>
	</package>
	<package>
	<name>py27-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<name>py35-django18</name>
	<name>py36-django18</name>
	<range><lt>1.8.18</lt></range>
	</package>
	<package>
	<name>py27-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<name>py36-django19</name>
	<range><lt>1.9.13</lt></range>
	</package>
	<package>
	<name>py27-django110</name>
	<name>py33-django110</name>
	<name>py34-django110</name>
	<name>py35-django110</name>
	<name>py36-django110</name>
	<range><lt>1.10.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django team reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2017/apr/04/security-releases/">
	<p>These release addresses two security issues detailed below. We
	encourage all users of Django to upgrade as soon as possible.</p>
	<ul>
	<li>Open redirect and possible XSS attack via user-supplied numeric
	redirect URLs</li>
	<li>Open redirect vulnerability in django.views.static.serve()</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2017/apr/04/security-releases/</url>
	<cvename>CVE-2017-7233</cvename>
	<cvename>CVE-2017-7234</cvename>
	</references>
	<dates>
	<discovery>2017-04-04</discovery>
	<entry>2017-04-04</entry>
	</dates>
	</vuln>

	<vuln vid="356b02e9-1954-11e7-9608-001999f8d30b">
	<topic>asterisk -- Buffer overflow in CDR's set user</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.14.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>No size checking is done when setting the user field
	on a CDR. Thus, it is possible for someone to use an
	arbitrarily large string and write past the end of the
	user field storage buffer. This allows the possibility
	of remote code injection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2017-001.html</url>
	<url>https://issues.asterisk.org/jira/browse/ASTERISK-26897</url>
	</references>
	<dates>
	<discovery>2017-03-27</discovery>
	<entry>2017-04-04</entry>
	</dates>
	</vuln>

	<vuln vid="057e6616-1885-11e7-bb4d-a0d3c19bfa21">
	<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
	<affects>
	<package>
	<name>nvidia-driver</name>
	<range><lt>375.39</lt></range>
	</package>
	<package>
	<name>nvidia-driver-340</name>
	<range><lt>340.102</lt></range>
	</package>
	<package>
	<name>nvidia-driver-304</name>
	<range><lt>304.135</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVIDIA Unix security team reports:</p>
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4398">
	<p>NVIDIA GPU Display Driver contains vulnerabilities in the
	kernel mode layer handler where multiple integer overflows,
	improper access control, and improper validation of a user
	input may cause a denial of service or potential escalation
	of privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-0309</cvename>
	<cvename>CVE-2017-0310</cvename>
	<cvename>CVE-2017-0311</cvename>
	<cvename>CVE-2017-0318</cvename>
	<cvename>CVE-2017-0321</cvename>
	<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4398</url>
	</references>
	<dates>
	<discovery>2017-02-14</discovery>
	<entry>2017-04-04</entry>
	</dates>
	</vuln>

	<vuln vid="7cf058d8-158d-11e7-ba2c-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>57.0.2987.133</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html">
	<p>5 security fixes in this release, including:</p>
	<ul>
	<li>[698622] Critical CVE-2017-5055: Use after free in printing. Credit to
	Wadih Matar</li>
	<li>[699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to
	Nicolas Trippar of Zimperium zLabs</li>
	<li>[662767] High CVE-2017-5052: Bad cast in Blink. Credit to
	JeongHoon Shin</li>
	<li>[705445] High CVE-2017-5056: Use after free in Blink. Credit to
	anonymous</li>
	<li>[702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to
	Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5055</cvename>
	<cvename>CVE-2017-5054</cvename>
	<cvename>CVE-2017-5052</cvename>
	<cvename>CVE-2017-5056</cvename>
	<cvename>CVE-2017-5053</cvename>
	<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html</url>
	</references>
	<dates>
	<discovery>2017-03-29</discovery>
	<entry>2017-03-30</entry>
	</dates>
	</vuln>

	<vuln vid="47873d72-14eb-11e7-970f-002590263bf5">
	<topic>xen-tools -- xenstore denial of service via repeated update</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
	<p>Unprivileged guests may be able to stall progress of the control
	domain or driver domain, possibly leading to a Denial of Service
	(DoS) of the entire host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://xenbits.xen.org/xsa/advisory-206.html</url>
	</references>
	<dates>
	<discovery>2017-03-28</discovery>
	<entry>2017-03-30</entry>
	</dates>
	</vuln>

	<vuln vid="68611303-149e-11e7-b9bb-6805ca0b3d42">
	<topic>phpMyAdmin -- bypass 'no password' restriction</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>4.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-8/">
	<h3>Summary</h3>
	<p>Bypass $cfg['Servers'][$i]['AllowNoPassword']</p>
	<h3>Description</h3>
	<p>A vulnerability was discovered where the restrictions
	caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are
	bypassed under certain PHP versions. This can allow the
	login of users who have no password set even if the
	administrator has set $cfg['Servers'][$i]['AllowNoPassword']
	to false (which is also the default).</p>
	<p>This behavior depends on the PHP version used (it seems
	PHP 5 is affected, while PHP 7.0 is not).</p>
	<h3>Severity</h3>
	<p>We consider this vulnerability to be of moderate severity.</p>
	<h3>Mitigation factor</h3>
	<p>Set a password for all users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-8/</url>
	</references>
	<dates>
	<discovery>2017-03-28</discovery>
	<entry>2017-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="04bc4e23-9a70-42cb-9fec-3613632d34bc">
	<cancelled superseded="967b852b-1e28-11e6-8dd3-002590263bf5"/>
	</vuln>

	<vuln vid="2826317b-10ec-11e7-944e-000c292e4fd8">
	<topic>samba -- symlink race allows access outside share definition</topic>
	<affects>
	<package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
	</package>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
	</package>
	<package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><le>4.2.14</le></range>
	</package>
	<package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><le>4.3.13</le></range>
	</package>
	<package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.12</lt></range>
	</package>
	<package>
	<name>samba45</name>
	<range><ge>4.5.0</ge><lt>4.5.7</lt></range>
	</package>
	<package>
	<name>samba46</name>
	<range><ge>4.6.0</ge><lt>4.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba team reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2017-2619.html">
	<p>A time-of-check, time-of-use race condition
	can allow clients to access non-exported parts
	of the file system via symlinks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.samba.org/samba/security/CVE-2017-2619.html</url>
	<cvename>CVE-2017-2619</cvename>
	</references>
	<dates>
	<discovery>2017-03-23</discovery>
	<entry>2017-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="af19ecd0-0f6a-11e7-970f-002590263bf5">
	<topic>xen-tools -- Cirrus VGA Heap overflow via display refresh</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-211.html">
	<p>A privileged user within the guest VM can cause a heap overflow in
	the device model process, potentially escalating their privileges to
	that of the device model process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9603</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-211.html</url>
	</references>
	<dates>
	<discovery>2017-03-14</discovery>
	<entry>2017-03-23</entry>
	</dates>
	</vuln>

	<vuln vid="06f931c0-0be0-11e7-b4bf-5404a68ad561">
	<topic>irssi -- use-after-free potential code execution</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><gt>0.8.21,1</gt><lt>1.0.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The irssi project reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_03.txt">
	<p>Use after free while producing list of netjoins (CWE-416).
	This issue was found and reported to us by APic.
	This issue usually leads to segmentation faults.
	Targeted code execution should be difficult.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://irssi.org/security/irssi_sa_2017_03.txt</url>
	<cvename>CVE-2017-7191</cvename>
	</references>
	<dates>
	<discovery>2017-03-11</discovery>
	<entry>2017-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="7c27192f-0bc3-11e7-9940-b499baebfeaf">
	<topic>mysql -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>mariadb55-client</name>
	<range><le>5.5.54</le></range>
	</package>
	<package>
	<name>mariadb100-client</name>
	<range><lt>10.0.30</lt></range>
	</package>
	<package>
	<name>mariadb101-client</name>
	<range><lt>10.1.22</lt></range>
	</package>
	<package>
	<name>mysql55-client</name>
	<range><le>5.5.54</le></range>
	</package>
	<package>
	<name>mysql56-client</name>
	<range><lt>5.6.21</lt></range>
	</package>
	<package>
	<name>mysql57-client</name>
	<range><lt>5.7.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Openwall reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/02/11/11">
	<p>C client library for MySQL (libmysqlclient.so) has
	use-after-free defect which can cause crash of applications
	using that MySQL client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2017/02/11/11</url>
	<cvename>CVE-2017-3302</cvename>
	</references>
	<dates>
	<discovery>2017-01-27</discovery>
	<entry>2017-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="5f453b69-abab-4e76-b6e5-2ed0bafcaee3">
	<topic>firefox -- integer overflow in createImageBitmap()</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>52.0.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/">
	<p>An integer overflow in createImageBitmap() was reported
	through the Pwn2Own contest. The fix for this vulnerability
	disables the experimental extensions to the
	createImageBitmap API. This function runs in the content
	sandbox, requiring a second vulnerability to compromise a
	user's computer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5428</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-08/</url>
	</references>
	<dates>
	<discovery>2017-03-17</discovery>
	<entry>2017-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="df45b4bd-0b7f-11e7-970f-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle29</name>
	<range><le>2.9.9</le></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.9</lt></range>
	</package>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.5</lt></range>
	</package>
	<package>
	<name>moodle32</name>
	<range><lt>3.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/news/#p1408104">
	<p>In addition to a number of bug fixes and small improvements,
	security vulnerabilities have been discovered and fixed. We highly
	recommend that you upgrade your sites as soon as possible.
	Upgrading should be very straightforward. As per our usual policy,
	admins of all registered Moodle sites will be notified of security
	issue details directly via email and we'll publish details more
	widely in a week.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://moodle.org/news/#p1408104</url>
	</references>
	<dates>
	<discovery>2017-03-13</discovery>
	<entry>2017-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="f72d98d1-0b7e-11e7-970f-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle29</name>
	<range><le>2.9.9</le></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.8</lt></range>
	</package>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.4</lt></range>
	</package>
	<package>
	<name>moodle32</name>
	<range><lt>3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-17-0001: System file inclusion when adding own preset
	file in Boost theme</p></li>
	<li><p>MSA-17-0002: Incorrect sanitation of attributes in forums
	</p></li>
	<li><p>MSA-17-0003: PHPMailer vulnerability in no-reply address
	</p></li>
	<li><p>MSA-17-0004: XSS in assignment submission page</p></li>
	</ul>
	<p>.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2576</cvename>
	<cvename>CVE-2017-2578</cvename>
	<cvename>CVE-2016-10045</cvename>
	<url>https://moodle.org/security/</url>
	</references>
	<dates>
	<discovery>2017-01-17</discovery>
	<entry>2017-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="2730c668-0b1c-11e7-8d52-6cf0497db129">
	<topic>drupal8 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal8</name>
	<range><lt>8.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-2017-001">
	<p>CVE-2017-6377: Editor module incorrectly checks access to inline private files</p>
	<p>CVE-2017-6379: Some admin paths were not protected with a CSRF token</p>
	<p>CVE-2017-6381: Remote code execution</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-6377</cvename>
	<cvename>CVE-2017-6379</cvename>
	<cvename>CVE-2017-6381</cvename>
	<url>https://www.drupal.org/SA-2017-001</url>
	</references>
	<dates>
	<discovery>2017-03-15</discovery>
	<entry>2017-03-17</entry>
	</dates>
	</vuln>

	<vuln vid="9b973e97-0a99-11e7-ace7-080027ef73ec">
	<topic>PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections</topic>
	<affects>
	<package>
	<name>putty</name>
	<range><lt>0.68</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon G. Tatham reports:</p>
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html">
	<p>Many versions of PuTTY prior to 0.68 have a heap-corrupting integer
	overflow bug in the ssh_agent_channel_data function which processes
	messages sent by remote SSH clients to a forwarded agent connection. [...]</p>
	<p>This bug is only exploitable at all if you have enabled SSH
	agent forwarding, which is turned off by default. Moreover, an
	attacker able to exploit this bug would have to have already be able
	to connect to the Unix-domain socket representing the forwarded
	agent connection. Since any attacker with that capability would
	necessarily already be able to generate signatures with your agent's
	stored private keys, you should in normal circumstances be defended
	against this vulnerability by the same precautions you and your
	operating system were already taking to prevent untrusted people
	from accessing your SSH agent.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html</url>
	<cvename>CVE-2017-6542</cvename>
	</references>
	<dates>
	<discovery>2017-01-29</discovery>
	<entry>2017-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="4ffb633c-0a3b-11e7-a9f2-0011d823eebd">
	<topic>Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>25.0.0.127</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-07.html">
	<ul>
	<li>These updates resolve a buffer overflow vulnerability that
	could lead to code execution (CVE-2017-2997).</li>
	<li>These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2017-2998, CVE-2017-2999).</li>
	<li>These updates resolve a random number generator vulnerability
	used for constant blinding that could lead to information
	disclosure (CVE-2017-3000).</li>
	<li>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2017-3001, CVE-2017-3002,
	CVE-2017-3003).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2997</cvename>
	<cvename>CVE-2017-2998</cvename>
	<cvename>CVE-2017-2999</cvename>
	<cvename>CVE-2017-3000</cvename>
	<cvename>CVE-2017-3001</cvename>
	<cvename>CVE-2017-3002</cvename>
	<cvename>CVE-2017-3003</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-07.html</url>
	</references>
	<dates>
	<discovery>2017-03-14</discovery>
	<entry>2017-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="f41e3e54-076b-11e7-a9f2-0011d823eebd">
	<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mbedtls</name>
	<range><lt>2.4.2</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><lt>1.3.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Janos Follath reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01">
	<ul>
	<li>If a malicious peer supplies a certificate with a specially
	crafted secp224k1 public key, then an attacker can cause the
	server or client to attempt to free block of memory held on
	stack. Depending on the platform, this could result in a Denial
	of Service (client crash) or potentially could be exploited to
	allow remote code execution with the same privileges as the host
	application.</li>
	<li>If the client and the server both support MD5 and the client
	can be tricked to authenticate to a malicious server, then the
	malicious server can impersonate the client. To launch this man
	in the middle attack, the adversary has to compute a
	chosen-prefix MD5 collision in real time. This is very expensive
	computationally, but can be practical. Depending on the
	platform, this could result in a Denial of Service (client crash)
	or potentially could be exploited to allow remote code execution
	with the same privileges as the host application.</li>
	<li>A bug in the logic of the parsing of a PEM encoded Certificate
	Revocation List in mbedtls_x509_crl_parse() can result in an
	infinite loop. In versions before 1.3.10 the same bug results in
	an infinite recursion stack overflow that usually crashes the
	application. Methods and means of acquiring the CRLs is not part
	of the TLS handshake and in the strict TLS setting this
	vulnerability cannot be triggered remotely. The vulnerability
	cannot be triggered unless the application explicitly calls
	mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM
	formatted CRL of untrusted origin. In which case the
	vulnerability can be exploited to launch a denial of service
	attack against the application.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01</url>
	</references>
	<dates>
	<discovery>2017-03-11</discovery>
	<entry>2017-03-12</entry>
	</dates>
	</vuln>

	<vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>57.0.2987.98</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">
	<p>36 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5030</cvename>
	<cvename>CVE-2017-5031</cvename>
	<cvename>CVE-2017-5032</cvename>
	<cvename>CVE-2017-5029</cvename>
	<cvename>CVE-2017-5034</cvename>
	<cvename>CVE-2017-5035</cvename>
	<cvename>CVE-2017-5036</cvename>
	<cvename>CVE-2017-5037</cvename>
	<cvename>CVE-2017-5039</cvename>
	<cvename>CVE-2017-5040</cvename>
	<cvename>CVE-2017-5041</cvename>
	<cvename>CVE-2017-5033</cvename>
	<cvename>CVE-2017-5042</cvename>
	<cvename>CVE-2017-5038</cvename>
	<cvename>CVE-2017-5043</cvename>
	<cvename>CVE-2017-5044</cvename>
	<cvename>CVE-2017-5045</cvename>
	<cvename>CVE-2017-5046</cvename>
	<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-03-09</discovery>
	<entry>2017-03-12</entry>
	</dates>
	</vuln>

	<vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b">
	<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
	<affects>
	<package>
	<name>bouncycastle15</name>
	<range><ge>1.51</ge><lt>1.56</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Legion of the Bouncy Castle reports:</p>
	<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
	<p>Release: 1.56</p>
	<p>2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/215507</freebsdpr>
	<url>https://www.bouncycastle.org/releasenotes.html</url>
	</references>
	<dates>
	<discovery>2016-12-23</discovery>
	<entry>2017-03-12</entry>
	</dates>
	</vuln>

	<vuln vid="41fe4724-06a2-11e7-8e3e-5453ed2e2b49">
	<topic>kde-runtime -- kdesu: displayed command truncated by unicode string terminator</topic>
	<affects>
	<package>
	<name>kde-runtime</name>
	<range><lt>4.14.3_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Aastals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20160930-1.txt">
	<p>A maliciously crafted command line for kdesu can result in the
	user only seeing part of the commands that will actually get executed
	as super user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7787</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2016/09/29/7</mlist>
	<url>https://www.kde.org/info/security/advisory-20160930-1.txt</url>
	</references>
	<dates>
	<discovery>2016-09-30</discovery>
	<entry>2017-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="e550fc62-069a-11e7-8e3e-5453ed2e2b49">
	<topic>kdepimlibs -- directory traversal on KTNEF</topic>
	<affects>
	<package>
	<name>kdepimlibs</name>
	<range><lt>4.14.10_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Aastals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20170227-1.txt">
	<p>A directory traversal issue was found in KTNEF which can be
	exploited by tricking a user into opening a malicious winmail.dat
	file. The issue allows to write files with the permission of the user
	opening the winmail.dat file during extraction.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.kde.org/info/security/advisory-20170227-1.txt</url>
	</references>
	<dates>
	<discovery>2017-02-27</discovery>
	<entry>2017-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="f714d8ab-028e-11e7-8042-50e549ebab6c">
	<topic>kio: Information Leak when accessing https when using a malicious PAC file</topic>
	<affects>
	<package>
	<name>kdelibs</name>
	<range><lt>4.14.29_10</lt></range>
	</package>
	<package>
	<name>kf5-kio</name>
	<range><lt>5.31.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Astals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20170228-1.txt">
	<p>Using a malicious PAC file, and then using exfiltration methods in the PAC
	function FindProxyForURL() enables the attacker to expose full https URLs.</p>
	<p>This is a security issue since https URLs may contain sensitive
	information in the URL authentication part (user:password@host), and in the
	path and the query (e.g. access tokens).</p>
	<p>This attack can be carried out remotely (over the LAN) since proxy settings
	allow "Detect Proxy Configuration Automatically".
	This setting uses WPAD to retrieve the PAC file, and an attacker who has access
	to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
	and inject his/her own malicious PAC instead of the legitimate one.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.kde.org/info/security/advisory-20170228-1.txt</url>
	</references>
	<dates>
	<discovery>2017-02-28</discovery>
	<entry>2017-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="82752070-0349-11e7-b48d-00e04c1ea73d">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.7.3,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/">
	<p>WordPress versions 4.7.2 and earlier are affected by six security issues.</p>
	<ul>
	<li>Cross-site scripting (XSS) via media file metadata.</li>
	<li>Control characters can trick redirect URL validation.</li>
	<li>Unintended files can be deleted by administrators using the
	plugin deletion functionality.</li>
	<li>Cross-site scripting (XSS) via video URL in YouTube embeds.</li>
	<li>Cross-site scripting (XSS) via taxonomy term names.</li>
	<li>Cross-site request forgery (CSRF) in Press This leading to
	excessive use of server resources.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2017/03/07/3</url>
	<url>https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2017-03-07</discovery>
	<entry>2017-03-07</entry>
	</dates>
	</vuln>

	<vuln vid="96eca031-1313-4daf-9be2-9d6e1c4f1eb5">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>52.0_1,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><ge>46.0,1</ge><lt>52.0,1</lt></range>
	<range><lt>45.8.0_1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><ge>46.0,2</ge><lt>52.0,2</lt></range>
	<range><lt>45.8.0_1,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><ge>46.0</ge><lt>52.0</lt></range>
	<range><lt>45.8.0_1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>46.0</ge><lt>52.0</lt></range>
	<range><lt>45.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5400</cvename>
	<cvename>CVE-2017-5401</cvename>
	<cvename>CVE-2017-5402</cvename>
	<cvename>CVE-2017-5403</cvename>
	<cvename>CVE-2017-5404</cvename>
	<cvename>CVE-2017-5406</cvename>
	<cvename>CVE-2017-5407</cvename>
	<cvename>CVE-2017-5410</cvename>
	<cvename>CVE-2017-5411</cvename>
	<cvename>CVE-2017-5409</cvename>
	<cvename>CVE-2017-5408</cvename>
	<cvename>CVE-2017-5412</cvename>
	<cvename>CVE-2017-5413</cvename>
	<cvename>CVE-2017-5414</cvename>
	<cvename>CVE-2017-5415</cvename>
	<cvename>CVE-2017-5416</cvename>
	<cvename>CVE-2017-5417</cvename>
	<cvename>CVE-2017-5425</cvename>
	<cvename>CVE-2017-5426</cvename>
	<cvename>CVE-2017-5427</cvename>
	<cvename>CVE-2017-5418</cvename>
	<cvename>CVE-2017-5419</cvename>
	<cvename>CVE-2017-5420</cvename>
	<cvename>CVE-2017-5405</cvename>
	<cvename>CVE-2017-5421</cvename>
	<cvename>CVE-2017-5422</cvename>
	<cvename>CVE-2017-5399</cvename>
	<cvename>CVE-2017-5398</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-05/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-06/</url>
	</references>
	<dates>
	<discovery>2017-03-07</discovery>
	<entry>2017-03-07</entry>
	</dates>
	</vuln>

	<vuln vid="71ebbc50-01c1-11e7-ae1b-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>3.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	<p>Fixed an XSS vulnerability in Security Library method xss_clean().
	</p>
	<p>Fixed a possible file inclusion vulnerability in Loader Library
	method vars().</p>
	<p>Fixed a possible remote code execution vulnerability in the Email
	Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane
	from NamePros).</p>
	<p>Added protection against timing side-channel attacks in Security
	Library method csrf_verify().</p>
	<p>Added protection against BREACH attacks targeting the CSRF token
	field generated by Form Helper function form_open().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.codeigniter.com/user_guide/changelog.html</url>
	</references>
	<dates>
	<discovery>2017-01-09</discovery>
	<entry>2017-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="7b35a77a-0151-11e7-ae1b-002590263bf5">
	<topic>ikiwiki -- authentication bypass vulnerability</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>3.20170111</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ikiwiki reports:</p>
	<blockquote cite="https://ikiwiki.info/security/#index48h2">
	<p>The ikiwiki maintainers discovered further flaws similar to
	CVE-2016-9646 in the passwordauth plugin's use of
	CGI::FormBuilder, with a more serious impact:</p>
	<p>An attacker who can log in to a site with a password can log in as
	a different and potentially more privileged user.</p>
	<p>An attacker who can create a new account can set arbitrary fields
	in the user database for that account</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-0356</cvename>
	<url>https://ikiwiki.info/security/#index48h2</url>
	</references>
	<dates>
	<discovery>2017-01-11</discovery>
	<entry>2017-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="5ed094a0-0150-11e7-ae1b-002590263bf5">
	<topic>ikiwiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>3.20161229</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10026">
	<p>ikiwiki 3.20161219 does not properly check if a revision changes
	the access permissions for a page on sites with the git and
	recentchanges plugins and the CGI interface enabled, which allows
	remote attackers to revert certain changes by leveraging permissions
	to change the page before the revision was made.</p>
	</blockquote>
	<blockquote cite="https://ikiwiki.info/security/#index47h2">
	<p>When CGI::FormBuilder->field("foo") is called in list context
	(and in particular in the arguments to a subroutine that takes named
	arguments), it can return zero or more values for foo from the CGI
	request, rather than the expected single value. This breaks the
	usual Perl parsing convention for named arguments, similar to
	CVE-2014-1572 in Bugzilla (which was caused by a similar API design
	issue in CGI.pm).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10026</cvename>
	<cvename>CVE-2016-9645</cvename>
	<cvename>CVE-2016-9646</cvename>
	<url>https://ikiwiki.info/security/#index46h2</url>
	<url>https://ikiwiki.info/security/#index47h2</url>
	</references>
	<dates>
	<discovery>2016-12-19</discovery>
	<entry>2017-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="f4eb9a25-fde0-11e6-9ad0-b8aeed92ecc4">
	<topic>potrace -- multiple memory failure</topic>
	<affects>
	<package>
	<name>potrace</name>
	<range><lt>1.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>potrace reports:</p>
	<blockquote cite="https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/">
	<p>CVE-2016-8685: invalid memory access in findnext</p>
	<p>CVE-2016-8686: memory allocation failure</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/</url>
	<cvename>CVE-2016-8685</cvename>
	<cvename>CVE-2016-8686</cvename>
	</references>
	<dates>
	<discovery>2016-10-15</discovery>
	<entry>2017-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="765d165b-fbfe-11e6-aae7-5404a68ad561">
	<topic>MPD -- buffer overflows in http output</topic>
	<affects>
	<package>
	<name>musicpd</name>
	<range><lt>0.20.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MPD project reports:</p>
	<blockquote cite="http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5">
	<p>httpd: fix two buffer overflows in IcyMetaData length calculation</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5</url>
	</references>
	<dates>
	<discovery>2017-02-18</discovery>
	<entry>2017-02-26</entry>
	</dates>
	</vuln>

	<vuln vid="311e4b1c-f8ee-11e6-9940-b499baebfeaf">
	<topic>cURL -- ocsp status validation error</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.52.0</ge><lt>7.53.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20170222.html">
	<p>SSL_VERIFYSTATUS ignored<br/>
	curl and libcurl support "OCSP stapling", also known as the TLS
	Certificate Status Request extension (using the
	CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this
	feature, it uses that TLS extension to ask for a fresh proof of
	the server's certificate's validity. If the server doesn't support
	the extension, or fails to provide said proof, curl is expected to
	return an error.<br/>
	Due to a coding mistake, the code that checks for a test success or
	failure, ends up always thinking there's valid proof, even when
	there is none or if the server doesn't support the TLS extension in
	question. Contrary to how it used to function and contrary to how
	this feature is documented to work.<br/>
	This could lead to users not detecting when a server's certificate
	goes invalid or otherwise be mislead that the server is in a better
	shape than it is in reality.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_20170222.html</url>
	<cvename>CVE-2017-2629</cvename>
	</references>
	<dates>
	<discovery>2017-02-22</discovery>
	<entry>2017-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="8cbd9c08-f8b9-11e6-ae1b-002590263bf5">
	<topic>xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.1_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-209.html">
	<p>In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
	cirrus_bitblt_cputovideo fails to check whether the specified
	memory region is safe. A malicious guest administrator can cause
	an out of bounds memory write, very likely exploitable as a
	privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2620</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-209.html</url>
	</references>
	<dates>
	<discovery>2017-02-21</discovery>
	<entry>2017-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="786a7d87-f826-11e6-9436-14dae9d5a9d2">
	<topic>fbsdmon -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>fbsdmon</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alan Somers reports:</p>
	<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099">
	<p>The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099</url>
	</references>
	<dates>
	<discovery>2017-02-14</discovery>
	<entry>2017-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="f1075415-f5e9-11e6-a4e2-5404a68ad561">
	<topic>wavpack -- multiple invalid memory reads</topic>
	<affects>
	<package>
	<name>wavpack</name>
	<range><lt>5.1.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Bryant reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/23/4">
	<p>global buffer overread in read_code / read_words.c</p>
	<p>heap out of bounds read in WriteCaffHeader / caff.c</p>
	<p>heap out of bounds read in unreorder_channels / wvunpack.c</p>
	<p>heap oob read in read_new_config_info / open_utils.c</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2017/01/23/4</url>
	<cvename>CVE-2016-10169</cvename>
	<cvename>CVE-2016-10170</cvename>
	<cvename>CVE-2016-10171</cvename>
	<cvename>CVE-2016-10172</cvename>
	<url>https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc</url>
	</references>
	<dates>
	<discovery>2017-01-21</discovery>
	<entry>2017-02-18</entry>
	</dates>
	</vuln>

	<vuln vid="8fedf75c-ef2f-11e6-900e-003048f78448">
	<topic>optipng -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>optipng</name>
	<range><lt>0.7.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7802">
	<p>ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2191">
	<p>The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3981">
	<p>Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3982">
	<p>Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7802</cvename>
	<cvename>CVE-2016-2191</cvename>
	<cvename>CVE-2016-3981</cvename>
	<cvename>CVE-2016-3982</cvename>
	</references>
	<dates>
	<discovery>2015-10-09</discovery>
	<entry>2017-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="1a802ba9-f444-11e6-9940-b499baebfeaf">
	<topic>openssl -- crash on handshake</topic>
	<affects>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0e</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20170216.txt">
	<p>Severity: High<br/>
	During a renegotiation handshake if the Encrypt-Then-Mac
	extension is negotiated where it was not in the original
	handshake (or vice-versa) then this can cause OpenSSL to
	crash (dependent on ciphersuite). Both clients and servers
	are affected.<br/>
	This issue does not affect OpenSSL version 1.0.2.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20170216.txt</url>
	<cvename>CVE-2017-3733</cvename>
	</references>
	<dates>
	<discovery>2017-02-16</discovery>
	<entry>2017-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="077bbadf-f2f4-11e6-92a7-902b34361349">
	<topic>diffoscope -- arbitrary file write</topic>
	<affects>
	<package>
	<name>py34-diffoscope</name>
	<name>py35-diffoscope</name>
	<name>py36-diffoscope</name>
	<range><ge>67</ge><lt>76</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ximin Luo reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723">
	<p>[v67] introduced a security hole where diffoscope may write to
	arbitrary locations on disk depending on the contents of an
	untrusted archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-0359</cvename>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723</url>
	</references>
	<dates>
	<discovery>2017-02-09</discovery>
	<entry>2017-02-14</entry>
	<modified>2017-02-16</modified>
	</dates>
	</vuln>

	<vuln vid="7f9b696f-f11b-11e6-b50e-5404a68ad561">
	<topic>ffmpeg -- heap overflow in lavf/mov.c</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range><lt>3.2.4,1</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-29.x has ffmpeg-3.2 -->
	<range><lt>29.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>FFmpeg security reports:</p>
	<blockquote cite="https://www.ffmpeg.org/security.html">
	<p>FFmpeg 3.2.4 fixes the following vulnerabilities:
	CVE-2017-5024, CVE-2017-5025</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5024</cvename>
	<url>https://www.ffmpeg.org/security.html</url>
	<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
	<cvename>CVE-2017-5025</cvename>
	<url>https://www.ffmpeg.org/security.html</url>
	<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-01-25</discovery>
	<entry>2017-02-12</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="79bbb8f8-f049-11e6-8a6a-bcaec565249c">
	<topic>gtk-vnc -- bounds checking vulnerabilities</topic>
	<affects>
	<package>
	<name>gtk-vnc</name>
	<range><lt>0.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel P. Berrange reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html">
	<p>CVE-2017-5884 - fix bounds checking for RRE, hextile and
	copyrect encodings</p>
	<p>CVE-2017-5885 - fix color map index bounds checking.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html</url>
	<cvename>CVE-2017-5884</cvename>
	<cvename>CVE-2017-5885</cvename>
	</references>
	<dates>
	<discovery>2017-02-09</discovery>
	<entry>2017-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="a73aba9a-effe-11e6-ae1b-002590263bf5">
	<topic>xen-tools -- oob access in cirrus bitblt copy</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-208.html">
	<p>When doing bitblt copy backwards, qemu should negate the blit
	width. This avoids an oob access before the start of video
	memory.</p>
	<p>A malicious guest administrator can cause an out of bounds memory
	access, possibly leading to information disclosure or privilege
	escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2615</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-208.html</url>
	</references>
	<dates>
	<discovery>2017-02-10</discovery>
	<entry>2017-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="fb74eacc-ec8a-11e6-bc8a-0011d823eebd">
	<topic>tiff -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><lt>4.0.7</lt></range>
	</package>
	<package>
	<name>linux-c6-libtiff</name>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_5</lt></range>
	</package>
	<package>
	<name>linux-c7-libtiff</name>
	<name>linux-c7-tiff</name>
	<range><lt>4.0.3_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libtiff project reports:</p>
	<blockquote cite="http://simplesystems.org/libtiff/v4.0.7.html">
	<p>Multiple flaws have been discovered in libtiff library and
	utilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://simplesystems.org/libtiff/v4.0.7.html</url>
	<cvename>CVE-2016-9533</cvename>
	<cvename>CVE-2016-9534</cvename>
	<cvename>CVE-2016-9535</cvename>
	<cvename>CVE-2015-8870</cvename>
	<cvename>CVE-2016-5652</cvename>
	<cvename>CVE-2016-9540</cvename>
	<cvename>CVE-2016-9537</cvename>
	<cvename>CVE-2016-9536</cvename>
	</references>
	<dates>
	<discovery>2016-11-19</discovery>
	<entry>2017-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="2b63e964-eb04-11e6-9ac1-a4badb2f4699">
	<topic>mantis -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>1.2.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wdollman reports:</p>
	<blockquote cite="https://mantisbt.org/bugs/view.php?id=21611">
	<p>The value of the view_type parameter on the
	view_all_bug_page.php page is not encoded before being displayed on the
	page.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mantisbt.org/bugs/view.php?id=21611</url>
	<cvename>CVE-2016-6837</cvename>
	<freebsdpr>ports/216662</freebsdpr>
	</references>
	<dates>
	<discovery>2016-08-15</discovery>
	<entry>2017-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="b4ecf774-eb01-11e6-9ac1-a4badb2f4699">
	<topic>guile2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>guile2</name>
	<range><lt>2.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ludovic Courtès reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/10/11/1">
	<p>The REPL server is vulnerable to
	the HTTP inter-protocol attack</p>
	<p>The ‘mkdir’ procedure of GNU Guile, an implementation of
	the Scheme programming language, temporarily changed the process’ umask
	to zero. During that time window, in a multithreaded application, other
	threads could end up creating files with insecure permissions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2016/10/11/1</url>
	<url>http://www.openwall.com/lists/oss-security/2016/10/12/2</url>
	<cvename>CVE-2016-8605</cvename>
	<cvename>CVE-2016-8606</cvename>
	<freebsdpr>ports/216663</freebsdpr>
	</references>
	<dates>
	<discovery>2016-10-12</discovery>
	<entry>2017-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="c6932dd4-eaff-11e6-9ac1-a4badb2f4699">
	<topic>chicken -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chicken</name>
	<range><lt>4.12,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Peter Bex reports:</p>
	<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html">
	<p>A buffer overflow error was found in the POSIX unit's procedures
	process-execute and process-spawn.</p>
	<p>Additionally, a memory leak existed in this code, which would be
	triggered when an error is raised during argument and environment
	processing.</p>
	</blockquote>
	<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-12/msg00000.html">
	<p>Irregex versions before 0.9.6 contain a resource exhaustion
	vulnerability: when compiling deeply nested regexes containing the
	"+" operator due to exponential expansion behaviour.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html</url>
	<cvename>CVE-2016-6830</cvename>
	<cvename>CVE-2016-6831</cvename>
	<cvename>CVE-2016-9954</cvename>
	<freebsdpr>ports/216661</freebsdpr>
	</references>
	<dates>
	<discovery>2016-08-12</discovery>
	<entry>2017-02-04</entry>
	<modified>2017-03-05</modified>
	</dates>
	</vuln>

	<vuln vid="a130bd8c-eafe-11e6-9ac1-a4badb2f4699">
	<topic>libebml -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libebml</name>
	<range><lt>1.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mortiz Bunkus reports:</p>
	<blockquote cite="https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html">
	<p>Multiple invalid memory accesses vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html</url>
	<cvename>CVE-2015-8789</cvename>
	<cvename>CVE-2015-8790</cvename>
	<cvename>CVE-2015-8791</cvename>
	<freebsdpr>ports/216659</freebsdpr>
	</references>
	<dates>
	<discovery>2015-10-20</discovery>
	<entry>2017-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="5b1631dc-eafd-11e6-9ac1-a4badb2f4699">
	<topic>freeimage -- code execution vulnerability</topic>
	<affects>
	<package>
	<name>freeimage</name>
	<range><lt>3.16.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TALOS reports:</p>
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0189/">
	<p>An exploitable out-of-bounds write vulnerability exists in
	the XMP image handling functionality of the FreeImage library.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.talosintelligence.com/reports/TALOS-2016-0189/</url>
	<cvename>CVE-2016-5684</cvename>
	<freebsdpr>ports/216657</freebsdpr>
	</references>
	<dates>
	<discovery>2016-10-03</discovery>
	<entry>2017-02-04</entry>
	<modified>2018-04-14</modified>
	</dates>
	</vuln>

	<vuln vid="5a9b3d70-48e2-4267-b196-83064cb14fe0">
	<topic>shotwell -- failure to encrypt authentication</topic>
	<affects>
	<package>
	<name>shotwell</name>
	<range><lt>0.24.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jens Georg reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html">
	<p>I have just released Shotwell 0.24.5 and 0.25.4 which turn
	on HTTPS encryption all over the publishing plugins.</p>
	<p>Users using Tumblr and Yandex.Fotki publishing are strongly
	advised to change their passwords and reauthenticate Shotwell
	to those services after upgrade.</p>
	<p>Users of Picasa and Youtube publishing are strongly advised
	to reauthenticate (Log out and back in) Shotwell to those
	services after upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html</url>
	</references>
	<dates>
	<discovery>2017-01-31</discovery>
	<entry>2017-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="5cfa9d0c-73d7-4642-af4f-28fbed9e9404">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>2.44</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>2.32.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2598</cvename>
	<cvename>CVE-2017-2599</cvename>
	<cvename>CVE-2017-2600</cvename>
	<cvename>CVE-2011-4969</cvename>
	<cvename>CVE-2017-2601</cvename>
	<cvename>CVE-2015-0886</cvename>
	<cvename>CVE-2017-2602</cvename>
	<cvename>CVE-2017-2603</cvename>
	<cvename>CVE-2017-2604</cvename>
	<cvename>CVE-2017-2605</cvename>
	<cvename>CVE-2017-2606</cvename>
	<cvename>CVE-2017-2607</cvename>
	<cvename>CVE-2017-2608</cvename>
	<cvename>CVE-2017-2609</cvename>
	<cvename>CVE-2017-2610</cvename>
	<cvename>CVE-2017-2611</cvename>
	<cvename>CVE-2017-2612</cvename>
	<cvename>CVE-2017-2613</cvename>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01</url>
	</references>
	<dates>
	<discovery>2017-02-01</discovery>
	<entry>2017-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="14ea4458-e5cd-11e6-b56d-38d547003487">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.7.2,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aaron D. Campbell reports:</p>
	<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/">
	<p>WordPress versions 4.7.1 and earlier are affected by three security
	issues:</p>
	<ul>
	<li>The user interface for assigning taxonomy terms in Press This is
	shown to users who do not have permissions to use it.</li>
	<li>WP_Query is vulnerable to a SQL injection (SQLi) when passing
	unsafe data. WordPress core is not directly vulnerable to this
	issue, but we’ve added hardening to prevent plugins and
	themes from accidentally causing a vulnerability.</li>
	<li>A cross-site scripting (XSS) vulnerability was discovered in the
	posts list table.</li>
	<li>An unauthenticated privilege escalation vulnerability was
	discovered in a REST API endpoint.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5610</cvename>
	<cvename>CVE-2017-5611</cvename>
	<cvename>CVE-2017-5612</cvename>
	<url>http://www.openwall.com/lists/oss-security/2017/01/28/5</url>
	<url>https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/</url>
	<url>https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/</url>
	</references>
	<dates>
	<discovery>2017-01-26</discovery>
	<entry>2017-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699">
	<topic>nfsen -- remote command execution</topic>
	<affects>
	<package>
	<name>nfsen</name>
	<range><lt>1.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Peter Haag reports:</p>
	<blockquote cite="https://sourceforge.net/p/nfsen/mailman/message/35623845/">
	<p>A remote attacker with access to the web interface to
	execute arbitrary commands on the host operating system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://sourceforge.net/p/nfsen/mailman/message/35623845/</url>
	</references>
	<dates>
	<discovery>2017-01-24</discovery>
	<entry>2017-01-27</entry>
	</dates>
	</vuln>

	<vuln vid="4b9ca994-e3d9-11e6-813d-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>56.0.2924.76</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html">
	<p>51 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5007</cvename>
	<cvename>CVE-2017-5006</cvename>
	<cvename>CVE-2017-5008</cvename>
	<cvename>CVE-2017-5010</cvename>
	<cvename>CVE-2017-5011</cvename>
	<cvename>CVE-2017-5009</cvename>
	<cvename>CVE-2017-5012</cvename>
	<cvename>CVE-2017-5013</cvename>
	<cvename>CVE-2017-5014</cvename>
	<cvename>CVE-2017-5015</cvename>
	<cvename>CVE-2017-5019</cvename>
	<cvename>CVE-2017-5016</cvename>
	<cvename>CVE-2017-5017</cvename>
	<cvename>CVE-2017-5018</cvename>
	<cvename>CVE-2017-2020</cvename>
	<cvename>CVE-2017-2021</cvename>
	<cvename>CVE-2017-2022</cvename>
	<cvename>CVE-2017-2023</cvename>
	<cvename>CVE-2017-2024</cvename>
	<cvename>CVE-2017-2025</cvename>
	<cvename>CVE-2017-2026</cvename>
	<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2017-01-25</discovery>
	<entry>2017-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="d455708a-e3d3-11e6-9940-b499baebfeaf">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2k,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0d</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_13</lt></range>
	</package>
	<package>
	<name>linux-c7-openssl-libs</name>
	<range><lt>1.0.1e_3</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_8</lt></range>
	<range><ge>10.3</ge><lt>10.3_17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20170126.txt">
	<ul>
	<li>Truncated packet could crash via OOB read (CVE-2017-3731)</li>
	<li>Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)</li>
	<li>BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)</li>
	<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20170126.txt</url>
	<cvename>CVE-2016-7055</cvename>
	<cvename>CVE-2017-3730</cvename>
	<cvename>CVE-2017-3731</cvename>
	<cvename>CVE-2017-3732</cvename>
	<freebsdsa>SA-17:02.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2017-01-26</discovery>
	<entry>2017-01-26</entry>
	<modified>2017-05-26</modified>
	</dates>
	</vuln>

	<vuln vid="e60169c4-aa86-46b0-8ae2-0d81f683df09">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>51.0_1,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.48</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.7.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.7.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5373</cvename>
	<cvename>CVE-2017-5374</cvename>
	<cvename>CVE-2017-5375</cvename>
	<cvename>CVE-2017-5376</cvename>
	<cvename>CVE-2017-5377</cvename>
	<cvename>CVE-2017-5378</cvename>
	<cvename>CVE-2017-5379</cvename>
	<cvename>CVE-2017-5380</cvename>
	<cvename>CVE-2017-5381</cvename>
	<cvename>CVE-2017-5382</cvename>
	<cvename>CVE-2017-5383</cvename>
	<cvename>CVE-2017-5384</cvename>
	<cvename>CVE-2017-5385</cvename>
	<cvename>CVE-2017-5386</cvename>
	<cvename>CVE-2017-5387</cvename>
	<cvename>CVE-2017-5388</cvename>
	<cvename>CVE-2017-5389</cvename>
	<cvename>CVE-2017-5390</cvename>
	<cvename>CVE-2017-5391</cvename>
	<cvename>CVE-2017-5392</cvename>
	<cvename>CVE-2017-5393</cvename>
	<cvename>CVE-2017-5394</cvename>
	<cvename>CVE-2017-5395</cvename>
	<cvename>CVE-2017-5396</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-01/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2017-02/</url>
	</references>
	<dates>
	<discovery>2017-01-24</discovery>
	<entry>2017-01-24</entry>
	</dates>
	</vuln>

	<vuln vid="7721562b-e20a-11e6-b2e2-6805ca0b3d42">
	<topic>phpMyAdmin -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.6.0</ge><lt>4.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-1/">
	<p>Open redirect</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-2/">
	<p>php-gettext code execution</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-3/">
	<p>DOS vulnerability in table editing</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-4/">
	<p>CSS injection in themes</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-5/">
	<p>Cookie attribute injection attack</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-6/">
	<p>SSRF in replication</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-7/">
	<p>DOS in replication status</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-1</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-2</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-3</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-4</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-5</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-6</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2017-7</url>
	<cvename>CVE-2015-8980</cvename>
	</references>
	<dates>
	<discovery>2017-01-24</discovery>
	<entry>2017-01-24</entry>
	</dates>
	</vuln>

	<vuln vid="a4b7def1-e165-11e6-9d84-90e2ba9881c8">
	<topic>Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability</topic>
	<affects>
	<package>
	<name>intel-nvmupdate</name>
	<range><lt>5.05</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Intel Corporation reports:</p>
	<blockquote cite="https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr">
	<p>A security vulnerability in the Intel(R) Ethernet Controller X710
	and Intel(R) Ethernet Controller XL710 family of products
	(Fortville) has been found in the Non-Volatile Flash Memory (NVM)
	image.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr</url>
	<cvename>CVE-2016-8106</cvename>
	</references>
	<dates>
	<discovery>2017-01-09</discovery>
	<entry>2017-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="709e025a-de8b-11e6-a9a5-b499baebfeaf">
	<topic>PHP -- undisclosed vulnerabilities</topic>
	<affects>
	<package>
	<name>php56</name>
	<range><lt>5.6.30</lt></range>
	</package>
	<package>
	<name>php70</name>
	<range><lt>7.0.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-2">
	<p>The PHP development team announces the immediate availability of
	PHP 7.0.15. This is a security release. Several security bugs were
	fixed in this release.</p>
	</blockquote>
	<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-3">
	<p>The PHP development team announces the immediate availability of
	PHP 5.6.30. This is a security release. Several security bugs were
	fixed in this release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/archive/2017.php#id2017-01-19-2</url>
	<url>http://php.net/archive/2017.php#id2017-01-19-3</url>
	</references>
	<dates>
	<discovery>2017-01-19</discovery>
	<entry>2017-01-19</entry>
	<modified>2017-01-20</modified>
	</dates>
	</vuln>

	<vuln vid="57facd35-ddf6-11e6-915d-001b3856973b">
	<topic>icoutils -- check_offset overflow on 64-bit systems</topic>
	<affects>
	<package>
	<name>icoutils</name>
	<range><lt>0.31.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Choongwoo Han reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q1/38">
	<p>An exploitable crash exists in the wrestool utility on 64-bit systems
	where the result of subtracting two pointers exceeds the size of int.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5208</cvename>
	<cvename>CVE-2017-5331</cvename>
	<cvename>CVE-2017-5332</cvename>
	<cvename>CVE-2017-5333</cvename>
	<url>http://seclists.org/oss-sec/2017/q1/38</url>
	</references>
	<dates>
	<discovery>2017-01-03</discovery>
	<entry>2017-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf">
	<topic>mysql -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.54</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.30</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.22</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.54</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.35</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL">
	<p>No further details have been provided in the Critical Patch Update</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL</url>
	<cvename>CVE-2016-8318</cvename>
	<cvename>CVE-2017-3312</cvename>
	<cvename>CVE-2017-3258</cvename>
	<cvename>CVE-2017-3273</cvename>
	<cvename>CVE-2017-3244</cvename>
	<cvename>CVE-2017-3257</cvename>
	<cvename>CVE-2017-3238</cvename>
	<cvename>CVE-2017-3256</cvename>
	<cvename>CVE-2017-3291</cvename>
	<cvename>CVE-2017-3265</cvename>
	<cvename>CVE-2017-3251</cvename>
	<cvename>CVE-2017-3313</cvename>
	<cvename>CVE-2017-3243</cvename>
	<cvename>CVE-2016-8327</cvename>
	<cvename>CVE-2017-3317</cvename>
	<cvename>CVE-2017-3318</cvename>
	<cvename>CVE-2017-3319</cvename>
	<cvename>CVE-2017-3320</cvename>
	</references>
	<dates>
	<discovery>2017-01-18</discovery>
	<entry>2017-01-18</entry>
	<modified>2017-03-14</modified>
	</dates>
	</vuln>

	<vuln vid="e3200958-dd6c-11e6-ae1b-002590263bf5">
	<topic>powerdns -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>powerdns</name>
	<range><lt>3.4.11</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.2</lt></range>
	</package>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>3.7.4</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS reports:</p>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/">
	<p>2016-02: Crafted queries can cause abnormal CPU usage</p>
	</blockquote>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/">
	<p>2016-03: Denial of service via the web server</p>
	</blockquote>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/">
	<p>2016-04: Insufficient validation of TSIG signatures</p>
	</blockquote>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/">
	<p>2016-05: Crafted zone record can cause a denial of service</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7068</cvename>
	<cvename>CVE-2016-7072</cvename>
	<cvename>CVE-2016-7073</cvename>
	<cvename>CVE-2016-7074</cvename>
	<cvename>CVE-2016-2120</cvename>
	<freebsdpr>ports/216135</freebsdpr>
	<freebsdpr>ports/216136</freebsdpr>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/</url>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/</url>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/</url>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/</url>
	<url>https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/</url>
	<url>https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/</url>
	</references>
	<dates>
	<discovery>2016-12-15</discovery>
	<entry>2017-01-18</entry>
	</dates>
	</vuln>

	<vuln vid="4af92a40-db33-11e6-ae1b-002590263bf5">
	<topic>groovy -- remote execution of untrusted code/DoS vulnerability</topic>
	<affects>
	<package>
	<name>groovy</name>
	<range><ge>1.7.0</ge><lt>2.4.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Groovy project reports:</p>
	<blockquote cite="http://groovy-lang.org/security.html">
	<p>When an application with Groovy on classpath uses standard Java
	serialization mechanisms, e.g. to communicate between servers or to
	store local data, it is possible for an attacker to bake a special
	serialized object that will execute code directly when deserialized.
	All applications which rely on serialization and do not isolate the
	code which deserializes objects are subject to this vulnerability.
	This is similar to CVE-2015-3253 but this exploit involves extra
	wrapping of objects and catching of exceptions which are now safe
	guarded against.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6814</cvename>
	<url>http://groovy-lang.org/security.html</url>
	</references>
	<dates>
	<discovery>2016-09-20</discovery>
	<entry>2017-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="6aa956fb-d97f-11e6-a071-001e67f15f5a">
	<topic>RabbitMQ -- Authentication vulnerability</topic>
	<affects>
	<package>
	<name>rabbitmq</name>
	<range><ge>3.0.0</ge><lt>3.5.8</lt></range>
	<range><ge>3.6.0</ge><lt>3.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pivotal.io reports:</p>
	<blockquote cite="https://pivotal.io/security/cve-2016-9877">
	<p>MQTT (MQ Telemetry Transport) connection authentication with a
	username/password pair succeeds if an existing username is
	provided but the password is omitted from the connection
	request. Connections that use TLS with a client-provided
	certificate are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9877</cvename>
	<url>https://pivotal.io/security/cve-2016-9877</url>
	<url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6</url>
	</references>
	<dates>
	<discovery>2016-12-06</discovery>
	<entry>2017-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="b180d1fb-dac6-11e6-ae1b-002590263bf5">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.7.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aaron D. Campbell reports:</p>
	<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/">
	<p>WordPress versions 4.7 and earlier are affected by eight security
	issues...</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5487</cvename>
	<cvename>CVE-2017-5488</cvename>
	<cvename>CVE-2017-5489</cvename>
	<cvename>CVE-2017-5490</cvename>
	<cvename>CVE-2017-5491</cvename>
	<cvename>CVE-2017-5492</cvename>
	<cvename>CVE-2017-5493</cvename>
	<url>http://www.openwall.com/lists/oss-security/2017/01/14/6</url>
	<url>https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2017-01-11</discovery>
	<entry>2017-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf">
	<topic>mysql -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html">
	<p>Local security vulnerability in 'Server: Packaging' sub component.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>93617</bid>
	<cvename>CVE-2016-5625</cvename>
	<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html</url>
	</references>
	<dates>
	<discovery>2016-10-18</discovery>
	<entry>2017-01-14</entry>
	<modified>2017-01-15</modified>
	</dates>
	</vuln>

	<vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-client</name>
	<name>mariadb55-server</name>
	<range><lt>5.5.52</lt></range>
	</package>
	<package>
	<name>mariadb100-client</name>
	<name>mariadb100-server</name>
	<range><lt>10.0.28</lt></range>
	</package>
	<package>
	<name>mariadb101-client</name>
	<name>mariadb101-server</name>
	<range><lt>10.1.18</lt></range>
	</package>
	<package>
	<name>mysql55-client</name>
	<name>mysql55-server</name>
	<range><lt>5.5.52</lt></range>
	</package>
	<package>
	<name>mysql56-client</name>
	<name>mysql56-server</name>
	<range><lt>5.6.33</lt></range>
	</package>
	<package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
	</package>
	<package>
	<name>percona55-client</name>
	<name>percona55-server</name>
	<range><lt>5.5.51.38.2</lt></range>
	</package>
	<package>
	<name>percona56-client</name>
	<name>percona56-server</name>
	<range><lt>5.6.32.78.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MySQL project reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">
	<ul>
	<li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer'
	sub component.</li>
	<li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with
	certain permissions to gain privileges by leveraging use of my_copystat
	by REPAIR TABLE to repair a MyISAM table.</li>
	<li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based
	logging, allows local users with access to the mysql account to gain
	root privileges via a symlink attack on error logs and possibly other
	files.</li>
	<li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub
	component.</li>
	<li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub
	component.</li>
	<li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated'
	sub component.</li>
	<li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub
	component.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>
	<cvename>CVE-2016-3492</cvename>
	<cvename>CVE-2016-5616</cvename>
	<cvename>CVE-2016-5617</cvename>
	<cvename>CVE-2016-5624</cvename>
	<cvename>CVE-2016-5626</cvename>
	<cvename>CVE-2016-5629</cvename>
	<cvename>CVE-2016-6663</cvename>
	<cvename>CVE-2016-6664</cvename>
	<cvename>CVE-2016-8283</cvename>
	</references>
	<dates>
	<discovery>2016-09-13</discovery>
	<entry>2017-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f">
	<topic>Ansible -- Command execution on Ansible controller from host</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><gt>1.9.6_1</gt><lt>2.2.0.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Computest reports:</p>
	<blockquote cite="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
	<p>Computest found and exploited several issues
	that allow a compromised host to execute commands
	on the Ansible controller and thus gain access
	to other hosts controlled by that controller.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9587</cvename>
	<url>https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt</url>
	<url>https://lwn.net/Articles/711357/</url>
	</references>
	<dates>
	<discovery>2017-01-09</discovery>
	<entry>2017-01-12</entry>
	</dates>
	</vuln>

	<vuln vid="7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b">
	<topic>phpmailer -- Remote Code Execution</topic>
	<affects>
	<package>
	<name>phpmailer</name>
	<range><lt>5.2.22</lt></range>
	</package>
	<package>
	<name>tt-rss</name>
	<range><lt>2017.01.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/95328/discuss">
	<p>PHPMailer is prone to an local information-disclosure vulnerability.
	Attackers can exploit this issue to obtain sensitive information
	that may aid in launching further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/bid/95328/discuss</url>
	<cvename>CVE-2017-5223</cvename>
	</references>
	<dates>
	<discovery>2017-01-10</discovery>
	<entry>2017-01-12</entry>
	</dates>
	</vuln>

	<vuln vid="d4c7e9a9-d893-11e6-9b4d-d050996490d0">
	<topic>BIND -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.9P5</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.4P5</lt></range>
	</package>
	<package>
	<name>bind911</name>
	<range><lt>9.11.0P2</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2016.12.28</le></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>10.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01439/0">
	<p>A malformed query response received by a recursive
	server in response to a query of RTYPE ANY could
	trigger an assertion failure while named is attempting
	to add the RRs in the query response to the cache.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01440/0">
	<p>Depending on the type of query and the EDNS options
	in the query they receive, DNSSEC-enabled authoritative
	servers are expected to include RRSIG and other RRsets
	in their responses to recursive servers.
	DNSSEC-validating servers will also make specific queries
	for DS and other RRsets.
	Whether DNSSEC-validating or not, an error in processing
	malformed query responses that contain DNSSEC-related
	RRsets that are inconsistent with other RRsets in the
	same query response can trigger an assertion failure.
	Although the combination of properties which triggers
	the assertion should not occur in normal traffic, it
	is potentially possible for the assertion to be triggered
	deliberately by an attacker sending a specially-constructed
	answer.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01441/0">
	<p>An unusually-formed answer containing a DS resource
	record could trigger an assertion failure. While the
	combination of properties which triggers the assertion
	should not occur in normal traffic, it is potentially
	possible for the assertion to be triggered deliberately
	by an attacker sending a specially-constructed answer
	having the required properties.</p>
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01442/0">
	<p>An error in handling certain queries can cause an
	assertion failure when a server is using the
	nxdomain-redirect feature to cover a zone for which
	it is also providing authoritative service.
	A vulnerable server could be intentionally stopped
	by an attacker if it was using a configuration that
	met the criteria for the vulnerability and if the
	attacker could cause it to accept a query that
	possessed the required attributes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9131</cvename>
	<cvename>CVE-2016-9147</cvename>
	<cvename>CVE-2016-9444</cvename>
	<cvename>CVE-2016-9778</cvename>
	<url>https://kb.isc.org/article/AA-01439/0</url>
	<url>https://kb.isc.org/article/AA-01440/0</url>
	<url>https://kb.isc.org/article/AA-01441/0</url>
	<url>https://kb.isc.org/article/AA-01442/0</url>
	</references>
	<dates>
	<discovery>2017-01-11</discovery>
	<entry>2017-01-12</entry>
	</dates>
	</vuln>

	<vuln vid="2c948527-d823-11e6-9171-14dae9d210b8">
	<topic>FreeBSD -- OpenSSH multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><lt>7.3.p1_5,1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_7</lt></range>
	<range><ge>10.3</ge><lt>10.3_16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The ssh-agent(1) agent supports loading a PKCS#11 module
	from outside a trusted whitelist. An attacker can request
	loading of a PKCS#11 module across forwarded agent-socket.
	[CVE-2016-10009]</p>
	<p>When privilege separation is disabled, forwarded Unix
	domain sockets would be created by sshd(8) with the privileges
	of 'root' instead of the authenticated user. [CVE-2016-10010]</p>
	<h1>Impact:</h1>
	<p>A remote attacker who have control of a forwarded
	agent-socket on a remote system and have the ability to
	write files on the system running ssh-agent(1) agent can
	run arbitrary code under the same user credential. Because
	the attacker must already have some control on both systems,
	it is relatively hard to exploit this vulnerability in a
	practical attack. [CVE-2016-10009]</p>
	<p>When privilege separation is disabled (on FreeBSD,
	privilege separation is enabled by default and has to be
	explicitly disabled), an authenticated attacker can potentially
	gain root privileges on systems running OpenSSH server.
	[CVE-2016-10010]</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10009</cvename>
	<cvename>CVE-2016-10010</cvename>
	<freebsdsa>SA-17:01.openssh</freebsdsa>
	</references>
	<dates>
	<discovery>2017-01-11</discovery>
	<entry>2017-01-11</entry>
	<modified>2017-01-13</modified>
	</dates>
	</vuln>

	<vuln vid="7caebe30-d7f1-11e6-a9a5-b499baebfeaf">
	<topic>openssl -- timing attack vulnerability</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><lt>2.4.4_1</lt></range>
	</package>
	<package>
	<name>libressl-devel</name>
	<range><lt>2.5.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cesar Pereida Garcia reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2017/q1/52">
	<p>The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL
	versions and forks is vulnerable to timing attacks when signing with the
	standardized elliptic curve P-256 despite featuring constant-time curve
	operations and modular inversion. A software defect omits setting the
	BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in
	the BN_mod_inverse method and therefore resulting in a cache-timing attack
	vulnerability.<br/>
	A malicious user with local access can recover ECDSA P-256 private keys.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2017/q1/52</url>
	<cvename>CVE-2016-7056</cvename>
	</references>
	<dates>
	<discovery>2017-01-10</discovery>
	<entry>2017-01-11</entry>
	<modified>2017-01-11</modified>
	</dates>
	</vuln>

	<vuln vid="2a7bdc56-d7a3-11e6-ae1b-002590263bf5">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplayer</name>
	<range><lt>24.0.0.194</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-02.html">
	<p>These updates resolve a security bypass vulnerability that could
	lead to information disclosure (CVE-2017-2938).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2017-2932, CVE-2017-2936,
	CVE-2017-2937).</p>
	<p>These updates resolve heap buffer overflow vulnerabilities that
	could lead to code execution (CVE-2017-2927, CVE-2017-2933,
	CVE-2017-2934, CVE-2017-2935).</p>
	<p>These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928,
	CVE-2017-2930, CVE-2017-2931).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-2925</cvename>
	<cvename>CVE-2017-2926</cvename>
	<cvename>CVE-2017-2927</cvename>
	<cvename>CVE-2017-2928</cvename>
	<cvename>CVE-2017-2930</cvename>
	<cvename>CVE-2017-2931</cvename>
	<cvename>CVE-2017-2932</cvename>
	<cvename>CVE-2017-2933</cvename>
	<cvename>CVE-2017-2934</cvename>
	<cvename>CVE-2017-2935</cvename>
	<cvename>CVE-2017-2936</cvename>
	<cvename>CVE-2017-2937</cvename>
	<cvename>CVE-2017-2938</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb17-02.html</url>
	</references>
	<dates>
	<discovery>2017-01-10</discovery>
	<entry>2017-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="ab804e60-d693-11e6-9171-14dae9d210b8">
	<topic>moinmoin -- XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.9.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thomas Waldmann reports:</p>
	<blockquote cite="http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES">
	<ul>
	<li><p>fix XSS in AttachFile view (multifile related) CVE-2016-7148</p></li>
	<li><p>fix XSS in GUI editor's attachment dialogue CVE-2016-7146</p></li>
	<li><p>fix XSS in GUI editor's link dialogue CVE-2016-9119</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES</url>
	<cvename>CVE-2016-7148</cvename>
	<cvename>CVE-2016-7146</cvename>
	<cvename>CVE-2016-9119</cvename>
	<freebsdpr>ports/214937</freebsdpr>
	</references>
	<dates>
	<discovery>2016-10-31</discovery>
	<entry>2017-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="64be967a-d379-11e6-a071-001e67f15f5a">
	<topic>libvncserver -- multiple buffer overflows</topic>
	<affects>
	<package>
	<name>libvncserver</name>
	<range><lt>0.9.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libvnc server reports:</p>
	<blockquote cite="https://github.com/LibVNC/libvncserver/pull/137">
	<p>Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/LibVNC/libvncserver/pull/137</url>
	<cvename>CVE-2016-9941</cvename>
	<cvename>CVE-2016-9942</cvename>
	<freebsdpr>ports/215805</freebsdpr>
	</references>
	<dates>
	<discovery>2016-11-24</discovery>
	<entry>2017-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="83041ca7-d690-11e6-9171-14dae9d210b8">
	<topic>libdwarf -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libdwarf</name>
	<range><lt>20161124</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Christian Rebischke reports:</p>
	<blockquote cite="https://lwn.net/Articles/708092/">
	<p>libdwarf is vulnerable to multiple issues including
	arbitrary code execution, information disclosure and denial of
	service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lwn.net/Articles/708092/</url>
	<cvename>CVE-2016-5027</cvename>
	<cvename>CVE-2016-5028</cvename>
	<cvename>CVE-2016-5029</cvename>
	<cvename>CVE-2016-5030</cvename>
	<cvename>CVE-2016-5031</cvename>
	<cvename>CVE-2016-5032</cvename>
	<cvename>CVE-2016-5033</cvename>
	<cvename>CVE-2016-5035</cvename>
	<cvename>CVE-2016-5037</cvename>
	<cvename>CVE-2016-5040</cvename>
	<cvename>CVE-2016-5041</cvename>
	<cvename>CVE-2016-5043</cvename>
	<cvename>CVE-2016-5044</cvename>
	<cvename>CVE-2016-7510</cvename>
	<cvename>CVE-2016-7511</cvename>
	<cvename>CVE-2016-8679</cvename>
	<cvename>CVE-2016-8680</cvename>
	<cvename>CVE-2016-8681</cvename>
	<cvename>CVE-2016-9275</cvename>
	<cvename>CVE-2016-9276</cvename>
	<cvename>CVE-2016-9480</cvename>
	<cvename>CVE-2016-9558</cvename>
	</references>
	<dates>
	<discovery>2016-12-04</discovery>
	<entry>2017-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="03532a19-d68e-11e6-9171-14dae9d210b8">
	<topic>lynx -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>lynx</name>
	<range><lt>2.8.8.2_5,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote>
	<p>Lynx is vulnerable to POODLE by still supporting vulnerable
	version of SSL. Lynx is also vulnerable to URL attacks by incorrectly
	parsing hostnames ending with an '?'.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch</url>
	<url>https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch</url>
	<cvename>CVE-2014-3566</cvename>
	<cvename>CVE-2016-9179</cvename>
	<freebsdpr>ports/215464</freebsdpr>
	</references>
	<dates>
	<discovery>2016-10-26</discovery>
	<entry>2017-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="91e039ed-d689-11e6-9171-14dae9d210b8">
	<topic>hdf5 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>hdf5</name>
	<range><lt>1.10.0</lt></range>
	</package>
	<package>
	<name>hdf5-18</name>
	<range><lt>1.8.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos Security reports:</p>
	<blockquote cite="http://blog.talosintel.com/2016/11/hdf5-vulns.html">
	<ul>
	<li><p>CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability</p></li>
	<li><p>CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability</p></li>
	<li><p>CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability</p></li>
	<li><p>CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.talosintel.com/2016/11/hdf5-vulns.html</url>
	<cvename>CVE-2016-4330</cvename>
	<cvename>CVE-2016-4331</cvename>
	<cvename>CVE-2016-4332</cvename>
	<cvename>CVE-2016-4333</cvename>
	</references>
	<dates>
	<discovery>2016-11-17</discovery>
	<entry>2017-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="e1ff4c5e-d687-11e6-9171-14dae9d210b8">
	<topic>End of Life Ports</topic>
	<affects>
	<package>
	<name>py27-django16</name>
	<name>py33-django16</name>
	<name>py34-django16</name>
	<name>py35-django16</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>These packages have reached End of Life status and/or have
	been removed from the Ports Tree. They may contain undocumented
	security issues. Please take caution and find alternative
	software as soon as possible.</p>
	</body>
	</description>
	<references>
	<freebsdpr>ports/211975</freebsdpr>
	</references>
	<dates>
	<discovery>2017-01-06</discovery>
	<entry>2017-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="c218873d-d444-11e6-84ef-f0def167eeea">
	<topic>Use-After-Free Vulnerability in pcsc-lite</topic>
	<affects>
	<package>
	<name>pcsc-lite</name>
	<range><ge>1.6.0</ge><lt>1.8.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Peter Wu on Openwall mailing-list reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/03/2">
	<p>The issue allows a local attacker to cause a Denial of Service,
	but can potentially result in Privilege Escalation since
	the daemon is running as root. while any local user can
	connect to the Unix socket.
	Fixed by patch which is released with hpcsc-lite 1.8.20.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10109</cvename>
	<url>http://www.openwall.com/lists/oss-security/2017/01/03/2</url>
	</references>
	<dates>
	<discovery>2017-01-03</discovery>
	<entry>2017-01-06</entry>
	<modified>2017-01-10</modified>
	</dates>
	</vuln>

	<vuln vid="0c5369fc-d671-11e6-a9a5-b499baebfeaf">
	<topic>GnuTLS -- Memory corruption vulnerabilities</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>3.5.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GnuTLS project reports:</p>
	<blockquote cite="http://www.gnutls.org/news.html#2017-01-09">
	<ul>
	<li>It was found using the OSS-FUZZ fuzzer infrastructure that
	decoding a specially crafted OpenPGP certificate could lead
	to heap and stack overflows. (GNUTLS-SA-2017-2)</li>
	<li>It was found using the OSS-FUZZ fuzzer infrastructure that
	decoding a specially crafted X.509 certificate with Proxy
	Certificate Information extension present could lead to a
	double free. (GNUTLS-SA-2017-1)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.gnutls.org/news.html#2017-01-09</url>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-2</url>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-1</url>
	</references>
	<dates>
	<discovery>2017-01-09</discovery>
	<entry>2017-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5">
	<topic>tomcat -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><lt>6.0.49</lt></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.74</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.40</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">
	<p>Important: Information Disclosure CVE-2016-8745</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-8745</cvename>
	<freebsdpr>ports/215865</freebsdpr>
	<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>
	<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>
	<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>
	</references>
	<dates>
	<discovery>2017-01-05</discovery>
	<entry>2017-01-07</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><lt>6.0.48</lt></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.73</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.39</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">
	<p>Important: Remote Code Execution CVE-2016-8735</p>
	<p>Important: Information Disclosure CVE-2016-6816</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-8735</cvename>
	<cvename>CVE-2016-6816</cvename>
	<freebsdpr>ports/214599</freebsdpr>
	<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>
	<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>
	<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2017-01-07</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><lt>6.0.47</lt></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.72</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.37</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
	<p>Low: Unrestricted Access to Global Resources CVE-2016-6797</p>
	<p>Low: Security Manager Bypass CVE-2016-6796</p>
	<p>Low: System Property Disclosure CVE-2016-6794</p>
	<p>Low: Security Manager Bypass CVE-2016-5018</p>
	<p>Low: Timing Attack CVE-2016-0762</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6797</cvename>
	<cvename>CVE-2016-6796</cvename>
	<cvename>CVE-2016-6794</cvename>
	<cvename>CVE-2016-5018</cvename>
	<cvename>CVE-2016-0762</cvename>
	<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>
	<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>
	<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>
	</references>
	<dates>
	<discovery>2016-10-27</discovery>
	<entry>2017-01-07</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a">
	<topic>Irssi -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>0.8.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Irssi reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_01.txt">
	<p>Five vulnerabilities have been located in Irssi</p>
	<ul>
	<li>A NULL pointer dereference in the nickcmp function found by
	Joseph Bisch. (CWE-690)</li>
	<li>Use after free when receiving invalid nick message (Issue #466,
	CWE-146)</li>
	<li>Out of bounds read in certain incomplete control codes found
	by Joseph Bisch. (CWE-126)</li>
	<li>Out of bounds read in certain incomplete character sequences
	found by Hanno Böck and independently by J. Bisch. (CWE-126)</li>
	<li>Out of bounds read when Printing the value '%['. Found by
	Hanno Böck. (CWE-126)</li>
	</ul>
	<p>These issues may result in denial of service (remote crash).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2017-5193</cvename>
	<cvename>CVE-2017-5194</cvename>
	<cvename>CVE-2017-5195</cvename>
	<cvename>CVE-2017-5196</cvename>
	<cvename>CVE-2017-5356</cvename>
	<freebsdpr>ports/215800</freebsdpr>
	<url>https://irssi.org/security/irssi_sa_2017_01.txt</url>
	</references>
	<dates>
	<discovery>2017-01-03</discovery>
	<entry>2017-01-05</entry>
	<modified>2017-01-15</modified>
	</dates>
	</vuln>

	<vuln vid="496160d3-d3be-11e6-ae1b-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>3.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	<p>Fixed a number of new vulnerabilities in Security Library method
	xss_clean().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.codeigniter.com/user_guide/changelog.html</url>
	</references>
	<dates>
	<discovery>2016-10-28</discovery>
	<entry>2017-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="5e439ee7-d3bd-11e6-ae1b-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>3.1.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	<p>Fixed an SQL injection in the ‘odbc’ database driver.</p>
	<p>Updated set_realpath() Path Helper function to filter-out php://
	wrapper inputs.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.codeigniter.com/user_guide/changelog.html</url>
	</references>
	<dates>
	<discovery>2016-07-26</discovery>
	<entry>2017-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="eafa3aec-211b-4dd4-9b8a-a664a3f0917a">
	<topic>w3m -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>w3m</name>
	<name>w3m-img</name>
	<name>ja-w3m</name>
	<name>ja-w3m-img</name>
	<range><lt>0.5.3.20170102</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple remote code execution and denial of service conditions present.</p>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2016/q4/452</url>
	<url>http://seclists.org/oss-sec/2016/q4/516</url>
	<cvename>CVE-2016-9422</cvename>
	<cvename>CVE-2016-9423</cvename>
	<cvename>CVE-2016-9424</cvename>
	<cvename>CVE-2016-9425</cvename>
	<cvename>CVE-2016-9426</cvename>
	<cvename>CVE-2016-9428</cvename>
	<cvename>CVE-2016-9429</cvename>
	<cvename>CVE-2016-9430</cvename>
	<cvename>CVE-2016-9431</cvename>
	<cvename>CVE-2016-9432</cvename>
	<cvename>CVE-2016-9433</cvename>
	<cvename>CVE-2016-9434</cvename>
	<cvename>CVE-2016-9435</cvename>
	<cvename>CVE-2016-9436</cvename>
	<cvename>CVE-2016-9437</cvename>
	<cvename>CVE-2016-9438</cvename>
	<cvename>CVE-2016-9439</cvename>
	<cvename>CVE-2016-9440</cvename>
	<cvename>CVE-2016-9441</cvename>
	<cvename>CVE-2016-9442</cvename>
	<cvename>CVE-2016-9443</cvename>
	<cvename>CVE-2016-9622</cvename>
	<cvename>CVE-2016-9623</cvename>
	<cvename>CVE-2016-9624</cvename>
	<cvename>CVE-2016-9625</cvename>
	<cvename>CVE-2016-9626</cvename>
	<cvename>CVE-2016-9627</cvename>
	<cvename>CVE-2016-9628</cvename>
	<cvename>CVE-2016-9629</cvename>
	<cvename>CVE-2016-9630</cvename>
	<cvename>CVE-2016-9631</cvename>
	<cvename>CVE-2016-9632</cvename>
	<cvename>CVE-2016-9633</cvename>
	</references>
	<dates>
	<discovery>2016-11-03</discovery>
	<entry>2017-01-01</entry>
	<modified>2017-01-09</modified>
	</dates>
	</vuln>

	<vuln vid="d0b12952-cb86-11e6-906f-0cc47a065786">
	<topic>h2o -- Use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range><lt>2.0.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kazuho Oku reports:</p>
	<blockquote cite="https://github.com/h2o/h2o/issues?q=label%3Avulnerability">
	<p>A use-after-free vulnerability exists in H2O up to and including
	version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to
	mount DoS attacks and / or information theft.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/h2o/h2o/releases/tag/v2.0.5</url>
	<url>https://github.com/h2o/h2o/issues/1144</url>
	</references>
	<dates>
	<discovery>2016-09-09</discovery>
	<entry>2016-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="1b61ecef-cdb9-11e6-a9a5-b499baebfeaf">
	<topic>PHP -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70</name>
	<range><lt>7.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Check Point reports:</p>
	<blockquote cite="http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/">
	<p>... discovered 3 fresh and previously unknown vulnerabilities
	(CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7
	unserialize mechanism.</p>
	<p>The first two vulnerabilities allow attackers to take full control
	over servers, allowing them to do anything they want with the
	website, from spreading malware to defacing it or stealing customer
	data.</p>
	<p>The last vulnerability generates a Denial of Service attack which
	basically hangs the website, exhausts its memory consumption, and
	shuts it down.</p>
	<p>The PHP security team issued fixes for two of the vulnerabilities
	on the 13th of October and 1st of December.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/</url>
	<cvename>CVE-2016-7478</cvename>
	<cvename>CVE-2016-7479</cvename>
	<cvename>CVE-2016-7480</cvename>
	</references>
	<dates>
	<discovery>2016-12-27</discovery>
	<entry>2016-12-29</entry>
	<modified>2017-01-04</modified>
	</dates>
	</vuln>

	<vuln vid="6972668d-cdb7-11e6-a9a5-b499baebfeaf">
	<topic>PHP -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70</name>
	<range><lt>7.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.14">
	<ul>
	<li>Use After Free Vulnerability in unserialize() (CVE-2016-9936)</li>
	<li>Invalid read when wddx decodes empty boolean element
	(CVE-2016-9935)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-7.php#7.0.14</url>
	<cvename>CVE-2016-9935</cvename>
	<cvename>CVE-2016-9936</cvename>
	</references>
	<dates>
	<discovery>2016-12-08</discovery>
	<entry>2016-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="3c4693de-ccf7-11e6-a9a5-b499baebfeaf">
	<topic>phpmailer -- Remote Code Execution</topic>
	<affects>
	<package>
	<name>phpmailer</name>
	<range><lt>5.2.20</lt></range>
	</package>
	<package>
	<name>tt-rss</name>
	<range><lt>29.12.2016.04.37</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Legal Hackers reports:</p>
	<blockquote cite="https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html">
	<p>An independent research uncovered a critical vulnerability in
	PHPMailer that could potentially be used by (unauthenticated)
	remote attackers to achieve remote arbitrary code execution in
	the context of the web server user and remotely compromise the
	target web application.</p>
	<p>To exploit the vulnerability an attacker could target common
	website components such as contact/feedback forms, registration
	forms, password email resets and others that send out emails with
	the help of a vulnerable version of the PHPMailer class.</p>
	<p>The first patch of the vulnerability CVE-2016-10033 was incomplete.
	This advisory demonstrates the bypass of the patch. The bypass allows
	to carry out Remote Code Execution on all current versions (including
	5.2.19).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html</url>
	<cvename>CVE-2016-10045</cvename>
	</references>
	<dates>
	<discovery>2016-12-28</discovery>
	<entry>2016-12-28</entry>
	</dates>
	</vuln>

	<vuln vid="e4bc323f-cc73-11e6-b704-000c292e4fd8">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
	</package>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
	</package>
	<package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><le>4.2.14</le></range>
	</package>
	<package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.13</lt></range>
	</package>
	<package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.8</lt></range>
	</package>
	<package>
	<name>samba45</name>
	<range><ge>4.5.0</ge><lt>4.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba team reports:</p>
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.5.3">
	<p>[CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes
	on DNS objects and trigger a controlled memory corruption.</p>
	<p>[CVE-2016-2125] Samba client code always requests a forwardable ticket
	when using Kerberos authentication. This means the target server, which must be in the current or trusted
	domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to
	fully impersonate the authenticated user or service.</p>
	<p>[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process
	to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum.
	A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2123</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2123.html</url>
	<cvename>CVE-2016-2125</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2125.html</url>
	<cvename>CVE-2016-2126</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2126.html</url>
	</references>
	<dates>
	<discovery>2016-12-19</discovery>
	<entry>2016-12-26</entry>
	<modified>2016-12-26</modified>
	</dates>
	</vuln>

	<vuln vid="244c8288-cc4a-11e6-a475-bcaec524bf84">
	<topic>upnp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>upnp</name>
	<range><lt>1.6.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthew Garett reports:</p>
	<blockquote cite="https://twitter.com/mjg59/status/755062278513319936">
	<p>Reported this to upstream 8 months ago without response,
	so: libupnp's default behaviour allows anyone to write to your
	filesystem. Seriously. Find a device running a libupnp based server
	(Shodan says there's rather a lot), and POST a file to /testfile.
	Then GET /testfile ... and yeah if the server is running as root
	(it is) and is using / as the web root (probably not, but maybe)
	this gives full host fs access.</p>
	</blockquote>
	<p>Scott Tenaglia reports:</p>
	<blockquote cite="https://sourceforge.net/p/pupnp/bugs/133/">
	<p>There is a heap buffer overflow vulnerability in the
	create_url_list function in upnp/src/gena/gena_device.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://twitter.com/mjg59/status/755062278513319936</url>
	<url>https://sourceforge.net/p/pupnp/bugs/133/</url>
	<cvename>CVE-2016-6255</cvename>
	<cvename>CVE-2016-8863</cvename>
	</references>
	<dates>
	<discovery>2016-02-23</discovery>
	<entry>2016-12-27</entry>
	</dates>
	</vuln>

	<vuln vid="c7656d4c-cb60-11e6-a9a5-b499baebfeaf">
	<topic>phpmailer -- Remote Code Execution</topic>
	<affects>
	<package>
	<name>phpmailer</name>
	<range><lt>5.2.18</lt></range>
	</package>
	<package>
	<name>tt-rss</name>
	<range><lt>26.12.2016.07.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Legal Hackers reports:</p>
	<blockquote cite="http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html">
	<p>An independent research uncovered a critical vulnerability in
	PHPMailer that could potentially be used by (unauthenticated)
	remote attackers to achieve remote arbitrary code execution in
	the context of the web server user and remotely compromise the
	target web application.</p>
	<p>To exploit the vulnerability an attacker could target common
	website components such as contact/feedback forms, registration
	forms, password email resets and others that send out emails with
	the help of a vulnerable version of the PHPMailer class.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html</url>
	<url>https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md</url>
	<cvename>CVE-2016-10033</cvename>
	</references>
	<dates>
	<discovery>2016-12-26</discovery>
	<entry>2016-12-26</entry>
	</dates>
	</vuln>

	<vuln vid="e7002b26-caaa-11e6-a76a-9f7324e5534e">
	<topic>exim -- DKIM private key leak</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><gt>4.69</gt><lt>4.87.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Exim project reports:</p>
	<blockquote cite="https://exim.org/static/doc/CVE-2016-9963.txt">
	<p>Exim leaks the private DKIM signing key to the log files.
	Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used,
	the key material is included in the bounce message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://exim.org/static/doc/CVE-2016-9963.txt</url>
	<cvename>CVE-2016-9963</cvename>
	</references>
	<dates>
	<discovery>2016-12-15</discovery>
	<entry>2016-12-25</entry>
	</dates>
	</vuln>

	<vuln vid="2aedd15f-ca8b-11e6-a9a5-b499baebfeaf">
	<cancelled superseded="2c948527-d823-11e6-9171-14dae9d210b8"/>
	</vuln>

	<vuln vid="c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4">
	<topic>cURL -- uninitialized random vulnerability</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.52.0</ge><lt>7.52.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Project curl Security Advisory:</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20161223.html">
	<p>libcurl's (new) internal function that returns a good 32bit
	random value was implemented poorly and overwrote the pointer
	instead of writing the value into the buffer the pointer
	pointed to.</p>
	<p>This random value is used to generate nonces for Digest and
	NTLM authentication, for generating boundary strings in HTTP
	formposts and more. Having a weak or virtually non-existent
	random there makes these operations vulnerable.</p>
	<p>This function is brand new in 7.52.0 and is the result of an
	overhaul to make sure libcurl uses strong random as much as
	possible - provided by the backend TLS crypto libraries when
	present. The faulty function was introduced in this commit.</p>
	<p>We are not aware of any exploit of this flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_20161223.html</url>
	<cvename>CVE-2016-9594</cvename>
	</references>
	<dates>
	<discovery>2016-12-23</discovery>
	<entry>2016-12-24</entry>
	</dates>
	</vuln>

	<vuln vid="41f8af15-c8b9-11e6-ae1b-002590263bf5">
	<topic>squid -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.1</ge><lt>3.5.23</lt></range>
	</package>
	<package>
	<name>squid-devel</name>
	<range><ge>4.0</ge><lt>4.0.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2016:10 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_10.txt">
	<p>Due to incorrect comparison of request headers Squid can deliver
	responses containing private data to clients it should not have
	reached.</p>
	<p>This problem allows a remote attacker to discover private and
	sensitive information about another clients browsing session.
	Potentially including credentials which allow access to further
	sensitive resources. This problem only affects Squid configured
	to use the Collapsed Forwarding feature. It is of particular
	importance for HTTPS reverse-proxy sites with Collapsed
	Forwarding.</p>
	</blockquote>
	<p>Squid security advisory 2016:11 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_11.txt">
	<p>Due to incorrect HTTP conditional request handling Squid can
	deliver responses containing private data to clients it should not
	have reached.</p>
	<p>This problem allows a remote attacker to discover private and
	sensitive information about another clients browsing session.
	Potentially including credentials which allow access to further
	sensitive resources..</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10002</cvename>
	<cvename>CVE-2016-10003</cvename>
	<freebsdpr>ports/215416</freebsdpr>
	<freebsdpr>ports/215418</freebsdpr>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_10.txt</url>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_11.txt</url>
	</references>
	<dates>
	<discovery>2016-12-16</discovery>
	<entry>2016-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="c11629d3-c8ad-11e6-ae1b-002590263bf5">
	<topic>vim -- arbitrary command execution</topic>
	<affects>
	<package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<range><lt>8.0.0056</lt></range>
	</package>
	<package>
	<name>neovim</name>
	<range><lt>0.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248">
	<p>vim before patch 8.0.0056 does not properly validate values for the
	'filetype', 'syntax' and 'keymap' options, which may result in the
	execution of arbitrary code if a file with a specially crafted
	modeline is opened.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1248</cvename>
	<bid>94478</bid>
	<url>https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a</url>
	<url>https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="c290f093-c89e-11e6-821e-68f7288bdf41">
	<topic>Pligg CMS -- XSS Vulnerability</topic>
	<affects>
	<package>
	<name>pligg</name>
	<range><le>2.0.2,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netsparker reports: </p>
	<blockquote cite="https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/">
	<p>Proof of Concept URL for XSS in Pligg CMS:</p>
	<p>Page: groups.php</p>
	<p>Parameter Name: keyword</p>
	<p>Parameter Type: GET</p>
	<p>Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'</p>
	<p>For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/</url>
	</references>
	<dates>
	<discovery>2015-05-13</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="fcedcdbb-c86e-11e6-b1cf-14dae9d210b8">
	<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_6</lt></range>
	<range><ge>10.3</ge><lt>10.3_15</lt></range>
	<range><ge>10.2</ge><lt>10.2_28</lt></range>
	<range><ge>10.1</ge><lt>10.1_45</lt></range>
	<range><ge>9.3</ge><lt>9.3_53</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Multiple vulnerabilities have been discovered in the NTP
	suite:</p>
	<p>CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy
	of Cisco ASIG.</p>
	<p>CVE-2016-9310: Mode 6 unauthenticated trap information
	disclosure and DDoS vector. Reported by Matthew Van Gundy
	of Cisco ASIG.</p>
	<p>CVE-2016-7427: Broadcast Mode Replay Prevention DoS.
	Reported by Matthew Van Gundy of Cisco ASIG.</p>
	<p>CVE-2016-7428: Broadcast Mode Poll Interval Enforcement
	DoS. Reported by Matthew Van Gundy of Cisco ASIG.</p>
	<p>CVE-2016-7431: Regression: 010-origin: Zero Origin
	Timestamp Bypass. Reported by Sharon Goldberg and Aanchal
	Malhotra of Boston University.</p>
	<p>CVE-2016-7434: Null pointer dereference in
	_IO_str_init_static_internal(). Reported by Magnus Stubman.</p>
	<p>CVE-2016-7426: Client rate limiting and server responses.
	Reported by Miroslav Lichvar of Red Hat.</p>
	<p>CVE-2016-7433: Reboot sync calculation problem. Reported
	independently by Brian Utterback of Oracle, and by Sharon
	Goldberg and Aanchal Malhotra of Boston University.</p>
	<h1>Impact:</h1>
	<p>A remote attacker who can send a specially crafted packet
	to cause a NULL pointer dereference that will crash ntpd,
	resulting in a Denial of Service. [CVE-2016-9311]</p>
	<p>An exploitable configuration modification vulnerability
	exists in the control mode (mode 6) functionality of ntpd.
	If, against long-standing BCP recommendations, "restrict
	default noquery ..." is not specified, a specially crafted
	control mode packet can set ntpd traps, providing information
	disclosure and DDoS amplification, and unset ntpd traps,
	disabling legitimate monitoring by an attacker from remote.
	[CVE-2016-9310]</p>
	<p>An attacker with access to the NTP broadcast domain can
	periodically inject specially crafted broadcast mode NTP
	packets into the broadcast domain which, while being logged
	by ntpd, can cause ntpd to reject broadcast mode packets
	from legitimate NTP broadcast servers. [CVE-2016-7427]</p>
	<p>An attacker with access to the NTP broadcast domain can
	send specially crafted broadcast mode NTP packets to the
	broadcast domain which, while being logged by ntpd, will
	cause ntpd to reject broadcast mode packets from legitimate
	NTP broadcast servers. [CVE-2016-7428]</p>
	<p>Origin timestamp problems were fixed in ntp 4.2.8p6.
	However, subsequent timestamp validation checks introduced
	a regression in the handling of some Zero origin timestamp
	checks. [CVE-2016-7431]</p>
	<p>If ntpd is configured to allow mrulist query requests
	from a server that sends a crafted malicious packet, ntpd
	will crash on receipt of that crafted malicious mrulist
	query packet. [CVE-2016-7434]</p>
	<p>An attacker who knows the sources (e.g., from an IPv4
	refid in server response) and knows the system is (mis)configured
	in this way can periodically send packets with spoofed
	source address to keep the rate limiting activated and
	prevent ntpd from accepting valid responses from its sources.
	[CVE-2016-7426]</p>
	<p>Ntp Bug 2085 described a condition where the root delay
	was included twice, causing the jitter value to be higher
	than expected. Due to a misinterpretation of a small-print
	variable in The Book, the fix for this problem was incorrect,
	resulting in a root distance that did not include the peer
	dispersion. The calculations and formulas have been reviewed
	and reconciled, and the code has been updated accordingly.
	[CVE-2016-7433]</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7426</cvename>
	<cvename>CVE-2016-7427</cvename>
	<cvename>CVE-2016-7428</cvename>
	<cvename>CVE-2016-7431</cvename>
	<cvename>CVE-2016-7433</cvename>
	<cvename>CVE-2016-7434</cvename>
	<cvename>CVE-2016-9310</cvename>
	<cvename>CVE-2016-9311</cvename>
	<freebsdsa>SA-16:39.ntp</freebsdsa>
	</references>
	<dates>
	<discovery>2016-12-22</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="42880202-c81c-11e6-a9a5-b499baebfeaf">
	<topic>cURL -- buffer overflow</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.1</ge><lt>7.52</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/vuln-7.51.0.html">
	<h2>printf floating point buffer overflow</h2>
	<p>libcurl's implementation of the printf() functions triggers a
	buffer overflow when doing a large floating point output. The bug
	occurs when the conversion outputs more than 255 bytes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/vuln-7.51.0.html</url>
	<cvename>CVE-2016-9586</cvename>
	</references>
	<dates>
	<discovery>2016-12-21</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="624b45c0-c7f3-11e6-ae1b-002590263bf5">
	<topic>Joomla! -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>1.6.0</ge><lt>3.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html">
	<h2>[20161201] - Core - Elevated Privileges</h2>
	<p>Incorrect use of unfiltered data stored to the session on a form
	validation failure allows for existing user accounts to be modified;
	to include resetting their username, password, and user group
	assignments.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html">
	<h2>[20161202] - Core - Shell Upload</h2>
	<p>Inadequate filesystem checks allowed files with alternative PHP
	file extensions to be uploaded.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html">
	<h2>[20161203] - Core - Information Disclosure</h2>
	<p>Inadequate ACL checks in the Beez3 com_content article layout
	override enables a user to view restricted content.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9836</cvename>
	<cvename>CVE-2016-9837</cvename>
	<cvename>CVE-2016-9838</cvename>
	<url>https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html</url>
	<url>https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html</url>
	<url>https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html</url>
	<url>https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html</url>
	</references>
	<dates>
	<discovery>2016-12-06</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="a27d234a-c7f2-11e6-ae1b-002590263bf5">
	<topic>Joomla! -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.4.4</ge><lt>3.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html">
	<h2>[20161001] - Core - Account Creation</h2>
	<p>Inadequate checks allows for users to register on a site when
	registration has been disabled.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html">
	<h2>[20161002] - Core - Elevated Privilege</h2>
	<p>Incorrect use of unfiltered data allows for users to register on a
	site with elevated privileges.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html">
	<h2>[20161003] - Core - Account Modifications</h2>
	<p>Incorrect use of unfiltered data allows for existing user accounts
	to be modified; to include resetting their username, password, and
	user group assignments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-8869</cvename>
	<cvename>CVE-2016-8870</cvename>
	<cvename>CVE-2016-9081</cvename>
	<url>https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html</url>
	<url>https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html</url>
	<url>https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html</url>
	<url>https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html</url>
	</references>
	<dates>
	<discovery>2016-10-25</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="f0806cad-c7f1-11e6-ae1b-002590263bf5">
	<topic>Joomla! -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>1.6.0</ge><lt>3.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html">
	<h2>[20160801] - Core - ACL Violation</h2>
	<p>Inadequate ACL checks in com_content provide potential read access
	to data which should be access restricted to users with edit_own
	level.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html">
	<h2>[20160802] - Core - XSS Vulnerability</h2>
	<p>Inadequate escaping leads to XSS vulnerability in mail component.
	</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/654-20160803-core-csrf.html">
	<h2>[20160803] - Core - CSRF</h2>
	<p>Add additional CSRF hardening in com_joomlaupdate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html</url>
	<url>https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html</url>
	<url>https://developer.joomla.org/security-centre/654-20160803-core-csrf.html</url>
	<url>https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html</url>
	</references>
	<dates>
	<discovery>2016-08-03</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="c0ef061a-c7f0-11e6-ae1b-002590263bf5">
	<topic>Joomla! -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>1.5.0</ge><lt>3.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html">
	<h2>[20151206] - Core - Session Hardening</h2>
	<p>The Joomla Security Strike team has been following up on the
	critical security vulnerability patched last week. Since the recent
	update it has become clear that the root cause is a bug in PHP
	itself. This was fixed by PHP in September of 2015 with the releases
	of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all
	versions of PHP 7 and has been back-ported in some specific Linux
	LTS versions of PHP 5.3). This fixes the bug across all supported
	PHP versions.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html">
	<h2>[20151207] - Core - SQL Injection</h2>
	<p>Inadequate filtering of request data leads to a SQL Injection
	vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html</url>
	<url>https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html</url>
	<url>https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html</url>
	</references>
	<dates>
	<discovery>2015-12-21</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="3ae078ca-c7eb-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 PV guests may be able to mask interrupts</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-202.html">
	<p>Certain PV guest kernel operations (page table writes in
	particular) need emulation, and use Xen's general x86 instruction
	emulator. This allows a malicious guest kernel which asynchronously
	modifies its instruction stream to effect the clearing of EFLAGS.IF
	from the state used to return to guest context.</p>
	<p>A malicious guest kernel administrator can cause a host hang or
	crash, resulting in a Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10024</cvename>
	<url>https://xenbits.xen.org/xsa/advisory-202.html</url>
	</references>
	<dates>
	<discovery>2016-12-21</discovery>
	<entry>2016-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="862d6ab3-c75e-11e6-9f98-20cf30e32f6d">
	<topic>Apache httpd -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Software Foundation reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
	<cvename>CVE-2016-8743</cvename>
	<cvename>CVE-2016-2161</cvename>
	<cvename>CVE-2016-0736</cvename>
	<cvename>CVE-2016-8740</cvename>
	<cvename>CVE-2016-5387</cvename>
	</references>
	<dates>
	<discovery>2016-12-20</discovery>
	<entry>2016-12-21</entry>
	<modified>2016-12-22</modified>
	</dates>
	</vuln>

	<vuln vid="942433db-c661-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-204.html">
	<p>The typical behaviour of singlestepping exceptions is determined at
	the start of the instruction, with a #DB trap being raised at the
	end of the instruction. SYSCALL (and SYSRET, although we don't
	implement it) behave differently because the typical behaviour
	allows userspace to escalate its privilege. (This difference in
	behaviour seems to be undocumented.) Xen wrongly raised the
	exception based on the flags at the start of the instruction.</p>
	<p>Guest userspace which can invoke the instruction emulator can use
	this flaw to escalate its privilege to that of the guest kernel.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-10013</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-204.html</url>
	</references>
	<dates>
	<discovery>2016-12-19</discovery>
	<entry>2016-12-20</entry>
	</dates>
	</vuln>

	<vuln vid="e47ab5db-c333-11e6-ae1b-002590263bf5">
	<topic>atheme-services -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>atheme-services</name>
	<range><lt>7.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9773">
	<p>modules/chanserv/flags.c in Atheme before 7.2.7 allows remote
	attackers to modify the Anope FLAGS behavior by registering and
	dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4478">
	<p>Buffer overflow in the xmlrpc_char_encode function in
	modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows
	remote attackers to cause a denial of service via vectors related
	to XMLRPC response encoding.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/209217</freebsdpr>
	<cvename>CVE-2014-9773</cvename>
	<cvename>CVE-2016-4478</cvename>
	<url>https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e</url>
	<url>https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b</url>
	</references>
	<dates>
	<discovery>2016-01-09</discovery>
	<entry>2016-12-16</entry>
	</dates>
	</vuln>

	<vuln vid="512c0ffd-cd39-4da4-b2dc-81ff4ba8e238">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>50.1.0_1,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.47</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.6.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.6.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/">
	<p>CVE-2016-9894: Buffer overflow in SkiaGL</p>
	<p>CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements</p>
	<p>CVE-2016-9895: CSP bypass using marquee tag</p>
	<p>CVE-2016-9896: Use-after-free with WebVR</p>
	<p>CVE-2016-9897: Memory corruption in libGLES</p>
	<p>CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees</p>
	<p>CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs</p>
	<p>CVE-2016-9904: Cross-origin information leak in shared atoms</p>
	<p>CVE-2016-9901: Data from Pocket server improperly sanitized before execution</p>
	<p>CVE-2016-9902: Pocket extension does not validate the origin of events</p>
	<p>CVE-2016-9903: XSS injection vulnerability in add-ons SDK</p>
	<p>CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1</p>
	<p>CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9894</cvename>
	<cvename>CVE-2016-9899</cvename>
	<cvename>CVE-2016-9895</cvename>
	<cvename>CVE-2016-9896</cvename>
	<cvename>CVE-2016-9897</cvename>
	<cvename>CVE-2016-9898</cvename>
	<cvename>CVE-2016-9900</cvename>
	<cvename>CVE-2016-9904</cvename>
	<cvename>CVE-2016-9901</cvename>
	<cvename>CVE-2016-9902</cvename>
	<cvename>CVE-2016-9903</cvename>
	<cvename>CVE-2016-9080</cvename>
	<cvename>CVE-2016-9893</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-94/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-95/</url>
	</references>
	<dates>
	<discovery>2016-12-13</discovery>
	<entry>2016-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="54e50cd9-c1a8-11e6-ae1b-002590263bf5">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.6.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jeremy Felt reports:</p>
	<blockquote cite="https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/">
	<p>WordPress versions 4.6 and earlier are affected by two security
	issues: a cross-site scripting vulnerability via image filename,
	reported by SumOfPwn researcher Cengiz Han Sahin; and a path
	traversal vulnerability in the upgrade package uploader, reported
	by Dominik Schilling from the WordPress security team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2016-09-07</discovery>
	<entry>2016-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="80a897a2-c1a6-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-200.html">
	<p>The x86 instruction CMPXCHG8B is supposed to ignore legacy operand
	size overrides; it only honors the REX.W override (making it
	CMPXCHG16B). So, the operand size is always 8 or 16. When support
	for CMPXCHG16B emulation was added to the instruction emulator,
	this restriction on the set of possible operand sizes was relied on
	in some parts of the emulation; but a wrong, fully general, operand
	size value was used for other parts of the emulation. As a result,
	if a guest uses a supposedly-ignored operand size prefix, a small
	amount of hypervisor stack data is leaked to the guests: a 96 bit
	leak to guests running in 64-bit mode; or, a 32 bit leak to other
	guests.</p>
	<p>A malicious unprivileged guest may be able to obtain sensitive
	information from the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9932</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-200.html</url>
	</references>
	<dates>
	<discovery>2016-12-13</discovery>
	<entry>2016-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="2d56308b-c0a8-11e6-a9a5-b499baebfeaf">
	<topic>PHP -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php56</name>
	<range><lt>5.6.29</lt></range>
	</package>
	<package>
	<name>php70</name>
	<range><lt>7.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/archive/2016.php#id2016-12-08-1">
	<p>This is a security release. Several security bugs were fixed in
	this release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/archive/2016.php#id2016-12-08-1</url>
	<url>http://php.net/archive/2016.php#id2016-12-08-2</url>
	</references>
	<dates>
	<discovery>2016-12-12</discovery>
	<entry>2016-12-12</entry>
	</dates>
	</vuln>

	<vuln vid="c0b13887-be44-11e6-b04f-001999f8d30b">
	<topic>asterisk -- Authentication Bypass</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.25.1</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.13.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>The chan_sip channel driver has a liberal definition
	for whitespace when attempting to strip the content between
	a SIP header name and a colon character. Rather than
	following RFC 3261 and stripping only spaces and horizontal
	tabs, Asterisk treats any non-printable ASCII character
	as if it were whitespace.</p>
	<p>This mostly does not pose a problem until Asterisk is
	placed in tandem with an authenticating SIP proxy. In
	such a case, a crafty combination of valid and invalid
	To headers can cause a proxy to allow an INVITE request
	into Asterisk without authentication since it believes
	the request is an in-dialog request. However, because of
	the bug described above, the request will look like an
	out-of-dialog request to Asterisk. Asterisk will then
	process the request as a new call. The result is that
	Asterisk can process calls from unvetted sources without
	any authentication.</p>
	<p>If you do not use a proxy for authentication, then
	this issue does not affect you.</p>
	<p>If your proxy is dialog-aware (meaning that the proxy
	keeps track of what dialogs are currently valid), then
	this issue does not affect you.</p>
	<p>If you use chan_pjsip instead of chan_sip, then this
	issue does not affect you.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.digium.com/pub/security/ASTERISK-2016-009.html</url>
	</references>
	<dates>
	<discovery>2016-11-28</discovery>
	<entry>2016-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="9e6640fe-be3a-11e6-b04f-001999f8d30b">
	<topic>asterisk -- Crash on SDP offer or answer from endpoint using Opus</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><ge>13.12.0</ge><lt>13.13.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>If an SDP offer or answer is received with the Opus
	codec and with the format parameters separated using a
	space the code responsible for parsing will recursively
	call itself until it crashes. This occurs as the code
	does not properly handle spaces separating the parameters.
	This does NOT require the endpoint to have Opus configured
	in Asterisk. This also does not require the endpoint to
	be authenticated. If guest is enabled for chan_sip or
	anonymous in chan_pjsip an SDP offer or answer is still
	processed and the crash occurs.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-008.html</url>
	</references>
	<dates>
	<discovery>2016-11-11</discovery>
	<entry>2016-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="eab68cff-bc0c-11e6-b2ca-001b3856973b">
	<topic>cryptopp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cryptopp</name>
	<range><lt>5.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple sources report:</p>
	<blockquote cite="https://eprint.iacr.org/2015/368">
	<p>CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function
	in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key
	operations for the Rabin-Williams digital signature algorithm, which
	allows remote attackers to obtain private keys via a timing attack.
	Fixed in 5.6.3.</p>
	</blockquote>
	<blockquote cite="https://github.com/weidai11/cryptopp/issues/146">
	<p>CVE-2016-3995: Incorrect implementation of Rijndael timing attack
	countermeasure. Fixed in 5.6.4.</p>
	</blockquote>
	<blockquote cite="https://github.com/weidai11/cryptopp/issues/277">
	<p>CVE-2016-7420: Library built without -DNDEBUG could egress sensitive
	information to the filesystem via a core dump if an assert was triggered.
	Fixed in 5.6.5.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://eprint.iacr.org/2015/368</url>
	<url>https://github.com/weidai11/cryptopp/issues/146</url>
	<url>https://github.com/weidai11/cryptopp/issues/277</url>
	<cvename>CVE-2015-2141</cvename>
	<cvename>CVE-2016-3995</cvename>
	<cvename>CVE-2016-7420</cvename>
	</references>
	<dates>
	<discovery>2015-02-27</discovery>
	<entry>2016-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="e722e3c6-bbee-11e6-b1cf-14dae9d210b8">
	<topic>FreeBSD -- bhyve(8) virtual machine escape</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_4</lt></range>
	<range><ge>10.3</ge><lt>10.3_13</lt></range>
	<range><ge>10.2</ge><lt>10.2_26</lt></range>
	<range><ge>10.1</ge><lt>10.1_43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The bounds checking of accesses to guest memory greater
	than 4GB by device emulations is subject to integer
	overflow.</p>
	<h1>Impact:</h1>
	<p>For a bhyve virtual machine with more than 3GB of guest
	memory configured, a malicious guest could craft device
	descriptors that could give it access to the heap of the
	bhyve process. Since the bhyve process is running as root,
	this may allow guests to obtain full control of the hosts
	they're running on.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1889</cvename>
	<freebsdsa>SA-16:38.bhyve</freebsdsa>
	</references>
	<dates>
	<discovery>2016-12-06</discovery>
	<entry>2016-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="0282269d-bbee-11e6-b1cf-14dae9d210b8">
	<topic>FreeBSD -- link_ntoa(3) buffer overflow</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_5</lt></range>
	<range><ge>10.3</ge><lt>10.3_14</lt></range>
	<range><ge>10.2</ge><lt>10.2_27</lt></range>
	<range><ge>10.1</ge><lt>10.1_44</lt></range>
	<range><ge>9.3</ge><lt>9.3_52</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A specially crafted argument can trigger a static buffer
	overflow in the library, with possibility to rewrite following
	static buffers that belong to other library functions.</p>
	<h1>Impact:</h1>
	<p>Due to very limited use of the function in the existing
	applications, and limited length of the overflow, exploitation
	of the vulnerability does not seem feasible. None of the
	utilities and daemons in the base system are known to be
	vulnerable. However, careful review of third party software
	that may use the function was not performed.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6559</cvename>
	<freebsdsa>SA-16:37.libc</freebsdsa>
	</references>
	<dates>
	<discovery>2016-12-06</discovery>
	<entry>2016-12-06</entry>
	<modified>2016-12-08</modified>
	</dates>
	</vuln>

	<vuln vid="e00304d2-bbed-11e6-b1cf-14dae9d210b8">
	<topic>FreeBSD -- Possible login(1) argument injection in telnetd(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_4</lt></range>
	<range><ge>10.3</ge><lt>10.3_13</lt></range>
	<range><ge>10.2</ge><lt>10.2_26</lt></range>
	<range><ge>10.1</ge><lt>10.1_43</lt></range>
	<range><ge>9.3</ge><lt>9.3_51</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>An unexpected sequence of memory allocation failures
	combined with insufficient error checking could result in
	the construction and execution of an argument sequence that
	was not intended.</p>
	<h1>Impact:</h1>
	<p>An attacker who controls the sequence of memory allocation
	failures and success may cause login(1) to run without
	authentication and may be able to cause misbehavior of
	login(1) replacements.</p>
	<p>No practical way of controlling these memory allocation
	failures is known at this time.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1888</cvename>
	<freebsdsa>SA-16:36.telnetd</freebsdsa>
	</references>
	<dates>
	<discovery>2016-12-06</discovery>
	<entry>2016-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="cb0bf1ec-bb92-11e6-a9a5-b499baebfeaf">
	<topic>Apache httpd -- denial of service in HTTP/2</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><ge>2.4.17</ge><le>2.4.23_1</le></range>
	</package>
	<package>
	<name>mod_http2-devel</name>
	<range><lt>1.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mod_http2 reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E">
	<p>The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply
	limitations on request headers correctly when experimental module
	for the HTTP/2 protocol is used to access a resource.</p>
	<p>The net result is that a the server allocates too much memory
	instead of denying the request. This can lead to memory exhaustion
	of the server by a properly crafted request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E</url>
	<url>https://github.com/icing/mod_h2/releases/tag/v1.8.3</url>
	<cvename>CVE-2016-8740</cvename>
	</references>
	<dates>
	<discovery>2016-12-06</discovery>
	<entry>2016-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="603fe0a1-bb26-11e6-8e5a-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>55.0.2883.75</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html">
	<p>36 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9651</cvename>
	<cvename>CVE-2016-5208</cvename>
	<cvename>CVE-2016-5207</cvename>
	<cvename>CVE-2016-5206</cvename>
	<cvename>CVE-2016-5205</cvename>
	<cvename>CVE-2016-5204</cvename>
	<cvename>CVE-2016-5209</cvename>
	<cvename>CVE-2016-5203</cvename>
	<cvename>CVE-2016-5210</cvename>
	<cvename>CVE-2016-5212</cvename>
	<cvename>CVE-2016-5211</cvename>
	<cvename>CVE-2016-5213</cvename>
	<cvename>CVE-2016-5214</cvename>
	<cvename>CVE-2016-5216</cvename>
	<cvename>CVE-2016-5215</cvename>
	<cvename>CVE-2016-5217</cvename>
	<cvename>CVE-2016-5218</cvename>
	<cvename>CVE-2016-5219</cvename>
	<cvename>CVE-2016-5221</cvename>
	<cvename>CVE-2016-5220</cvename>
	<cvename>CVE-2016-5222</cvename>
	<cvename>CVE-2016-9650</cvename>
	<cvename>CVE-2016-5223</cvename>
	<cvename>CVE-2016-5226</cvename>
	<cvename>CVE-2016-5225</cvename>
	<cvename>CVE-2016-5224</cvename>
	<cvename>CVE-2016-9652</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2016-12-01</discovery>
	<entry>2016-12-05</entry>
	</dates>
	</vuln>

	<vuln vid="e1f67063-aab4-11e6-b2d3-60a44ce6887b">
	<topic>ImageMagick7 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.3.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple sources report:</p>
	<blockquote cite="https://github.com/ImageMagick/ImageMagick/issues/296">
	<p>CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31</p>
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/">
	<p>CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.</p>
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/">
	<p>CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
	<url>https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/</url>
	<url>https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/</url>
	<cvename>CVE-2016-9298</cvename>
	<cvename>CVE-2016-8866</cvename>
	<cvename>CVE-2016-8862</cvename>
	<freebsdpr>ports/214514</freebsdpr>
	</references>
	<dates>
	<discovery>2016-09-14</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="bc4898d5-a794-11e6-b2d3-60a44ce6887b">
	<topic>Pillow -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>3.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pillow reports:</p>
	<blockquote cite="http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html">
	<p>Pillow prior to 3.3.2 may experience integer overflow
	errors in map.c when reading specially crafted image files. This may
	lead to memory disclosure or corruption.</p>
	<p>Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check
	for negative image sizes in ImagingNew in Storage.c. A negative image
	size can lead to a smaller allocation than expected, leading to arbi
	trary writes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html</url>
	<url>https://github.com/python-pillow/Pillow/issues/2105</url>
	<cvename>CVE-2016-9189</cvename>
	<cvename>CVE-2016-9190</cvename>
	<freebsdpr>ports/214410</freebsdpr>
	</references>
	<dates>
	<discovery>2016-09-06</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="19d35b0f-ba73-11e6-b1cf-14dae9d210b8">
	<topic>ImageMagick -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.6.4,1</lt></range>
	</package>
	<package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bastien Roucaries reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2016/q4/413">
	<p>Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
	suffer from a heap overflow in WaveletDenoiseImage(). This problem is
	easily trigerrable from a Perl script.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2016/q4/413</url>
	<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
	<cvename>CVE-2016-9298</cvename>
	<freebsdpr>ports/214517</freebsdpr>
	<freebsdpr>ports/214511</freebsdpr>
	<freebsdpr>ports/214520</freebsdpr>
	</references>
	<dates>
	<discovery>2016-11-13</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="e5dcb942-ba6f-11e6-b1cf-14dae9d210b8">
	<topic>py-cryptography -- vulnerable HKDF key generation</topic>
	<affects>
	<package>
	<name>py27-cryptography</name>
	<name>py33-cryptography</name>
	<name>py34-cryptography</name>
	<name>py35-cryptography</name>
	<range><lt>1.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alex Gaynor reports:</p>
	<blockquote cite="https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d">
	<p>Fixed a bug where ``HKDF`` would return an empty
	byte-string if used with a ``length`` less than
	``algorithm.digest_size``.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d</url>
	<cvename>CVE-2016-9243</cvename>
	<freebsdpr>ports/214915</freebsdpr>
	</references>
	<dates>
	<discovery>2016-11-05</discovery>
	<entry>2016-12-04</entry>
	<modified>2016-12-06</modified>
	</dates>
	</vuln>

	<vuln vid="a228c7a0-ba66-11e6-b1cf-14dae9d210b8">
	<topic>qemu -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<name>qemu-sbruno</name>
	<range><lt>2.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel P. Berrange reports:</p>
	<blockquote cite="https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html">
	<p>The VNC server websockets decoder will read and buffer data
	from websockets clients until it sees the end of the HTTP headers,
	as indicated by \r\n\r\n. In theory this allows a malicious to
	trick QEMU into consuming an arbitrary amount of RAM.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html</url>
	<cvename>CVE-2015-1779</cvename>
	<freebsdpr>ports/206725</freebsdpr>
	</references>
	<dates>
	<discovery>2015-03-23</discovery>
	<entry>2016-12-04</entry>
	<modified>2016-12-06</modified>
	</dates>
	</vuln>

	<vuln vid="59f79c99-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-tools -- delimiter injection vulnerabilities in pygrub</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-198.html">
	<p>pygrub, the boot loader emulator, fails to quote (or sanity check)
	its results when reporting them to its caller.</p>
	<p>A malicious guest administrator can obtain the contents of
	sensitive host files (an information leak). Additionally, a
	malicious guest administrator can cause files on the host to be
	removed, causing a denial of service. In some unusual host
	configurations, ability to remove certain files may be usable for
	privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9379</cvename>
	<cvename>CVE-2016-9380</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-198.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="58685e23-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-tools -- qemu incautious about shared ring processing</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-197.html">
	<p>The compiler can emit optimizations in qemu which can lead to
	double fetch vulnerabilities. Specifically data on the rings shared
	between qemu and the hypervisor (which the guest under control can
	obtain mappings of) can be fetched twice (during which time the
	guest can alter the contents) possibly leading to arbitrary code
	execution in qemu.</p>
	<p>Malicious administrators can exploit this vulnerability to take
	over the qemu process, elevating its privilege to that of the qemu
	process.</p>
	<p>In a system not using a device model stub domain (or other
	techniques for deprivileging qemu), malicious guest administrators
	can thus elevate their privilege to that of the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9381</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-197.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="56f0f11e-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 64-bit bit test instruction emulation broken</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-195.html">
	<p>The x86 instructions BT, BTC, BTR, and BTS, when used with a
	destination memory operand and a source register rather than an
	immediate operand, access a memory location offset from that
	specified by the memory operand as specified by the high bits of
	the register source.</p>
	<p>A malicious guest can modify arbitrary memory, allowing for
	arbitrary code execution (and therefore privilege escalation
	affecting the whole host), a crash of the host (leading to a DoS),
	or information leaks. The vulnerability is sometimes exploitable
	by unprivileged guest user processes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9383</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-195.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="5555120d-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- guest 32-bit ELF symbol table load leaking host data</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.7</ge><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-194.html">
	<p>Along with their main kernel binary, unprivileged guests may
	arrange to have their Xen environment load (kernel) symbol tables
	for their use. The ELF image metadata created for this purpose has a
	few unused bytes when the symbol table binary is in 32-bit ELF
	format. These unused bytes were not properly cleared during symbol
	table loading.</p>
	<p>A malicious unprivileged guest may be able to obtain sensitive
	information from the host.</p>
	<p>The information leak is small and not under the control of the
	guest, so effectively exploiting this vulnerability is probably
	difficult.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9384</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-194.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="53dbd096-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 segment base write emulation lacking canonical address checks</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.4</ge><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-193.html">
	<p>Both writes to the FS and GS register base MSRs as well as the
	WRFSBASE and WRGSBASE instructions require their input values to be
	canonical, or a #GP fault will be raised. When the use of those
	instructions by the hypervisor was enabled, the previous guard
	against #GP faults (having recovery code attached) was accidentally
	removed.</p>
	<p>A malicious guest administrator can crash the host, leading to a
	DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9385</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-193.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="523bb0b7-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 task switch to VM86 mode mis-handled</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-192.html">
	<p>LDTR, just like TR, is purely a protected mode facility. Hence even
	when switching to a VM86 mode task, LDTR loading needs to follow
	protected mode semantics. This was violated by the code.</p>
	<p>On SVM (AMD hardware): a malicious unprivileged guest process can
	escalate its privilege to that of the guest operating system.</p>
	<p>On both SVM and VMX (Intel hardware): a malicious unprivileged
	guest process can crash the guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9382</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-192.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="50ac2e96-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 null segments not always treated as unusable</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-191.html">
	<p>The Xen x86 emulator erroneously failed to consider the unusability
	of segments when performing memory accesses.</p>
	<p> The intended behaviour is as follows: The user data segment (%ds,
	%es, %fs and %gs) selectors may be NULL in 32-bit to prevent access.
	In 64-bit, NULL has a special meaning for user segments, and there
	is no way of preventing access. However, in both 32-bit and 64-bit,
	a NULL LDT system segment is intended to prevent access.</p>
	<p>On Intel hardware, loading a NULL selector zeros the base as well
	as most attributes, but sets the limit field to its largest possible
	value. On AMD hardware, loading a NULL selector zeros the attributes,
	leaving the stale base and limit intact.</p>
	<p>Xen may erroneously permit the access using unexpected base/limit
	values.</p>
	<p>Ability to exploit this vulnerability on Intel is easy, but on AMD
	depends in a complicated way on how the guest kernel manages LDTs.
	</p>
	<p>An unprivileged guest user program may be able to elevate its
	privilege to that of the guest operating system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9386</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-191.html</url>
	</references>
	<dates>
	<discovery>2016-11-22</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="4d7cf654-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-190.html">
	<p>Instructions touching FPU, MMX, or XMM registers are required to
	raise a Device Not Available Exception (#NM) when either CR0.EM or
	CR0.TS are set. (Their AVX or AVX-512 extensions would consider only
	CR0.TS.) While during normal operation this is ensured by the
	hardware, if a guest modifies instructions while the hypervisor is
	preparing to emulate them, the #NM delivery could be missed.</p>
	<p>Guest code in one task may thus (unintentionally or maliciously)
	read or modify register state belonging to another task in the same
	VM.</p>
	<p>A malicious unprivileged guest user may be able to obtain or
	corrupt sensitive information (including cryptographic material) in
	other programs in the same guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7777</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-190.html</url>
	</references>
	<dates>
	<discovery>2016-10-04</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="4bf57137-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- use after free in FIFO event channel code</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.4</ge><lt>4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-188.html">
	<p>When the EVTCHNOP_init_control operation is called with a bad guest
	frame number, it takes an error path which frees a control structure
	without also clearing the corresponding pointer. Certain subsequent
	operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control),
	upon finding the non-NULL pointer, continue operation assuming it
	points to allocated memory.</p>
	<p>A malicious guest administrator can crash the host, leading to a
	DoS. Arbitrary code execution (and therefore privilege escalation),
	and information leaks, cannot be excluded.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7154</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-188.html</url>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="4aae54be-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[]</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-187.html">
	<p>x86 HVM guests running with shadow paging use a subset of the x86
	emulator to handle the guest writing to its own pagetables. There
	are situations a guest can provoke which result in exceeding the
	space allocated for internal state.</p>
	<p>A malicious HVM guest administrator can cause Xen to fail a bug
	check, causing a denial of service to the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7094</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-187.html</url>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="49211361-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><eq>4.5.3</eq></range>
	<range><eq>4.6.3</eq></range>
	<range><ge>4.7.0</ge><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-186.html">
	<p>When emulating HVM instructions, Xen uses a small i-cache for
	fetches from guest memory. The code that handles cache misses does
	not check if the address from which it fetched lies within the cache
	before blindly writing to it. As such it is possible for the guest
	to overwrite hypervisor memory.</p>
	<p>It is currently believed that the only way to trigger this bug is
	to use the way that Xen currently incorrectly wraps CS:IP in 16 bit
	modes. The included patch prevents such wrapping.</p>
	<p>A malicious HVM guest administrator can escalate their privilege to
	that of the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7093</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-186.html</url>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="45ca25b5-ba4d-11e6-ae1b-002590263bf5">
	<topic>xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-185.html">
	<p>On real hardware, a 32-bit PAE guest must leave the USER and RW bit
	clear in L3 pagetable entries, but the pagetable walk behaves as if
	they were set. (The L3 entries are cached in processor registers,
	and don't actually form part of the pagewalk.)</p>
	<p>When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR
	in the USER and RW bits for L3 updates for the guest to observe
	architectural behaviour. This is unsafe in combination with
	recursive pagetables.</p>
	<p>As there is no way to construct an L3 recursive pagetable in native
	32-bit PAE mode, disallow this option in 32-bit PV guests.</p>
	<p>A malicious 32-bit PV guest administrator can escalate their
	privilege to that of the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7092</cvename>
	<freebsdpr>ports/214936</freebsdpr>
	<url>https://xenbits.xen.org/xsa/advisory-185.html</url>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="7fff2b16-b0ee-11e6-86b8-589cfc054129">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tshark</name>
	<range><lt>2.2.2</lt></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><lt>2.2.2</lt></range>
	</package>
	<package>
	<name>wireshark</name>
	<range><lt>2.2.2</lt></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><lt>2.2.2</lt></range>
	</package>
	<package>
	<name>wireshark-qt5</name>
	<range><lt>2.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark project reports:</p>
	<blockquote cite="://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html">
	<p>Wireshark project is releasing Wireshark 2.2.2, which addresses:</p>
	<ul>
	<li>wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372</li>
	<li>wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374</li>
	<li>wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376</li>
	<li>wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373</li>
	<li>wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html</url>
	<cvename>CVE-2016-9372</cvename>
	<cvename>CVE-2016-9373</cvename>
	<cvename>CVE-2016-9374</cvename>
	<cvename>CVE-2016-9375</cvename>
	<cvename>CVE-2016-9376</cvename>
	</references>
	<dates>
	<discovery>2016-11-16</discovery>
	<entry>2016-12-01</entry>
	</dates>
	</vuln>

	<vuln vid="18f39fb6-7400-4063-acaf-0806e92c094f">
	<topic>Mozilla -- SVG Animation Remote Code Execution</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>50.0.2,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.5.1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.5.1,2</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.46</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.46</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>45.5.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>45.5.1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>45.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/">
	<p>A use-after-free vulnerability in SVG Animation has been
	discovered. An exploit built on this vulnerability has been
	discovered in the wild targeting Firefox and Tor Browser
	users on Windows.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9079</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/</url>
	</references>
	<dates>
	<discovery>2016-11-30</discovery>
	<entry>2016-12-01</entry>
	<modified>2016-12-16</modified>
	</dates>
	</vuln>

	<vuln vid="479c5b91-b6cc-11e6-a04e-3417eb99b9a0">
	<topic>wget -- Access List Bypass / Race Condition</topic>
	<affects>
	<package>
	<name>wget</name>
	<range><le>1.17</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dawid Golunski reports:</p>
	<blockquote cite="https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html">
	<p>GNU wget in version 1.17 and earlier, when used in
	mirroring/recursive mode, is affected by a Race Condition
	vulnerability that might allow remote attackers to bypass intended
	wget access list restrictions specified with -A parameter.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098</url>
	<cvename>CVE-2016-7098</cvename>
	</references>
	<dates>
	<discovery>2016-11-24</discovery>
	<entry>2016-11-30</entry>
	</dates>
	</vuln>

	<vuln vid="48e83187-b6e9-11e6-b6cf-5453ed2e2b49">
	<topic>p7zip -- Null pointer dereference</topic>
	<affects>
	<package>
	<name>p7zip</name>
	<range><lt>15.14_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9296">
	<p>A null pointer dereference bug affects the 16.02 and many old
	versions of p7zip. A lack of null pointer check for the variable
	<code>folders.PackPositions</code> in function
	<code>CInArchive::ReadAndDecodePackedStreams</code>, as used in
	the 7z.so library and in 7z applications, will cause a crash and a
	denial of service when decoding malformed 7z files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9296</cvename>
	<url>https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/</url>
	<url>https://sourceforge.net/p/p7zip/bugs/185/</url>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296</url>
	</references>
	<dates>
	<discovery>2016-07-17</discovery>
	<entry>2016-11-30</entry>
	</dates>
	</vuln>

	<vuln vid="ac256985-b6a9-11e6-a3bf-206a8a720317">
	<topic>subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s)</topic>
	<affects>
	<package>
	<name>subversion18</name>
	<range><lt>1.8.17</lt></range>
	</package>
	<package>
	<name>subversion</name>
	<range><lt>1.9.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2016-8734-advisory.txt">
	<p>The mod_dontdothat module of subversion and subversion clients using
	http(s):// are vulnerable to a denial-of-service attack, caused by
	exponential XML entity expansion. The attack targets XML parsers
	causing targeted process to consume excessive amounts of resources.
	The attack is also known as the "billions of laughs attack."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://subversion.apache.org/security/CVE-2016-8734-advisory.txt</url>
	<cvename>CVE-2016-8734</cvename>
	</references>
	<dates>
	<discovery>2016-11-29</discovery>
	<entry>2016-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="18449f92-ab39-11e6-8011-005056925db4">
	<topic>libwww -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libwww</name>
	<range><lt>5.4.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3183">
	<p>The HTBoundary_put_block function in HTBound.c for W3C libwww
	(w3c-libwww) allows remote servers to cause a denial of service
	(segmentation fault) via a crafted multipart/byteranges MIME message
	that triggers an out-of-bounds read.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
	<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
	as used in the XML-Twig module for Perl, allows context-dependent
	attackers to cause a denial of service (application crash) via an XML
	document with malformed UTF-8 sequences that trigger a buffer
	over-read, related to the doProlog function in lib/xmlparse.c, a
	different vulnerability than CVE-2009-2625 and CVE-2009-3720.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
	<p>The updatePosition function in lib/xmltok_impl.c in libexpat in
	Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other
	software, allows context-dependent attackers to cause a denial of
	service (application crash) via an XML document with crafted UTF-8
	sequences that trigger a buffer over-read, a different vulnerability
	than CVE-2009-2625.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>15035</bid>
	<cvename>CVE-2005-3183</cvename>
	<cvename>CVE-2009-3560</cvename>
	<cvename>CVE-2009-3720</cvename>
	<freebsdpr>ports/214546</freebsdpr>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=170518</url>
	</references>
	<dates>
	<discovery>2005-10-12</discovery>
	<entry>2016-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e">
	<topic>mozilla -- data: URL can inherit wrong origin after an HTTP redirect</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>50.0.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/">
	<p>Redirection from an HTTP connection to a data: URL
	assigns the referring site's origin to the data: URL in some
	circumstances. This can result in same-origin violations
	against a domain if it loads resources from malicious
	sites. Cross-origin setting of cookies has been demonstrated
	without the ability to read them.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9078</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-91/</url>
	</references>
	<dates>
	<discovery>2016-11-28</discovery>
	<entry>2016-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="125f5958-b611-11e6-a9a5-b499baebfeaf">
	<topic>Roundcube -- arbitrary command execution</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>1.2.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Roundcube project reports</p>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-9920">
	<p>steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before
	1.2.3, when no SMTP server is configured and the sendmail program is
	enabled, does not properly restrict the use of custom envelope-from
	addresses on the sendmail command line, which allows remote
	authenticated users to execute arbitrary code via a modified HTTP
	request that sends a crafted e-mail message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9920</cvename>
	<bid>94858</bid>
	<url>http://www.openwall.com/lists/oss-security/2016/12/08/17</url>
	<url>https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123</url>
	</references>
	<dates>
	<discovery>2016-11-29</discovery>
	<entry>2016-11-29</entry>
	<modified>2016-12-14</modified>
	</dates>
	</vuln>

	<vuln vid="8db24888-b2f5-11e6-8153-00248c0c745d">
	<topic>Drupal Code -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><ge>7.0</ge><lt>7.52</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal development team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2016-005">
	<h3>Inconsistent name for term access query (Less critical - Drupal
	7 and Drupal 8)</h3>
	<p>Drupal provides a mechanism to alter database SELECT queries before
	they are executed. Contributed and custom modules may use this
	mechanism to restrict access to certain entities by implementing
	hook_query_alter() or hook_query_TAG_alter() in order to add
	additional conditions. Queries can be distinguished by means of
	query tags. As the documentation on EntityFieldQuery::addTag()
	suggests, access-tags on entity queries normally follow the form
	ENTITY_TYPE_access (e.g. node_access). However, the taxonomy
	module's access query tag predated this system and used term_access
	as the query tag instead of taxonomy_term_access.</p>
	<p>As a result, before this security release modules wishing to
	restrict access to taxonomy terms may have implemented an
	unsupported tag, or needed to look for both tags (term_access and
	taxonomy_term_access) in order to be compatible with queries
	generated both by Drupal core as well as those generated by
	contributed modules like Entity Reference. Otherwise information
	on taxonomy terms might have been disclosed to unprivileged users.
	</p>
	<h3>Incorrect cache context on password reset page (Less critical -
	Drupal 8)</h3>
	<p>The user password reset form does not specify a proper cache
	context, which can lead to cache poisoning and unwanted content on
	the page.</p>
	<h3>Confirmation forms allow external URLs to be injected (Moderately
	critical - Drupal 7)</h3>
	<p>Under certain circumstances, malicious users could construct a URL
	to a confirmation form that would trick users into being redirected
	to a 3rd party website after interacting with the form, thereby
	exposing the users to potential social engineering attacks.</p>
	<h3>Denial of service via transliterate mechanism (Moderately critical
	- Drupal 8)</h3>
	<p>A specially crafted URL can cause a denial of service via the
	transliterate mechanism.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9449</cvename>
	<cvename>CVE-2016-9450</cvename>
	<cvename>CVE-2016-9451</cvename>
	<cvename>CVE-2016-9452</cvename>
	</references>
	<dates>
	<discovery>2016-11-16</discovery>
	<entry>2016-11-25</entry>
	<modified>2016-11-27</modified>
	</dates>
	</vuln>

	<vuln vid="6fe72178-b2e3-11e6-8b2a-6805ca0b3d42">
	<topic>phpMyAdmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.6.0</ge><lt>4.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Please reference CVE/URL list for details</p>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-57/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-58/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-59/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-60/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-61/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-62/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-63/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-64/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-65/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-66/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-67/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-68/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-69/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-70/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-71/</url>
	<cvename>CVE-2016-6632</cvename>
	<cvename>CVE-2016-6633</cvename>
	<cvename>CVE-2016-4412</cvename>
	</references>
	<dates>
	<discovery>2016-11-25</discovery>
	<entry>2016-11-25</entry>
	</dates>
	</vuln>

	<vuln vid="dc596a17-7a9e-11e6-b034-f0def167eeea">
	<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
	<affects>
	<package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
	</package>
	<package>
	<name>mysql56-client</name>
	<name>mysql56-server</name>
	<range><lt>5.6.33</lt></range>
	</package>
	<package>
	<name>mysql55-client</name>
	<name>mysql55-server</name>
	<range><lt>5.5.52</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>LegalHackers' reports:</p>
	<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
	<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
	It works by manipulating my.cnf files and using --malloc-lib.
	The bug seems fixed in MySQL 5.7.15 by Oracle</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
	<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
	</references>
	<dates>
	<discovery>2016-09-12</discovery>
	<entry>2016-11-24</entry>
	<modified>2016-11-24</modified>
	</dates>
	</vuln>

	<vuln vid="8db8d62a-b08b-11e6-8eba-d050996490d0">
	<topic>ntp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p9</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Network Time Foundation reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se">
	<p>NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:</p>
	<ul>
	<li>1 HIGH severity vulnerability that only affects Windows</li>
	<li>2 MEDIUM severity vulnerabilities</li>
	<li>2 MEDIUM/LOW severity vulnerabilities</li>
	<li>5 LOW severity vulnerabilities</li>
	<li>28 other non-security fixes and improvements</li>
	</ul>
	<p>All of the security issues in this release are listed in
	<a href="http://www.kb.cert.org/vuls/id/633847">VU#633847</a>.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7426</cvename>
	<cvename>CVE-2016-7427</cvename>
	<cvename>CVE-2016-7428</cvename>
	<cvename>CVE-2016-7429</cvename>
	<cvename>CVE-2016-7431</cvename>
	<cvename>CVE-2016-7433</cvename>
	<cvename>CVE-2016-7434</cvename>
	<cvename>CVE-2016-9310</cvename>
	<cvename>CVE-2016-9311</cvename>
	<cvename>CVE-2016-9312</cvename>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se</url>
	<url>http://www.kb.cert.org/vuls/id/633847</url>
	</references>
	<dates>
	<discovery>2016-11-21</discovery>
	<entry>2016-11-22</entry>
	</dates>
	</vuln>

	<vuln vid="81fc7705-b002-11e6-b20a-14dae9d5a9d2">
	<topic>teeworlds -- Remote code execution</topic>
	<affects>
	<package>
	<name>teeworlds</name>
	<range><lt>0.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Teeworlds project reports:</p>
	<blockquote cite="https://www.teeworlds.com/?page=news&id=12086">
	<p>Attacker controlled memory-writes and possibly arbitrary code
	execution on the client, abusable by any server the client joins</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.teeworlds.com/?page=news&id=12086</url>
	</references>
	<dates>
	<discovery>2016-11-13</discovery>
	<entry>2016-11-21</entry>
	</dates>
	</vuln>

	<vuln vid="27eee66d-9474-44a5-b830-21ec12a1c307">
	<topic>jenkins -- Remote code execution vulnerability in remoting module</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>2.31</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>2.19.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16">
	<p>An unauthenticated remote code execution vulnerability allowed
	attackers to transfer a serialized Java object to the Jenkins CLI,
	making Jenkins connect to an attacker-controlled LDAP server, which
	in turn can send a serialized payload leading to code execution,
	bypassing existing protection mechanisms.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9299</cvename>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16</url>
	</references>
	<dates>
	<discovery>2016-11-11</discovery>
	<entry>2016-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="f6565fbf-ab9e-11e6-ae1b-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.9</lt></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.7</lt></range>
	</package>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-16-0023: Question engine allows access to files that
	should not be available</p></li>
	<li><p>MSA-16-0024: Non-admin site managers may accidentally edit
	admins via web services</p></li>
	<li><p>MSA-16-0025: Capability to view course notes is checked in
	the wrong context</p></li>
	<li><p>MSA-16-0026: When debugging is enabled, error exceptions
	returned from webservices could contain private data</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-8642</cvename>
	<cvename>CVE-2016-8643</cvename>
	<cvename>CVE-2016-8644</cvename>
	<url>https://moodle.org/security/</url>
	</references>
	<dates>
	<discovery>2016-11-14</discovery>
	<entry>2016-11-16</entry>
	<modified>2016-11-27</modified>
	</dates>
	</vuln>

	<vuln vid="ab02f981-ab9e-11e6-ae1b-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.8</lt></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.6</lt></range>
	</package>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-16-0022: Web service tokens should be invalidated when
	the user password is changed or forced to be changed.</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7038</cvename>
	<url>https://moodle.org/security/</url>
	</references>
	<dates>
	<discovery>2016-09-12</discovery>
	<entry>2016-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="d1853110-07f4-4645-895b-6fd462ad0589">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>50.0_1,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.47</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.5.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.5.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5289</cvename>
	<cvename>CVE-2016-5290</cvename>
	<cvename>CVE-2016-5291</cvename>
	<cvename>CVE-2016-5292</cvename>
	<cvename>CVE-2016-5293</cvename>
	<cvename>CVE-2016-5294</cvename>
	<cvename>CVE-2016-5295</cvename>
	<cvename>CVE-2016-5296</cvename>
	<cvename>CVE-2016-5297</cvename>
	<cvename>CVE-2016-5298</cvename>
	<cvename>CVE-2016-5299</cvename>
	<cvename>CVE-2016-9061</cvename>
	<cvename>CVE-2016-9062</cvename>
	<cvename>CVE-2016-9063</cvename>
	<cvename>CVE-2016-9064</cvename>
	<cvename>CVE-2016-9065</cvename>
	<cvename>CVE-2016-9066</cvename>
	<cvename>CVE-2016-9067</cvename>
	<cvename>CVE-2016-9068</cvename>
	<cvename>CVE-2016-9070</cvename>
	<cvename>CVE-2016-9071</cvename>
	<cvename>CVE-2016-9072</cvename>
	<cvename>CVE-2016-9073</cvename>
	<cvename>CVE-2016-9074</cvename>
	<cvename>CVE-2016-9075</cvename>
	<cvename>CVE-2016-9076</cvename>
	<cvename>CVE-2016-9077</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-89/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-90/</url>
	</references>
	<dates>
	<discovery>2016-11-15</discovery>
	<entry>2016-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="a8e9d834-a916-11e6-b9b4-bcaec524bf84">
	<topic>lives -- insecure files permissions</topic>
	<affects>
	<package>
	<name>lives</name>
	<range><lt>2.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565">
	<p>smogrify script creates insecure temporary files.</p>
	</blockquote>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043">
	<p>lives creates and uses world-writable directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565</url>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043</url>
	</references>
	<dates>
	<discovery>2016-07-30</discovery>
	<entry>2016-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
	<topic>openssl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0c</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20161110.txt">
	<ul>
	<li>ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)<br/>
	Severity: High<br/>
	TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS
	attack by corrupting larger payloads. This can result in an OpenSSL crash. This
	issue is not considered to be exploitable beyond a DoS.</li>
	<li>CMS Null dereference (CVE-2016-7053)<br/>
	Severity: Medium<br/>
	Applications parsing invalid CMS structures can crash with a NULL pointer
	dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type
	in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure
	callback if an attempt is made to free certain invalid encodings. Only CHOICE
	structures using a callback which do not handle NULL value are affected.</li>
	<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)i<br/>
	Severity: Low<br/>
	There is a carry propagating bug in the Broadwell-specific Montgomery
	multiplication procedure that handles input lengths divisible by, but
	longer than 256 bits.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20161110.txt</url>
	<cvename>CVE-2016-7054</cvename>
	<cvename>CVE-2016-7053</cvename>
	<cvename>CVE-2016-7055</cvename>
	</references>
	<dates>
	<discovery>2016-11-10</discovery>
	<entry>2016-11-10</entry>
	<modified>2016-11-11</modified>
	</dates>
	</vuln>

	<vuln vid="a3473f5a-a739-11e6-afaa-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>54.0.2840.100</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html">
	<p>4 security fixes in this release, including:</p>
	<ul>
	<li>[643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to
	Paul Mehta</li>
	<li>[658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to
	Choongwoo Han</li>
	<li>[660678] Medium CVE-2016-5201: Info leak in extensions. Credit to
	Rob Wu</li>
	<li>[662843] CVE-2016-5202: Various fixes from internal audits,
	fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5199</cvename>
	<cvename>CVE-2016-5200</cvename>
	<cvename>CVE-2016-5201</cvename>
	<cvename>CVE-2016-5202</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html</url>
	</references>
	<dates>
	<discovery>2016-11-09</discovery>
	<entry>2016-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="96f6bf10-a731-11e6-95ca-0011d823eebd">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c7-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.644</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-37.html">
	<ul>
	<li>These updates resolve type confusion vulnerabilities that
	could lead to code execution (CVE-2016-7860, CVE-2016-7861,
	CVE-2016-7865).</li>
	<li>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2016-7857, CVE-2016-7858,
	CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-37.html</url>
	<cvename>CVE-2016-7857</cvename>
	<cvename>CVE-2016-7858</cvename>
	<cvename>CVE-2016-7859</cvename>
	<cvename>CVE-2016-7860</cvename>
	<cvename>CVE-2016-7861</cvename>
	<cvename>CVE-2016-7862</cvename>
	<cvename>CVE-2016-7863</cvename>
	<cvename>CVE-2016-7864</cvename>
	<cvename>CVE-2016-7865</cvename>
	</references>
	<dates>
	<discovery>2016-11-08</discovery>
	<entry>2016-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="10968dfd-a687-11e6-b2d3-60a44ce6887b">
	<topic>gitlab -- Directory traversal via "import/export" feature</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>8.10.0</ge><le>8.10.12</le></range>
	<range><ge>8.11.0</ge><le>8.11.9</le></range>
	<range><ge>8.12.0</ge><le>8.12.7</le></range>
	<range><ge>8.13.0</ge><le>8.13.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/">
	<p>The import/export feature did not properly check for symbolic links
	in user-provided archives and therefore it was possible for an
	authenticated user to retrieve the contents of any file
	accessible to the GitLab service account. This included
	sensitive files such as those that contain secret tokens used
	by the GitLab service to authenticate users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/</url>
	<cvename>CVE-2016-9086</cvename>
	<freebsdpr>ports/214360</freebsdpr>
	</references>
	<dates>
	<discovery>2016-11-02</discovery>
	<entry>2016-11-09</entry>
	<modified>2017-05-18</modified>
	</dates>
	</vuln>

	<vuln vid="ae9cb9b8-a203-11e6-a265-3065ec8fd3ec">
	<topic>chromium -- out-of-bounds memory access</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>54.0.2840.90</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html">
	<p>[659475] High CVE-2016-5198: Out of bounds memory access in V8.
	Credit to Tencent Keen Security Lab, working with Trend Micro's
	Zero Day Initiative.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5198</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2016-11-01</discovery>
	<entry>2016-11-03</entry>
	</dates>
	</vuln>

	<vuln vid="0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8">
	<topic>FreeBSD -- OpenSSL Remote DoS vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_12</lt></range>
	<range><ge>10.2</ge><lt>10.2_25</lt></range>
	<range><ge>10.1</ge><lt>10.1_42</lt></range>
	<range><ge>9.3</ge><lt>9.3_50</lt></range>
	</package>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2i,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0a</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_13</lt></range>
	</package>
	<package>
	<name>linux-c7-openssl-libs</name>
	<range><lt>1.0.1e_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to improper handling of alert packets, OpenSSL would
	consume an excessive amount of CPU time processing undefined
	alert messages.</p>
	<h1>Impact:</h1>
	<p>A remote attacker who can initiate handshakes with an
	OpenSSL based server can cause the server to consume a lot
	of computation power with very little bandwidth usage, and
	may be able to use this technique in a leveraged Denial of
	Service attack.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-8610</cvename>
	<freebsdsa>SA-16:35.openssl</freebsdsa>
	<url>http://seclists.org/oss-sec/2016/q4/224</url>
	</references>
	<dates>
	<discovery>2016-11-02</discovery>
	<entry>2016-11-02</entry>
	<modified>2017-02-22</modified>
	</dates>
	</vuln>

	<vuln vid="cb116651-79db-4c09-93a2-c38f9df46724">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<name>py35-django</name>
	<range><lt>1.8.16</lt></range>
	</package>
	<package>
	<name>py27-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<name>py35-django18</name>
	<range><lt>1.8.16</lt></range>
	</package>
	<package>
	<name>py27-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<range><lt>1.9.11</lt></range>
	</package>
	<package>
	<name>py27-django110</name>
	<name>py33-django110</name>
	<name>py34-django110</name>
	<name>py35-django110</name>
	<range><lt>1.10.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2016/nov/01/security-releases/">
	<p>Today the Django team released Django 1.10.3, Django 1.9.11,
	and 1.8.16. These releases addresses two security issues
	detailed below. We encourage all users of Django to upgrade
	as soon as possible.</p>
	<ul>
	<li>User with hardcoded password created when running tests on Oracle</li>
	<li>DNS rebinding vulnerability when DEBUG=True</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2016/nov/01/security-releases/</url>
	<cvename>CVE-2016-9013</cvename>
	<cvename>CVE-2016-9014</cvename>
	</references>
	<dates>
	<discovery>2016-11-01</discovery>
	<entry>2016-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="765feb7d-a0d1-11e6-a881-b499baebfeaf">
	<topic>cURL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.1</ge><lt>7.51.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports</p>
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	<ul>
	<li>cookie injection for other servers</li>
	<li>case insensitive password comparison</li>
	<li>OOB write via unchecked multiplication</li>
	<li>double-free in curl_maprintf</li>
	<li>double-free in krb5 code</li>
	<li>glob parser write/read out of bounds</li>
	<li>curl_getdate read out of bounds</li>
	<li>URL unescape heap overflow via integer truncation</li>
	<li>Use-after-free via shared cookies</li>
	<li>invalid URL parsing with '#'</li>
	<li>IDNA 2003 makes curl use wrong host</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/security.html</url>
	<cvename>CVE-2016-8615</cvename>
	<cvename>CVE-2016-8616</cvename>
	<cvename>CVE-2016-8617</cvename>
	<cvename>CVE-2016-8618</cvename>
	<cvename>CVE-2016-8619</cvename>
	<cvename>CVE-2016-8620</cvename>
	<cvename>CVE-2016-8621</cvename>
	<cvename>CVE-2016-8622</cvename>
	<cvename>CVE-2016-8623</cvename>
	<cvename>CVE-2016-8624</cvename>
	<cvename>CVE-2016-8625</cvename>
	</references>
	<dates>
	<discovery>2016-11-02</discovery>
	<entry>2016-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="0b8d01a4-a0d2-11e6-9ca2-d050996490d0">
	<topic>BIND -- Remote Denial of Service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.9P4</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.4P4</lt></range>
	</package>
	<package>
	<name>bind911</name>
	<range><lt>9.11.0P1</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2016.10.21</le></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_50</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01434/">
	<p>A defect in BIND's handling of responses containing
	a DNAME answer can cause a resolver to exit after
	encountering an assertion failure in db.c or
	resolver.c</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-8864</cvename>
	<freebsdsa>SA-16:34.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-01434/</url>
	</references>
	<dates>
	<discovery>2016-11-01</discovery>
	<entry>2016-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="f4bf713f-6ac7-4b76-8980-47bf90c5419f">
	<topic>memcached -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>memcached</name>
	<range><lt>1.4.33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cisco Talos reports:</p>
	<blockquote cite="http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html">
	<p>Multiple integer overflow vulnerabilities exist within Memcached
	that could be exploited to achieve remote code execution on the
	targeted system. These vulnerabilities manifest in various Memcached
	functions that are used in inserting, appending, prepending, or
	modifying key-value data pairs. Systems which also have Memcached
	compiled with support for SASL authentication are also vulnerable to
	a third flaw due to how Memcached handles SASL authentication
	commands.</p>
	<p>An attacker could exploit these vulnerabilities by sending a
	specifically crafted Memcached command to the targeted server.
	Additionally, these vulnerabilities could also be exploited to leak
	sensitive process information which an attacker could use to bypass
	common exploitation mitigations, such as ASLR, and can be triggered
	multiple times. This enables reliable exploitation which makes these
	vulnerabilities severe.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html</url>
	<cvename>CVE-2016-8704</cvename>
	<cvename>CVE-2016-8705</cvename>
	<cvename>CVE-2016-8706</cvename>
	</references>
	<dates>
	<discovery>2016-10-31</discovery>
	<entry>2016-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="9bc14850-a070-11e6-a881-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<name>mysql55-server</name>
	<range><lt>5.5.53</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.34</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MariaDB project reports:</p>
	<blockquote cite="https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/">
	<p>Fixes for the following security vulnerabilities:</p>
	<ul>
	<li>CVE-2016-7440</li>
	<li>CVE-2016-5584</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/</url>
	<cvename>CVE-2016-7440</cvename>
	<cvename>CVE-2016-5584</cvename>
	</references>
	<dates>
	<discovery>2016-10-17</discovery>
	<entry>2016-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="9118961b-9fa5-11e6-a265-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>54.0.2840.59</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html">
	<p>21 security fixes in this release, including:</p>
	<ul>
	<li>[645211] High CVE-2016-5181: Universal XSS in Blink. Credit to
	Anonymous</li>
	<li>[638615] High CVE-2016-5182: Heap overflow in Blink. Credit to
	Giwan Go of STEALIEN</li>
	<li>[645122] High CVE-2016-5183: Use after free in PDFium. Credit
	to Anonymous</li>
	<li>[630654] High CVE-2016-5184: Use after free in PDFium. Credit
	to Anonymous</li>
	<li>[621360] High CVE-2016-5185: Use after free in Blink. Credit to
	cloudfuzzer</li>
	<li>[639702] High CVE-2016-5187: URL spoofing. Credit to Luan
	Herrera</li>
	<li>[565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan
	Herrera</li>
	<li>[633885] Medium CVE-2016-5192: Cross-origin bypass in Blink.
	Credit to haojunhou@gmail.com</li>
	<li>[646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr
	of Tencent's Xuanwu Lab</li>
	<li>[644963] Medium CVE-2016-5186: Out of bounds read in DevTools.
	Credit to Abdulrahman Alqabandi (@qab)</li>
	<li>[639126] Medium CVE-2016-5191: Universal XSS in Bookmarks.
	Credit to Gareth Hughes</li>
	<li>[642067] Medium CVE-2016-5190: Use after free in Internals.
	Credit to Atte Kettunen of OUSPG</li>
	<li>[639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang
	ZHOU (martinzhou96)</li>
	<li>[654782] CVE-2016-5194: Various fixes from internal audits,
	fuzzing and other initiatives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5181</cvename>
	<cvename>CVE-2016-5182</cvename>
	<cvename>CVE-2016-5183</cvename>
	<cvename>CVE-2016-5184</cvename>
	<cvename>CVE-2016-5185</cvename>
	<cvename>CVE-2016-5186</cvename>
	<cvename>CVE-2016-5187</cvename>
	<cvename>CVE-2016-5188</cvename>
	<cvename>CVE-2016-5189</cvename>
	<cvename>CVE-2016-5190</cvename>
	<cvename>CVE-2016-5191</cvename>
	<cvename>CVE-2016-5192</cvename>
	<cvename>CVE-2016-5193</cvename>
	<cvename>CVE-2016-5194</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2016-10-12</discovery>
	<entry>2016-10-31</entry>
	</dates>
	</vuln>

	<vuln vid="9c135c7e-9fa4-11e6-a265-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>53.0.2785.143</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html">
	<p>3 security fixes in this release, including:</p>
	<ul>
	<li>[642496] High CVE-2016-5177: Use after free in V8. Credit to
	Anonymous</li>
	<li>[651092] CVE-2016-5178: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5177</cvename>
	<cvename>CVE-2016-5178</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html</url>
	</references>
	<dates>
	<discovery>2016-09-29</discovery>
	<entry>2016-10-31</entry>
	</dates>
	</vuln>

	<vuln vid="6a2cfcdc-9dea-11e6-a298-14dae9d210b8">
	<topic>FreeBSD -- OpenSSH Remote Denial of Service vulnerability</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><lt>7.3p1_1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When processing the SSH_MSG_KEXINIT message, the server
	could allocate up to a few hundreds of megabytes of memory
	per each connection, before any authentication take place.</p>
	<h1>Impact:</h1>
	<p>A remote attacker may be able to cause a SSH server to
	allocate an excessive amount of memory. Note that the default
	MaxStartups setting on FreeBSD will limit the effectiveness
	of this attack.</p>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2016/q4/191</url>
	<cvename>CVE-2016-8858</cvename>
	<freebsdsa>SA-16:33.openssh</freebsdsa>
	</references>
	<dates>
	<discovery>2016-10-19</discovery>
	<entry>2016-10-29</entry>
	<modified>2016-11-02</modified>
	</dates>
	</vuln>

	<vuln vid="2e4fbc9a-9d23-11e6-a298-14dae9d210b8">
	<topic>sudo -- Potential bypass of sudo_noexec.so via wordexp()</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><ge>1.6.8</ge><lt>1.8.18p1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd C. Miller reports:</p>
	<blockquote cite="https://www.sudo.ws/alerts/noexec_wordexp.html">
	<p>A flaw exists in sudo's noexec functionality that may allow
	a user with sudo privileges to run additional commands even when the
	NOEXEC tag has been applied to a command that uses the wordexp()
	function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.sudo.ws/alerts/noexec_wordexp.html</url>
	<cvename>CVE-2016-7076</cvename>
	</references>
	<dates>
	<discovery>2016-10-28</discovery>
	<entry>2016-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="ac18046c-9b08-11e6-8011-005056925db4">
	<topic>Axis2 -- Security vulnerabilities on dependency Apache HttpClient</topic>
	<affects>
	<package>
	<name>axis2</name>
	<range><lt>1.7.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Axis2 reports:</p>
	<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html">
	<p>Apache Axis2 1.7.4 is a maintenance release that includes fixes for
	several issues, including the following security issues:
	Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities
	affecting the admin console.
	A dependency on an Apache HttpClient version affected by known security
	vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html</url>
	<url>https://issues.apache.org/jira/browse/AXIS2-4739</url>
	<url>https://issues.apache.org/jira/browse/AXIS2-5683</url>
	<url>https://issues.apache.org/jira/browse/AXIS2-5757</url>
	<cvename>CVE-2012-6153</cvename>
	<cvename>CVE-2014-3577</cvename>
	</references>
	<dates>
	<discovery>2012-12-06</discovery>
	<entry>2016-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="28bb6ee5-9b5c-11e6-b799-19bef72f4b7c">
	<topic>node.js -- ares_create_query single byte out of buffer write</topic>
	<affects>
	<package>
	<name>node010</name>
	<range><lt>0.10.48</lt></range>
	</package>
	<package>
	<name>node012</name>
	<range><lt>0.12.17</lt></range>
	</package>
	<package>
	<name>node4</name>
	<range><lt>4.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js has released new versions containing the following security fix:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
	<p>The following releases all contain fixes for CVE-2016-5180 "ares_create_query single
	byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance),
	Node.js v4.6.1 (LTS "Argon")
	</p>
	<p>While this is not a critical update, all users of these release lines should upgrade at
	their earliest convenience.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
	<cvename>CVE-2016-5180</cvename>
	<freebsdpr>ports/213800</freebsdpr>
	</references>
	<dates>
	<discovery>2016-10-18</discovery>
	<entry>2016-10-26</entry>
	</dates>
	</vuln>

	<vuln vid="27180c99-9b5c-11e6-b799-19bef72f4b7c">
	<topic>node.js -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node</name>
	<range><ge>6.0.0</ge><lt>6.9.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:</p>
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
	<p>Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL
	configuration file, from the OPENSSL_CONF environment variable or from the default
	location for the current platform. Always triggering a configuration file load attempt
	may allow an attacker to load compromised OpenSSL configuration into a Node.js process
	if they are able to place a file in a default location.
	</p>
	<p>Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes,
	potentially allowing an attacker to obtain sensitive information from arbitrary memory
	locations via crafted JavaScript code. This vulnerability would require an attacker to
	be able to execute arbitrary JavaScript code in a Node.js process.
	</p>
	<p>Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of
	the inspector. This provides additional security to prevent unauthorized clients from
	connecting to the Node.js process via the v8_inspector port when running with --inspect.
	Since the debugging protocol allows extensive access to the internals of a running process,
	and the execution of arbitrary code, it is important to limit connections to authorized
	tools only. Note that the v8_inspector protocol in Node.js is still considered an
	experimental feature. Vulnerability originally reported by Jann Horn.
	</p>
	<p>All of these vulnerabilities are considered low-severity for Node.js users, however,
	users of Node.js v6.x should upgrade at their earliest convenience.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
	<cvename>CVE-2016-5172</cvename>
	</references>
	<dates>
	<discovery>2016-10-18</discovery>
	<entry>2016-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="c5c6e293-9cc7-11e6-823f-b8aeed92ecc4">
	<topic>urllib3 -- certificate verification failure</topic>
	<affects>
	<package>
	<name>py-urllib3</name>
	<range><lt>1.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>urllib3 reports:</p>
	<blockquote cite="https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst">
	<p>CVE-2016-9015: Certification verification failure</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-9015</cvename>
	<url>https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst</url>
	</references>
	<dates>
	<discovery>2016-10-27</discovery>
	<entry>2016-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="de6d01d5-9c44-11e6-ba67-0011d823eebd">
	<topic>flash -- remote code execution</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6-flashplugin</name>
	<name>linux-c7-flashplugin</name>
	<range><lt>11.2r202.643</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-36.html">
	<p>Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh, Linux and Chrome OS. These updates address a
	critical vulnerability that could potentially allow an attacker to
	take control of the affected system.</p>
	<p>Adobe is aware of a report that an exploit for CVE-2016-7855
	exists in the wild, and is being used in limited, targeted attacks
	against users running Windows versions 7, 8.1 and 10.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-7855</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-36.html</url>
	</references>
	<dates>
	<discovery>2016-10-26</discovery>
	<entry>2016-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="a479a725-9adb-11e6-a298-14dae9d210b8">
	<topic>FreeBSD -- bhyve - privilege escalation vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.0</ge><lt>11.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>An unchecked array reference in the VGA device emulation
	code could potentially allow guests access to the heap of
	the bhyve process. Since the bhyve process is running as
	root, this may allow guests to obtain full control of the
	hosts they are running on.</p>
	<h1>Impact:</h1>
	<p>For bhyve virtual machines with the "fbuf" framebuffer
	device configured, if exploited, a malicious guest could
	obtain full access to not just the host system, but to other
	virtual machines running on the system.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:32.bhyve</freebsdsa>
	</references>
	<dates>
	<discovery>2016-10-25</discovery>
	<entry>2016-10-25</entry>
	<modified>2016-10-25</modified>
	</dates>
	</vuln>

	<vuln vid="2482c798-93c6-11e6-846f-bc5ff4fb5ea1">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-c7-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.637</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-32.html">
	<p>Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh, Linux and ChromeOS. These updates address
	critical vulnerabilities that could potentially allow an attacker
	to take control of the affected system.</p>
	<p>These updates resolve a type confusion vulnerability that could
	lead to code execution (CVE-2016-6992).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2016-6981, CVE-2016-6987).</p>
	<p>These updates resolve a security bypass vulnerability
	(CVE-2016-4286).</p>
	<p>These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2016-4273, CVE-2016-6982,
	CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986,
	CVE-2016-6989, CVE-2016-6990).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4273</cvename>
	<cvename>CVE-2016-4286</cvename>
	<cvename>CVE-2016-6981</cvename>
	<cvename>CVE-2016-6982</cvename>
	<cvename>CVE-2016-6983</cvename>
	<cvename>CVE-2016-6984</cvename>
	<cvename>CVE-2016-6985</cvename>
	<cvename>CVE-2016-6986</cvename>
	<cvename>CVE-2016-6987</cvename>
	<cvename>CVE-2016-6989</cvename>
	<cvename>CVE-2016-6990</cvename>
	<cvename>CVE-2016-6992</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-32.html</url>
	</references>
	<dates>
	<discovery>2016-10-11</discovery>
	<entry>2016-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>49.0.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-87/">
	<p>CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements</p>
	<p>CVE-2016-5288: Web content can read cache entries</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5287</cvename>
	<cvename>CVE-2016-5288</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-87/</url>
	</references>
	<dates>
	<discovery>2016-10-20</discovery>
	<entry>2016-10-21</entry>
	</dates>
	</vuln>

	<vuln vid="0baadc45-92d0-11e6-8011-005056925db4">
	<topic>Axis2 -- Cross-site scripting (XSS) vulnerability</topic>
	<affects>
	<package>
	<name>axis2</name>
	<range><lt>1.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Axis2 reports:</p>
	<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html">
	<p>Apache Axis2 1.7.3 is a security release that contains a fix
	for CVE-2010-3981. That security vulnerability affects the admin console
	that is part of the Axis2 Web application and was originally reported
	for SAP BusinessObjects (which includes a version of Axis2). That report
	didn’t mention Axis2 at all and the Axis2 project only recently became
	aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue
	affects Apache Axis2 as well.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html</url>
	<cvename>CVE-2010-3981</cvename>
	<freebsdpr>ports/213546</freebsdpr>
	</references>
	<dates>
	<discovery>2010-10-18</discovery>
	<entry>2016-10-18</entry>
	</dates>
	</vuln>

	<vuln vid="c1dc55dc-9556-11e6-b154-3065ec8fd3ec">
	<topic>Tor -- remote denial of service</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.2.8.9</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.9.4-alpha</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Blog reports:</p>
	<blockquote cite="https://blog.torproject.org/blog/tor-0289-released-important-fixes">
	<p>Prevent a class of security bugs caused by treating the contents
	of a buffer chunk as if they were a NUL-terminated string. At least
	one such bug seems to be present in all currently used versions of
	Tor, and would allow an attacker to remotely crash most Tor
	instances, especially those compiled with extra compiler hardening.
	With this defense in place, such bugs can't crash Tor, though we
	should still fix them as they occur. Closes ticket 20384
	(TROVE-2016-10-001).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blog.torproject.org/blog/tor-0289-released-important-fixes</url>
	</references>
	<dates>
	<discovery>2016-10-17</discovery>
	<entry>2016-10-18</entry>
	</dates>
	</vuln>

	<vuln vid="43f1c867-654a-11e6-8286-00248c0c745d">
	<topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic>
	<affects>
	<package>
	<name>rubygem-actionview</name>
	<range><gt>3.0.0</gt><lt>4.2.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Security team reports:</p>
	<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE">
	<p>There is a possible XSS vulnerability in Action View. Text declared as "HTML
	safe" will not have quotes escaped when used as attribute values in tag
	helpers. This vulnerability has been assigned the CVE identifier
	CVE-2016-6316.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE</url>
	<cvename>CVE-2016-6316</cvename>
	</references>
	<dates>
	<discovery>2016-08-11</discovery>
	<entry>2016-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="7e61cf44-6549-11e6-8286-00248c0c745d">
	<topic>Rails 4 -- Unsafe Query Generation Risk in Active Record</topic>
	<affects>
	<package>
	<name>rubygem-activerecord4</name>
	<range><gt>4.2.0</gt><lt>4.2.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Security team reports:</p>
	<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA">
	<p>There is a vulnerability when Active Record is used in conjunction with JSON
	parameter parsing. This vulnerability has been assigned the CVE identifier
	CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694
	and CVE-2013-0155.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA</url>
	<cvename>CVE-2016-6317</cvename>
	</references>
	<dates>
	<discovery>2016-08-11</discovery>
	<entry>2016-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="f471032a-8700-11e6-8d93-00248c0c745d">
	<topic>PHP -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70</name>
	<range><lt>7.0.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.11">
	<ul>
	<li><p>Fixed bug #73007 (add locale length check)</p></li>
	<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
	<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
	<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
	<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
	<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
	<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-7.php#7.0.11</url>
	<cvename>CVE-2016-7416</cvename>
	<cvename>CVE-2016-7412</cvename>
	<cvename>CVE-2016-7414</cvename>
	<cvename>CVE-2016-7417</cvename>
	<cvename>CVE-2016-7413</cvename>
	<cvename>CVE-2016-7418</cvename>
	</references>
	<dates>
	<discovery>2016-09-15</discovery>
	<entry>2016-09-30</entry>
	</dates>
	</vuln>

	<vuln vid="8d5180a6-86fe-11e6-8d93-00248c0c745d">
	<topic>PHP -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php56</name>
	<range><lt>5.6.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.6.26">
	<ul>
	<li><p>Fixed bug #73007 (add locale length check)</p></li>
	<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
	<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
	<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
	<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
	<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
	<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-5.php#5.6.26</url>
	<cvename>CVE-2016-7416</cvename>
	<cvename>CVE-2016-7412</cvename>
	<cvename>CVE-2016-7414</cvename>
	<cvename>CVE-2016-7417</cvename>
	<cvename>CVE-2016-7411</cvename>
	<cvename>CVE-2016-7413</cvename>
	<cvename>CVE-2016-7418</cvename>
	</references>
	<dates>
	<discovery>2016-09-16</discovery>
	<entry>2016-09-30</entry>
	</dates>
	</vuln>

	<vuln vid="ad479f89-9020-11e6-a590-14dae9d210b8">
	<topic>file-roller -- path traversal vulnerability</topic>
	<affects>
	<package>
	<name>file-roller</name>
	<range><ge>3.5.4,1</ge><lt>3.20.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/4">
	<p>File Roller 3.5.4 through 3.20.2 was affected by a path
	traversal bug that could result in deleted files if a user
	were tricked into opening a malicious archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2016/09/08/4</url>
	<cvename>CVE-2016-7162</cvename>
	<freebsdpr>ports/213199</freebsdpr>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-10-12</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="7d40edd1-901e-11e6-a590-14dae9d210b8">
	<topic>VirtualBox -- undisclosed vulnerabilities</topic>
	<affects>
	<package>
	<name>virtualbox-ose</name>
	<range><ge>5.0</ge><lt>5.0.8</lt></range>
	<range><ge>4.3</ge><lt>4.3.32</lt></range>
	<range><ge>4.2</ge><lt>4.2.34</lt></range>
	<range><ge>4.1</ge><lt>4.1.42</lt></range>
	<range><ge>4.0</ge><lt>4.0.34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
	<p>Unspecified vulnerability in the Oracle VM VirtualBox
	component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42,
	4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local
	users to affect availability via unknown vectors related to Core.</p>
	<p>Unspecified vulnerability in the Oracle VM VirtualBox
	component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42,
	4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature
	(RDP) enabled, allows remote attackers to affect availability via
	unknown vectors related to Core.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
	<cvename>CVE-2015-4813</cvename>
	<cvename>CVE-2015-4896</cvename>
	<freebsdpr>ports/204406</freebsdpr>
	</references>
	<dates>
	<discovery>2015-10-01</discovery>
	<entry>2016-10-12</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="10f7f782-901c-11e6-a590-14dae9d210b8">
	<topic>ImageMagick -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.5.10,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://www.debian.org/security/2016/dsa-3675">
	<p>Various memory handling problems and cases of missing or
	incomplete input sanitizing may result in denial of service or the
	execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and
	CALS files are processed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.debian.org/security/2016/dsa-3675</url>
	<freebsdpr>ports/213032</freebsdpr>
	</references>
	<dates>
	<discovery>2016-09-23</discovery>
	<entry>2016-10-12</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="2a526c78-84ab-11e6-a4a1-60a44ce6887b">
	<topic>libgd -- integer overflow which could lead to heap buffer overflow</topic>
	<affects>
	<package>
	<name>gd</name>
	<range><le>2.2.3</le></range>
	</package>
	<package>
	<name>php70-gd</name>
	<range><le>7.0.11</le></range>
	</package>
	<package>
	<name>php56-gd</name>
	<range><le>5.6.26</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>LibGD reports:</p>
	<blockquote cite="https://github.com/libgd/libgd/issues/308">
	<p>An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/libgd/libgd/issues/308</url>
	<url>https://bugs.php.net/bug.php?id=73003</url>
	<freebsdpr>ports/213023</freebsdpr>
	</references>
	<dates>
	<discovery>2016-09-02</discovery>
	<entry>2016-10-11</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="cb3f036d-8c7f-11e6-924a-60a44ce6887b">
	<topic>libvncserver -- multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>libvncserver</name>
	<range><lt>0.9.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nicolas Ruff reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2014/q3/639">
	<p>Integer overflow in MallocFrameBuffer() on client side.</p>
	<p>Lack of malloc() return value checking on client side.</p>
	<p>Server crash on a very large ClientCutText message.</p>
	<p>Server crash when scaling factor is set to zero.</p>
	<p>Multiple stack overflows in File Transfer feature.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2014/q3/639</url>
	<cvename>CVE-2014-6051</cvename>
	<cvename>CVE-2014-6052</cvename>
	<cvename>CVE-2014-6053</cvename>
	<cvename>CVE-2014-6054</cvename>
	<cvename>CVE-2014-6055</cvename>
	<freebsdpr>ports/212380</freebsdpr>
	</references>
	<dates>
	<discovery>2014-09-23</discovery>
	<entry>2016-10-11</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="ab947396-9018-11e6-a590-14dae9d210b8">
	<topic>openoffice -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>apache-openoffice</name>
	<name>apache-openoffice-devel</name>
	<range><lt>4.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2014-3575.html">
	<p>The exposure exploits the way OLE previews are generated to
	embed arbitrary file data into a specially crafted document when it is
	opened. Data exposure is possible if the updated document is distributed
	to other parties.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openoffice.org/security/cves/CVE-2014-3575.html</url>
	<cvename>CVE-2014-3575</cvename>
	<freebsdpr>ports/212379</freebsdpr>
	</references>
	<dates>
	<discovery>2014-08-21</discovery>
	<entry>2016-10-12</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="47157c14-9013-11e6-a590-14dae9d210b8">
	<topic>mupdf -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mupdf</name>
	<range><lt>1.9a_1,1</lt></range>
	</package>
	<package>
	<name>llpp</name>
	<range><lt>22_2</lt></range>
	</package>
	<package>
	<name>zathura-pdf-mupdf</name>
	<range><lt>0.3.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tobias Kortkamp reports:</p>
	<blockquote cite="http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html">
	<p>Heap-based buffer overflow in the pdf_load_mesh_params
	function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a
	denial of service (crash) or execute arbitrary code via a large decode
	array.</p>
	<p>Use-after-free vulnerability in the pdf_load_xref function in
	pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of
	service (crash) via a crafted PDF file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html</url>
	<url>http://bugs.ghostscript.com/show_bug.cgi?id=696941</url>
	<url>http://bugs.ghostscript.com/show_bug.cgi?id=696954</url>
	<cvename>CVE-2016-6525</cvename>
	<cvename>CVE-2016-6265</cvename>
	<freebsdpr>ports/212207</freebsdpr>
	</references>
	<dates>
	<discovery>2016-08-27</discovery>
	<entry>2016-10-12</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="b7d56d0b-7a11-11e6-af78-589cfc0654e1">
	<topic>openjpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openjpeg</name>
	<range><lt>2.1.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tencent's Xuanwu LAB reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/2">
	<p>A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in
	function opj_dwt_interleave_v of dwt.c. This vulnerability allows
	remote attackers to execute arbitrary code on vulnerable installations
	of OpenJPEG.</p>
	<p>An integer overflow issue exists in function opj_pi_create_decode of
	pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in
	function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp,
	opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be
	vulnerable). This vulnerability allows remote attackers to execute
	arbitrary code on vulnerable installations of OpenJPEG.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>"http://www.openwall.com/lists/oss-security/2016/09/08/2"</url>
	<url>"http://www.openwall.com/lists/oss-security/2016/09/08/3"</url>
	<cvename>CVE-2016-5157</cvename>
	<cvename>CVE-2016-7163</cvename>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="fa175f30-8c75-11e6-924a-60a44ce6887b">
	<topic>redis -- sensitive information leak through command history file</topic>
	<affects>
	<package>
	<name>redis</name>
	<name>redis-devel</name>
	<range><lt>3.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redis team reports:</p>
	<blockquote cite="https://github.com/antirez/redis/pull/1418">
	<p>The redis-cli history file (in linenoise) is created with the
	default OS umask value which makes it world readable in most systems
	and could potentially expose authentication credentials to other
	users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/antirez/redis/pull/1418</url>
	<url>https://github.com/antirez/redis/issues/3284</url>
	<cvename>CVE-2013-7458</cvename>
	</references>
	<dates>
	<discovery>2013-11-30</discovery>
	<entry>2016-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="1a71a972-8ee7-11e6-a590-14dae9d210b8">
	<topic>FreeBSD -- Multiple libarchive vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_10</lt></range>
	<range><ge>10.2</ge><lt>10.2_23</lt></range>
	<range><ge>10.1</ge><lt>10.1_40</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Flaws in libarchive's handling of symlinks and hard links
	allow overwriting files outside the extraction directory,
	or permission changes to a directory outside the extraction
	directory.</p>
	<h1>Impact:</h1>
	<p>An attacker who can control freebsd-update's or portsnap's
	input to tar(1) can change file content or permissions on
	files outside of the update tool's working sandbox.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:31.libarchive</freebsdsa>
	</references>
	<dates>
	<discovery>2016-10-05</discovery>
	<entry>2016-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="e7dcd69d-8ee6-11e6-a590-14dae9d210b8">
	<topic>FreeBSD -- Multiple portsnap vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_10</lt></range>
	<range><ge>10.2</ge><lt>10.2_23</lt></range>
	<range><ge>10.1</ge><lt>10.1_40</lt></range>
	<range><ge>9.3</ge><lt>9.3_48</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Flaws in portsnap's verification of downloaded tar files
	allows additional files to be included without causing the
	verification to fail. Portsnap may then use or execute these
	files.</p>
	<h1>Impact:</h1>
	<p>An attacker who can conduct man in the middle attack on
	the network at the time when portsnap is run can cause
	portsnap to execute arbitrary commands under the credentials
	of the user who runs portsnap, typically root.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:30.portsnap</freebsdsa>
	</references>
	<dates>
	<discovery>2016-10-10</discovery>
	<entry>2016-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="ce808022-8ee6-11e6-a590-14dae9d210b8">
	<topic>FreeBSD -- Heap overflow vulnerability in bspatch</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_10</lt></range>
	<range><ge>10.2</ge><lt>10.2_23</lt></range>
	<range><ge>10.1</ge><lt>10.1_40</lt></range>
	<range><ge>9.3</ge><lt>9.3_48</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The implementation of bspatch is susceptible to integer
	overflows with carefully crafted input, potentially allowing
	an attacker who can control the patch file to write at
	arbitrary locations in the heap. This issue was partially
	addressed in FreeBSD-SA-16:25.bspatch, but some possible
	integer overflows remained.</p>
	<h1>Impact:</h1>
	<p>An attacker who can control the patch file can cause a
	crash or run arbitrary code under the credentials of the
	user who runs bspatch, in many cases, root.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:29.bspatch</freebsdsa>
	</references>
	<dates>
	<discovery>2016-10-10</discovery>
	<entry>2016-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="aeb7874e-8df1-11e6-a082-5404a68ad561">
	<topic>mkvtoolnix -- code execution via specially crafted files</topic>
	<affects>
	<package>
	<name>mkvtoolnix</name>
	<range><lt>9.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Moritz Bunkus reports:</p>
	<blockquote cite="https://mkvtoolnix.download/doc/ChangeLog">
	<p>most of the bugs fixed on 2016-09-06 and 2016-09-07 for
	issue #1780 are potentially exploitable. The scenario is arbitrary
	code execution with specially-crafted files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mkvtoolnix.download/doc/ChangeLog</url>
	</references>
	<dates>
	<discovery>2016-09-07</discovery>
	<entry>2016-10-09</entry>
	</dates>
	</vuln>

	<vuln vid="1cf65085-a760-41d2-9251-943e1af62eb8">
	<topic>X.org libraries -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libX11</name>
	<range><lt>1.6.4,1</lt></range>
	</package>
	<package>
	<name>libXfixes</name>
	<range><lt>5.0.3</lt></range>
	</package>
	<package>
	<name>libXi</name>
	<range><lt>1.7.7,1</lt></range>
	</package>
	<package>
	<name>libXrandr</name>
	<range><lt>1.5.1</lt></range>
	</package>
	<package>
	<name>libXrender</name>
	<range><lt>0.9.10</lt></range>
	</package>
	<package>
	<name>libXtst</name>
	<range><lt>1.2.3</lt></range>
	</package>
	<package>
	<name>libXv</name>
	<range><lt>1.0.11,1</lt></range>
	</package>
	<package>
	<name>libXvMC</name>
	<range><lt>1.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthieu Herrb reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2016-October/002720.html">
	<p>Tobias Stoeckmann from the OpenBSD project has discovered a
	number of issues in the way various X client libraries handle
	the responses they receive from servers, and has worked with
	X.Org's security team to analyze, confirm, and fix these issues.
	These issue come in addition to the ones discovered by Ilja van
	Sprundel in 2013.</p>

	<p>Most of these issues stem from the client libraries trusting
	the server to send correct protocol data, and not verifying
	that the values will not overflow or cause other damage. Most
	of the time X clients and servers are run by the same user, with
	the server more privileged than the clients, so this is not a
	problem, but there are scenarios in which a privileged client
	can be connected to an unprivileged server, for instance,
	connecting a setuid X client (such as a screen lock program)
	to a virtual X server (such as Xvfb or Xephyr) which the user
	has modified to return invalid data, potentially allowing the
	user to escalate their privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.x.org/archives/xorg-announce/2016-October/002720.html</url>
	<cvename>CVE-2016-5407</cvename>
	</references>
	<dates>
	<discovery>2016-10-04</discovery>
	<entry>2016-10-07</entry>
	<modified>2016-10-10</modified>
	</dates>
	</vuln>

	<vuln vid="c8d902b1-8550-11e6-81e7-d050996490d0">
	<topic>BIND -- Remote Denial of Service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.9P3</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.4P3</lt></range>
	</package>
	<package>
	<name>bind911</name>
	<range><lt>9.11.0.rc3</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><lt>9.12.0.a.2016.09.10</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_48</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01419">
	<p>Testing by ISC has uncovered a critical error condition
	which can occur when a nameserver is constructing a
	response. A defect in the rendering of messages into
	packets can cause named to exit with an assertion
	failure in buffer.c while constructing a response
	to a query that meets certain criteria.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2776</cvename>
	<freebsdsa>SA-16:28.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-01419</url>
	</references>
	<dates>
	<discovery>2016-09-27</discovery>
	<entry>2016-09-28</entry>
	<modified>2016-10-10</modified>
	</dates>
	</vuln>

	<vuln vid="bb022643-84fb-11e6-a4a1-60a44ce6887b">
	<topic>django -- CSRF protection bypass on a site with Google Analytics</topic>
	<affects>
	<package>
	<name>py-django19</name>
	<range><lt>1.9.10</lt></range>
	</package>
	<package>
	<name>py-django18</name>
	<range><lt>1.8.15</lt></range>
	</package>
	<package>
	<name>py-django</name>
	<range><lt>1.8.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django Software Foundation reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2016/sep/26/security-releases/">
	<p>An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2016/sep/26/security-releases/</url>
	<cvename>CVE-2016-7401</cvename>
	</references>
	<dates>
	<discovery>2016-09-26</discovery>
	<entry>2016-09-27</entry>
	</dates>
	</vuln>

	<vuln vid="91a337d8-83ed-11e6-bf52-b499baebfeaf">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2j,1</lt></range>
	</package>
	<package>
	<name>openssl-devel</name>
	<range><lt>1.1.0b</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><lt>2.4.3</lt></range>
	</package>
	<package>
	<name>libressl-devel</name>
	<range><lt>2.4.3</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20160926.txt">
	<p>Critical vulnerability in OpenSSL 1.1.0a<br/>
	Fix Use After Free for large message sizes (CVE-2016-6309)</p>
	<p>Moderate vulnerability in OpenSSL 1.0.2i<br/>
	Missing CRL sanity check (CVE-2016-7052)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20160926.txt</url>
	<cvename>CVE-2016-6309</cvename>
	<cvename>CVE-2016-7052</cvename>
	<freebsdsa>SA-16:27.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2016-09-26</discovery>
	<entry>2016-09-26</entry>
	<modified>2016-10-10</modified>
	</dates>
	</vuln>

	<vuln vid="43eaa656-80bc-11e6-bf52-b499baebfeaf">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl-devel</name>
	<range><ge>1.1.0</ge><lt>1.1.0_1</lt></range>
	</package>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2i,1</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_11</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_8</lt></range>
	<range><ge>10.2</ge><lt>10.2_21</lt></range>
	<range><ge>10.1</ge><lt>10.1_38</lt></range>
	<range><ge>9.3</ge><lt>9.3_46</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20160922.txt">
	<p>High: OCSP Status Request extension unbounded memory growth</p>
	<p>SSL_peek() hang on empty record</p>
	<p>SWEET32 Mitigation</p>
	<p>OOB write in MDC2_Update()</p>
	<p>Malformed SHA512 ticket DoS</p>
	<p>OOB write in BN_bn2dec()</p>
	<p>OOB read in TS_OBJ_print_bio()</p>
	<p>Pointer arithmetic undefined behaviour</p>
	<p>Constant time flag not preserved in DSA signing</p>
	<p>DTLS buffered message DoS</p>
	<p>DTLS replay protection DoS</p>
	<p>Certificate message OOB reads</p>
	<p>Excessive allocation of memory in tls_get_message_header()</p>
	<p>Excessive allocation of memory in dtls1_preprocess_fragment()</p>
	<p>NB: LibreSSL is only affected by CVE-2016-6304</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20160922.txt</url>
	<cvename>CVE-2016-6304</cvename>
	<cvename>CVE-2016-6305</cvename>
	<cvename>CVE-2016-2183</cvename>
	<cvename>CVE-2016-6303</cvename>
	<cvename>CVE-2016-6302</cvename>
	<cvename>CVE-2016-2182</cvename>
	<cvename>CVE-2016-2180</cvename>
	<cvename>CVE-2016-2177</cvename>
	<cvename>CVE-2016-2178</cvename>
	<cvename>CVE-2016-2179</cvename>
	<cvename>CVE-2016-2181</cvename>
	<cvename>CVE-2016-6306</cvename>
	<cvename>CVE-2016-6307</cvename>
	<cvename>CVE-2016-6308</cvename>
	<freebsdsa>SA-16:26.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2016-09-22</discovery>
	<entry>2016-09-22</entry>
	<modified>2016-10-11</modified>
	</dates>
	</vuln>

	<vuln vid="e78261e4-803d-11e6-a590-14dae9d210b8">
	<topic>irssi -- heap corruption and missing boundary checks</topic>
	<affects>
	<package>
	<name>irssi</name>
	<name>zh-irssi</name>
	<range><ge>0.8.17</ge><lt>0.8.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Irssi reports:</p>
	<blockquote cite="https://irssi.org/security/irssi_sa_2016.txt">
	<p>Remote crash and heap corruption. Remote code execution seems
	difficult since only Nuls are written.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://irssi.org/security/irssi_sa_2016.txt</url>
	<cvename>CVE-2016-7044</cvename>
	<cvename>CVE-2016-7045</cvename>
	</references>
	<dates>
	<discovery>2016-09-21</discovery>
	<entry>2016-09-21</entry>
	<modified>2016-09-22</modified>
	</dates>
	</vuln>

	<vuln vid="2c57c47e-8bb3-4694-83c8-9fc3abad3964">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>49.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.46</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.4.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.4.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/">
	<p>CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]</p>
	<p>CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]</p>
	<p>CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]</p>
	<p>CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]</p>
	<p>CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]</p>
	<p>CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]</p>
	<p>CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]</p>
	<p>CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]</p>
	<p>CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]</p>
	<p>CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]</p>
	<p>CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]</p>
	<p>CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]</p>
	<p>CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]</p>
	<p>CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]</p>
	<p>CVE-2016-5281 - use-after-free in DOMSVGLength [high]</p>
	<p>CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]</p>
	<p>CVE-2016-5283 - <iframe src> fragment timing attack can reveal cross-origin data [high]</p>
	<p>CVE-2016-5284 - Add-on update site certificate pin expiration [high]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2827</cvename>
	<cvename>CVE-2016-5256</cvename>
	<cvename>CVE-2016-5257</cvename>
	<cvename>CVE-2016-5270</cvename>
	<cvename>CVE-2016-5271</cvename>
	<cvename>CVE-2016-5272</cvename>
	<cvename>CVE-2016-5273</cvename>
	<cvename>CVE-2016-5274</cvename>
	<cvename>CVE-2016-5275</cvename>
	<cvename>CVE-2016-5276</cvename>
	<cvename>CVE-2016-5277</cvename>
	<cvename>CVE-2016-5278</cvename>
	<cvename>CVE-2016-5279</cvename>
	<cvename>CVE-2016-5280</cvename>
	<cvename>CVE-2016-5281</cvename>
	<cvename>CVE-2016-5282</cvename>
	<cvename>CVE-2016-5283</cvename>
	<cvename>CVE-2016-5284</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-85/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-86/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-88/</url>
	</references>
	<dates>
	<discovery>2016-09-13</discovery>
	<entry>2016-09-20</entry>
	<modified>2016-10-21</modified>
	</dates>
	</vuln>

	<vuln vid="653a8059-7c49-11e6-9242-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>53.0.2785.113</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html">
	<p>Several security fixes in this release, including:</p>
	<ul>
	<li>[641101] High CVE-2016-5170: Use after free in Blink.Credit to
	Anonymous</li>
	<li>[643357] High CVE-2016-5171: Use after free in Blink. Credit to
	Anonymous</li>
	<li>[616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8.
	Credit to Choongwoo Han</li>
	<li>[468931] Medium CVE-2016-5173: Extension resource access.
	Credit to Anonymous</li>
	<li>[579934] Medium CVE-2016-5174: Popup not correctly suppressed.
	Credit to Andrey Kovalev (@L1kvID) Yandex Security Team</li>
	<li>[646394] CVE-2016-5175: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5170</cvename>
	<cvename>CVE-2016-5171</cvename>
	<cvename>CVE-2016-5172</cvename>
	<cvename>CVE-2016-5173</cvename>
	<cvename>CVE-2016-5174</cvename>
	<cvename>CVE-2016-5175</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html</url>
	</references>
	<dates>
	<discovery>2016-09-13</discovery>
	<entry>2016-09-16</entry>
	</dates>
	</vuln>

	<vuln vid="b64a7389-7c27-11e6-8aaa-5404a68ad561">
	<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
	<affects>
	<package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>LegalHackers' reports:</p>
	<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
	<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
	It works by manipulating my.cnf files and using --malloc-lib.
	The bug seems fixed in MySQL 5.7.15 by Oracle</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6662</cvename>
	<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
	<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
	</references>
	<dates>
	<discovery>2016-09-12</discovery>
	<entry>2016-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="bc19dcca-7b13-11e6-b99e-589cfc0654e1">
	<topic>dropbear -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dropbear</name>
	<range><lt>2016.74</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matt Johnston reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/15/2">
	<p>If specific usernames including "%" symbols can be created on a system
	(validated by getpwnam()) then an attacker could run arbitrary code as root
	when connecting to Dropbear server.

	A dbclient user who can control username or host arguments could potentially
	run arbitrary code as the dbclient user. This could be a problem if scripts
	or webpages pass untrusted input to the dbclient program.</p>
	<p>dropbearconvert import of OpenSSH keys could run arbitrary code as
	the local dropbearconvert user when parsing malicious key files.</p>
	<p>dbclient could run arbitrary code as the local dbclient user if
	particular -m or -c arguments are provided. This could be an issue where
	dbclient is used in scripts.</p>
	<p>dbclient or dropbear server could expose process memory to the
	running user if compiled with DEBUG_TRACE and running with -v</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>"http://www.openwall.com/lists/oss-security/2016/09/15/2"</url>
	<cvename>CVE-2016-7406</cvename>
	<cvename>CVE-2016-7407</cvename>
	<cvename>CVE-2016-7408</cvename>
	<cvename>CVE-2016-7409</cvename>
	</references>
	<dates>
	<discovery>2016-07-12</discovery>
	<entry>2016-09-15</entry>
	</dates>
	</vuln>

	<vuln vid="08664d42-7989-11e6-b7a8-74d02b9a84d5">
	<topic>h2o -- fix DoS attack vector</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range>
	<lt>2.0.4</lt>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Frederik Deweerdt reported a denial-of-service attack vector
	due to an unhandled error condition during socket connection.</p>
	</body>
	</description>
	<references>
	<url>https://github.com/h2o/h2o/issues/1077</url>
	<cvename>CVE-2016-4864</cvename>
	</references>
	<dates>
	<discovery>2016-06-09</discovery>
	<entry>2016-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="b018121b-7a4b-11e6-bf52-b499baebfeaf">
	<topic>cURL -- Escape and unescape integer overflows</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.11.1</ge><lt>7.50.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports</p>
	<blockquote cite="https://curl.haxx.se/docs/adv_20160914.html">
	<p>The four libcurl functions curl_escape(), curl_easy_escape(),
	curl_unescape and curl_easy_unescape perform string URL percent
	escaping and unescaping. They accept custom string length inputs
	in signed integer arguments.</p>
	<p>The provided string length arguments were not properly checked
	and due to arithmetic in the functions, passing in the length
	0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up
	causing an allocation of zero bytes of heap memory that curl
	would attempt to write gigabytes of data into.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://curl.haxx.se/docs/adv_20160914.html</url>
	<cvename>CVE-2016-7167</cvename>
	</references>
	<dates>
	<discovery>2016-09-14</discovery>
	<entry>2016-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="769ba449-79e1-11e6-bf75-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>53.0.2785.92</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html">
	<p>33 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5147</cvename>
	<cvename>CVE-2016-5148</cvename>
	<cvename>CVE-2016-5149</cvename>
	<cvename>CVE-2016-5150</cvename>
	<cvename>CVE-2016-5151</cvename>
	<cvename>CVE-2016-5152</cvename>
	<cvename>CVE-2016-5153</cvename>
	<cvename>CVE-2016-5154</cvename>
	<cvename>CVE-2016-5155</cvename>
	<cvename>CVE-2016-5156</cvename>
	<cvename>CVE-2016-5157</cvename>
	<cvename>CVE-2016-5158</cvename>
	<cvename>CVE-2016-5159</cvename>
	<cvename>CVE-2016-5160</cvename>
	<cvename>CVE-2016-5161</cvename>
	<cvename>CVE-2016-5162</cvename>
	<cvename>CVE-2016-5163</cvename>
	<cvename>CVE-2016-5164</cvename>
	<cvename>CVE-2016-5165</cvename>
	<cvename>CVE-2016-5166</cvename>
	<cvename>CVE-2016-5167</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html</url>
	</references>
	<dates>
	<discovery>2016-08-31</discovery>
	<entry>2016-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="958b9cee-79da-11e6-bf75-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>52.0.2743.116</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html">
	<p>10 security fixes in this release, including:</p>
	<ul>
	<li>[629542] High CVE-2016-5141 Address bar spoofing. Credit to
	anonymous</li>
	<li>[626948] High CVE-2016-5142 Use-after-free in Blink. Credit to
	anonymous</li>
	<li>[625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to
	GiWan Go of Stealien</li>
	<li>[619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to
	Ke Liu of Tencent's Xuanwu LAB</li>
	<li>[623406] Medium CVE-2016-5145 Same origin bypass for images in
	Blink. Credit to anonymous</li>
	<li>[619414] Medium CVE-2016-5143 Parameter sanitization failure in
	DevTools. Credit to Gregory Panakkal</li>
	<li>[618333] Medium CVE-2016-5144 Parameter sanitization failure in
	DevTools. Credit to Gregory Panakkal</li>
	<li>[633486] CVE-2016-5146: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5139</cvename>
	<cvename>CVE-2016-5140</cvename>
	<cvename>CVE-2016-5141</cvename>
	<cvename>CVE-2016-5142</cvename>
	<cvename>CVE-2016-5143</cvename>
	<cvename>CVE-2016-5144</cvename>
	<cvename>CVE-2016-5145</cvename>
	<cvename>CVE-2016-5146</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html</url>
	</references>
	<dates>
	<discovery>2016-08-03</discovery>
	<entry>2016-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="856b88bf-7984-11e6-81e7-d050996490d0">
	<topic>mysql -- Remote Root Code Execution</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.51</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.27</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.17</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.52</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.33</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.51.38.1</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.32.78.0</lt></range>
	</package>
	<package>
	<name>percona57-server</name>
	<range><lt>5.7.14.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dawid Golunski reports:</p>
	<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt">
	<p>An independent research has revealed multiple severe MySQL
	vulnerabilities. This advisory focuses on a critical
	vulnerability with a CVEID of CVE-2016-6662 which can allow
	attackers to (remotely) inject malicious settings into MySQL
	configuration files (my.cnf) leading to critical
	consequences.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6662</cvename>
	<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt</url>
	<url>https://jira.mariadb.org/browse/MDEV-10465</url>
	<url>https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/</url>
	<url>https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/</url>
	<url>https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/</url>
	</references>
	<dates>
	<discovery>2016-09-12</discovery>
	<entry>2016-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="331eabb3-85b1-466a-a2af-66ac864d395a">
	<topic>wolfssl -- leakage of private key information</topic>
	<affects>
	<package>
	<name>wolfssl</name>
	<range><lt>3.6.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Weimer of Redhat discovered that an optimization in
	RSA signature validation can result in disclosure of the
	server's private key under certain fault conditions.</p>
	</body>
	</description>
	<references>
	<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
	<url>https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/</url>
	<cvename>CVE-2015-7744</cvename>
	</references>
	<dates>
	<discovery>2015-09-17</discovery>
	<entry>2016-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="3d1372e1-7822-4fd8-b56e-5ee832afbd96">
	<topic>wolfssl -- DDoS amplification in DTLS</topic>
	<affects>
	<package>
	<name>wolfssl</name>
	<range><lt>3.6.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Ramacher identified an error in wolfSSL's implementation
	of the server side of the DTLS handshake, which could be abused
	for DDoS amplification or a DoS on the DTLS server itself.</p>
	</body>
	</description>
	<references>
	<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
	<url>https://github.com/IAIK/wolfSSL-DoS</url>
	<cvename>CVE-2015-6925</cvename>
	</references>
	<dates>
	<discovery>2015-09-18</discovery>
	<entry>2016-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="a0128291-7690-11e6-95a8-0011d823eebd">
	<topic>gnutls -- OCSP validation issue</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>3.4.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>gnutls.org reports:</p>
	<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-3">
	<p>Stefan Bühler discovered an issue that affects validation
	of certificates using OCSP responses, which can falsely report a
	certificate as valid under certain circumstances.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://gnutls.org/security.html#GNUTLS-SA-2016-3</url>
	</references>
	<dates>
	<discovery>2016-09-08</discovery>
	<entry>2016-09-09</entry>
	</dates>
	</vuln>

	<vuln vid="aa1aefe3-6e37-47db-bfda-343ef4acb1b5">
	<topic>Mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>48.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.45</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.3.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.3.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox48">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0718</cvename>
	<cvename>CVE-2016-2830</cvename>
	<cvename>CVE-2016-2835</cvename>
	<cvename>CVE-2016-2836</cvename>
	<cvename>CVE-2016-2837</cvename>
	<cvename>CVE-2016-2838</cvename>
	<cvename>CVE-2016-2839</cvename>
	<cvename>CVE-2016-5250</cvename>
	<cvename>CVE-2016-5251</cvename>
	<cvename>CVE-2016-5252</cvename>
	<cvename>CVE-2016-5253</cvename>
	<cvename>CVE-2016-5254</cvename>
	<cvename>CVE-2016-5255</cvename>
	<cvename>CVE-2016-5258</cvename>
	<cvename>CVE-2016-5259</cvename>
	<cvename>CVE-2016-5260</cvename>
	<cvename>CVE-2016-5261</cvename>
	<cvename>CVE-2016-5262</cvename>
	<cvename>CVE-2016-5263</cvename>
	<cvename>CVE-2016-5264</cvename>
	<cvename>CVE-2016-5265</cvename>
	<cvename>CVE-2016-5266</cvename>
	<cvename>CVE-2016-5267</cvename>
	<cvename>CVE-2016-5268</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/</url>
	</references>
	<dates>
	<discovery>2016-08-02</discovery>
	<entry>2016-09-07</entry>
	<modified>2016-09-20</modified>
	</dates>
	</vuln>

	<vuln vid="5cb18881-7604-11e6-b362-001999f8d30b">
	<topic>asterisk -- RTP Resource Exhaustion</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.23.1</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>The overlap dialing feature in chan_sip allows chan_sip
	to report to a device that the number that has been dialed
	is incomplete and more digits are required. If this
	functionality is used with a device that has performed
	username/password authentication RTP resources are leaked.
	This occurs because the code fails to release the old RTP
	resources before allocating new ones in this scenario.
	If all resources are used then RTP port exhaustion will
	occur and no RTP sessions are able to be set up.</p>
	<p>If overlap dialing support is not needed the "allowoverlap"
	option can be set to no. This will stop any usage of the
	scenario which causes the resource exhaustion.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-007.html</url>
	</references>
	<dates>
	<discovery>2016-08-05</discovery>
	<entry>2016-09-08</entry>
	</dates>
	</vuln>

	<vuln vid="7fda7920-7603-11e6-b362-001999f8d30b">
	<topic>asterisk -- Crash on ACK from unknown endpoint</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><ge>13.10.0</ge><lt>13.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>Asterisk can be crashed remotely by sending an ACK to
	it from an endpoint username that Asterisk does not
	recognize. Most SIP request types result in an "artificial"
	endpoint being looked up, but ACKs bypass this lookup.
	The resulting NULL pointer results in a crash when
	attempting to determine if ACLs should be applied.</p>
	<p>This issue was introduced in the Asterisk 13.10 release
	and only affects that release.</p>
	<p>This issue only affects users using the PJSIP stack
	with Asterisk. Those users that use chan_sip are
	unaffected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-006.html</url>
	</references>
	<dates>
	<discovery>2016-08-03</discovery>
	<entry>2016-09-08</entry>
	</dates>
	</vuln>

	<vuln vid="70c85c93-743c-11e6-a590-14dae9d210b8">
	<topic>inspircd -- authentication bypass vulnerability</topic>
	<affects>
	<package>
	<name>inspircd</name>
	<range><lt>2.0.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam reports:</p>
	<blockquote cite="http://www.inspircd.org/2016/09/03/v2023-released.html">
	<p>A serious vulnerability exists in when using m_sasl in
	combination with any services that support SASL EXTERNAL.
	To be vulnerable you must have m_sasl loaded, and have services which
	support SASL EXTERNAL authentication.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.inspircd.org/2016/09/03/v2023-released.html</url>
	</references>
	<dates>
	<discovery>2016-09-03</discovery>
	<entry>2016-09-06</entry>
	</dates>
	</vuln>

	<vuln vid="9e50dcc3-740b-11e6-94a2-080027ef73ec">
	<topic>mailman -- CSRF hardening in parts of the web interface</topic>
	<affects>
	<package>
	<name>mailman</name>
	<range><lt>2.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The late Tokio Kikuchi reported:</p>
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/775294">
	<p>We may have to set lifetime for input forms because of recent
	activities on cross-site request forgery (CSRF). The form lifetime
	is successfully deployed in frameworks like web.py or plone etc.
	Proposed branch lp:~tkikuchi/mailman/form-lifetime implement
	lifetime in admin, admindb, options and edithtml interfaces.
	[...]</p>
	</blockquote>
	<blockquote cite="https://launchpad.net/mailman/2.1/2.1.15">
	<p>The web admin interface has been hardened against CSRF attacks by
	adding a hidden, encrypted token with a time stamp to form submissions
	and not accepting authentication by cookie if the token is missing,
	invalid or older than the new mm_cfg.py setting FORM_LIFETIME which
	defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.launchpad.net/mailman/+bug/775294</url>
	<url>https://launchpad.net/mailman/2.1/2.1.15</url>
	<cvename>CVE-2016-7123</cvename>
	</references>
	<dates>
	<discovery>2011-05-02</discovery>
	<entry>2016-09-06</entry>
	</dates>
	</vuln>

	<vuln vid="adccefd1-7080-11e6-a2cb-c80aa9043978">
	<topic>openssh -- sshd -- remote valid user discovery and PAM /bin/login attack</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><lt>7.3.p1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSH project reports:</p>
	<blockquote cite="http://www.openssh.com/txt/release-7.3">
	<p>* sshd(8): Mitigate timing differences in password authentication
	that could be used to discern valid from invalid account names
	when long passwords were sent and particular password hashing
	algorithms are in use on the server. CVE-2016-6210, reported by
	EddieEzra.Harari at verint.com
	</p>
	<p> * sshd(8): (portable only) Ignore PAM environment vars when
	UseLogin=yes. If PAM is configured to read user-specified
	environment variables and UseLogin=yes in sshd_config, then a
	hostile local user may attack /bin/login via LD_PRELOAD or
	similar environment variables set via PAM. CVE-2015-8325,
	found by Shayan Sadigh.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openssh.com/txt/release-7.3</url>
	<cvename>CVE-2016-6210</cvename>
	<cvename>CVE-2015-8325</cvename>
	</references>
	<dates>
	<discovery>2016-08-01</discovery>
	<entry>2016-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec">
	<topic>mailman -- CSRF protection enhancements</topic>
	<affects>
	<package>
	<name>mailman</name>
	<range><lt>2.1.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Sapiro reports:</p>
	<blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668">
	<p>CSRF protection has been extended to the user options page. This
	was actually fixed by Tokio Kikuchi as part of the fix for LP:
	#775294 and intended for Mailman 2.1.15, but that fix wasn't
	completely merged at the time. The full fix also addresses the
	admindb, and edithtml pages as well as the user options page and the
	previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url>
	<url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url>
	<cvename>CVE-2016-6893</cvename>
	</references>
	<dates>
	<discovery>2016-08-19</discovery>
	<entry>2016-08-29</entry>
	</dates>
	</vuln>

	<vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6">
	<topic>libxml2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.9.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel Veillard reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/xml/2016-May/msg00023.html">
	<p>More format string warnings with possible format string
	vulnerability (David Kilzer)</p>
	<p>Avoid building recursive entities (Daniel Veillard)</p>
	<p>Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)</p>
	<p>Heap-based buffer-underreads due to xmlParseName (David Kilzer)</p>
	<p>Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)</p>
	<p>Heap use-after-free in htmlParsePubidLiteral and
	htmlParseSystemiteral (Pranjal Jumde)</p>
	<p>Fix some format string warnings with possible format string
	vulnerability (David Kilzer)</p>
	<p>Detect change of encoding when parsing HTML names (Hugh Davenport)</p>
	<p>Fix inappropriate fetch of entities content (Daniel Veillard)</p>
	<p>Bug 759398: Heap use-after-free in xmlDictComputeFastKey
	(Pranjal Jumde)</p>
	<p>Bug 758605: Heap-based buffer overread in xmlDictAddString
	(Pranjal Jumde)</p>
	<p>Bug 758588: Heap-based buffer overread in
	xmlParserPrintFileContextInternal (David Kilzer)</p>
	<p>Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
	(Pranjal Jumde)</p>
	<p>Add missing increments of recursion depth counter to XML parser.
	(Peter Simons)</p>
	<p>Fix NULL pointer deref in XPointer range-to</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/xml/2016-May/msg00023.html</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=759398</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=758605</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=758588</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=757711</url>
	<url>https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb</url>
	<cvename>CVE-2016-1762</cvename>
	<cvename>CVE-2016-1833</cvename>
	<cvename>CVE-2016-1834</cvename>
	<cvename>CVE-2016-1835</cvename>
	<cvename>CVE-2016-1836</cvename>
	<cvename>CVE-2016-1837</cvename>
	<cvename>CVE-2016-1838</cvename>
	<cvename>CVE-2016-1839</cvename>
	<cvename>CVE-2016-1840</cvename>
	<cvename>CVE-2016-3627</cvename>
	<cvename>CVE-2016-3705</cvename>
	<cvename>CVE-2016-4449</cvename>
	<cvename>CVE-2016-4483</cvename>
	</references>
	<dates>
	<discovery>2016-05-23</discovery>
	<entry>2016-08-28</entry>
	</dates>
	</vuln>

	<vuln vid="4472ab39-6c66-11e6-9ca5-50e549ebab6c">
	<topic>kdelibs -- directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>kdelibs</name>
	<range><lt>4.14.10_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Faure reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20160724-1.txt">
	<p>A maliciously crafted archive (.zip or .tar.bz2) with "../" in the
	file paths could be offered for download via the KNewStuff
	framework (e.g. on www.kde-look.org), and upon extraction would
	install files anywhere in the user's home directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6232</cvename>
	<url>https://www.kde.org/info/security/advisory-20160724-1.txt</url>
	</references>
	<dates>
	<discovery>2016-07-24</discovery>
	<entry>2016-08-27</entry>
	</dates>
	</vuln>

	<vuln vid="f5035ead-688b-11e6-8b1d-c86000169601">
	<topic>eog -- out-of-bounds write</topic>
	<affects>
	<package>
	<name>eog</name>
	<range><lt>3.18.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Felix Riemann reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html">
	<p>CVE-2016-6855 out-of-bounds write in eog 3.10.2.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html</url>
	<cvename>CVE-2016-6855</cvename>
	</references>
	<dates>
	<discovery>2016-08-21</discovery>
	<entry>2016-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="44989c29-67d1-11e6-8b1d-c86000169601">
	<topic>fontconfig -- insufficiently cache file validation</topic>
	<affects>
	<package>
	<name>fontconfig</name>
	<range><lt>1.12.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian security team reports:</p>
	<blockquote cite="https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html">
	<p>Tobias Stoeckmann discovered that cache files are insufficiently
	validated in fontconfig, a generic font configuration library. An
	attacker can trigger arbitrary free() calls, which in turn allows
	double free attacks and therefore arbitrary code execution. In
	combination with setuid binaries using crafted cache files, this
	could allow privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html</url>
	<cvename>CVE-2016-5384</cvename>
	</references>
	<dates>
	<discovery>2016-08-05</discovery>
	<entry>2016-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="7fe7df75-6568-11e6-a590-14dae9d210b8">
	<topic>End of Life Ports</topic>
	<affects>
	<package>
	<name>python32</name>
	<name>python31</name>
	<name>python30</name>
	<name>python26</name>
	<name>python25</name>
	<name>python24</name>
	<name>python23</name>
	<name>python22</name>
	<name>python21</name>
	<name>python20</name>
	<name>python15</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>php54</name>
	<name>php53</name>
	<name>php52</name>
	<name>php5</name>
	<name>php4</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>perl5</name>
	<range><lt>5.18</lt></range>
	</package>
	<package>
	<name>perl5.16</name>
	<name>perl5.14</name>
	<name>perl5.12</name>
	<name>perl</name> <!-- Perl 5.10 and earlier were called "perl" -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><lt>2.1,1</lt></range>
	</package>
	<package>
	<name>unifi2</name>
	<name>unifi3</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>apache21</name>
	<name>apache20</name>
	<name>apache13</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>tomcat55</name>
	<name>tomcat41</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>mysql51-client</name>
	<name>mysql51-server</name>
	<name>mysql50-client</name>
	<name>mysql50-server</name>
	<name>mysql41-client</name>
	<name>mysql41-server</name>
	<name>mysql40-client</name>
	<name>mysql40-server</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>postgresql90-client</name>
	<name>postgresql90-server</name>
	<name>postgresql84-client</name>
	<name>postgresql84-server</name>
	<name>postgresql83-client</name>
	<name>postgresql83-server</name>
	<name>postgresql82-client</name>
	<name>postgresql82-server</name>
	<name>postgresql81-client</name>
	<name>postgresql81-server</name>
	<name>postgresql80-client</name>
	<name>postgresql80-server</name>
	<name>postgresql74-client</name>
	<name>postgresql74-server</name>
	<name>postgresql73-client</name>
	<name>postgresql73-server</name>
	<name>postgresql72-client</name>
	<name>postgresql72-server</name>
	<name>postgresql71-client</name>
	<name>postgresql71-server</name>
	<name>postgresql7-client</name>
	<name>postgresql7-server</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>These packages have reached End of Life status and/or have
	been removed from the Ports Tree. They may contain undocumented
	security issues. Please take caution and find alternative
	software as soon as possible.</p>
	</body>
	</description>
	<references>
	<freebsdpr>ports/211975</freebsdpr>
	</references>
	<dates>
	<discovery>2016-08-18</discovery>
	<entry>2016-08-18</entry>
	<modified>2016-10-18</modified>
	</dates>
	</vuln>

	<vuln vid="e1c71d8d-64d9-11e6-b38a-25a46b33f2ed">
	<topic>gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output</topic>
	<affects>
	<package>
	<name>gnupg1</name>
	<range><lt>1.4.21</lt></range>
	</package>
	<package>
	<name>libgcrypt</name>
	<range><lt>1.7.3</lt></range>
	</package>
	<package>
	<name>linux-c6-libgcrypt</name>
	<range><lt>1.4.5_4</lt></range>
	</package>
	<package>
	<name>linux-c7-libgcrypt</name>
	<range><lt>1.5.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html">
	<p>There was a bug in the mixing functions of Libgcrypt's random
	number generator: An attacker who obtains 4640 bits from the RNG can
	trivially predict the next 160 bits of output. This bug exists since
	1998 in all GnuPG and Libgcrypt versions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html</url>
	<cvename>CVE-2016-6313</cvename>
	</references>
	<dates>
	<discovery>2016-08-17</discovery>
	<entry>2016-08-18</entry>
	<modified>2016-11-30</modified>
	</dates>
	</vuln>

	<vuln vid="ef70b201-645d-11e6-9cdc-6805ca0b3d42">
	<topic>phpmyadmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.6.0</ge><lt>4.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpmyadmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-29/">
	<p>Weakness with cookie encryption</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-30/">
	<p>Multiple XSS vulnerabilities</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-31/">
	<p>Multiple XSS vulnerabilities</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-32/">
	<p>PHP code injection</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-33/">
	<p>Full path disclosure</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-34/">
	<p>SQL injection attack</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-35/">
	<p>Local file exposure</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-36/">
	<p>Local file exposure through symlinks with
	UploadDir</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-37/">
	<p>Path traversal with SaveDir and UploadDir</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-38/">
	<p>Multiple XSS vulnerabilities</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-39/">
	<p>SQL injection attack</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-40/">
	<p>SQL injection attack</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-41/">
	<p>Denial of service (DOS) attack in transformation
	feature</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-42/">
	<p>SQL injection attack as control user</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-43/">
	<p>Unvalidated data passed to unserialize()</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-45/">
	<p>DOS attack with forced persistent connections</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-46/">
	<p>Denial of service (DOS) attack by for loops</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-47/">
	<p>IPv6 and proxy server IP-based authentication rule
	circumvention</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-48/">
	<p>Detect if user is logged in</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-49/">
	<p>Bypass URL redirect protection</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-50/">
	<p>Referrer leak in url.php</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-51/">
	<p>Reflected File Download attack</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-52/">
	<p>ArbitraryServerRegexp bypass</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-53/">
	<p>Denial of service (DOS) attack by changing password to a
	very long string</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-54/">
	<p>Remote code execution vulnerability when run as CGI</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-55/">
	<h3>Summary</h3>
	<p>Denial of service (DOS) attack with dbase extension</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-56/">
	<p>Remote code execution vulnerability when PHP is running
	with dbase extension</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-29/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-30/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-31/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-32/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-33/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-34/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-35/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-36/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-37/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-38/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-39/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-40/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-41/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-42/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-43/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-45/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-46/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-47/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-48/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-49/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-50/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-51/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-52/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-53/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-54/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-55/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-56/</url>
	<cvename>CVE-2016-6606</cvename>
	<cvename>CVE-2016-6607</cvename>
	<cvename>CVE-2016-6608</cvename>
	<cvename>CVE-2016-6609</cvename>
	<cvename>CVE-2016-6610</cvename>
	<cvename>CVE-2016-6611</cvename>
	<cvename>CVE-2016-6612</cvename>
	<cvename>CVE-2016-6613</cvename>
	<cvename>CVE-2016-6614</cvename>
	<cvename>CVE-2016-6615</cvename>
	<cvename>CVE-2016-6616</cvename>
	<cvename>CVE-2016-6617</cvename>
	<cvename>CVE-2016-6618</cvename>
	<cvename>CVE-2016-6619</cvename>
	<cvename>CVE-2016-6620</cvename>
	<cvename>CVE-2016-6622</cvename>
	<cvename>CVE-2016-6623</cvename>
	<cvename>CVE-2016-6624</cvename>
	<cvename>CVE-2016-6625</cvename>
	<cvename>CVE-2016-6626</cvename>
	<cvename>CVE-2016-6627</cvename>
	<cvename>CVE-2016-6628</cvename>
	<cvename>CVE-2016-6629</cvename>
	<cvename>CVE-2016-6630</cvename>
	<cvename>CVE-2016-6631</cvename>
	<cvename>CVE-2016-6632</cvename>
	<cvename>CVE-2016-6633</cvename>
	</references>
	<dates>
	<discovery>2016-08-17</discovery>
	<entry>2016-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="f7dd2d09-625e-11e6-828b-fcaa14edc6a6">
	<topic>TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution</topic>
	<affects>
	<package>
	<name>teamspeak3-server</name>
	<range><le>3.0.13_1,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanz Jenson audit report:</p>
	<blockquote cite="http://seclists.org/fulldisclosure/2016/Aug/61">
	<p>I found 10 vulnerabilities. Some of these are critical and allow remote code
	execution. For the average user, that means that these vulnerabilities can be
	exploited by a malicious attacker in order to take over any Teamspeak server,
	not only becoming serveradmin, but getting a shell on the affected machine.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/fulldisclosure/2016/Aug/61</url>
	</references>
	<dates>
	<discovery>2016-08-12</discovery>
	<entry>2016-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="df502a2f-61f6-11e6-a461-643150d3111d">
	<topic>puppet-agent MCollective plugin -- Remote Code Execution vulnerability</topic>
	<affects>
	<package>
	<name>mcollective-puppet-agent</name>
	<range><lt>1.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Puppet reports:</p>
	<blockquote cite="https://puppet.com/security/cve/cve-2015-7331">
	<p>Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://puppet.com/security/cve/cve-2015-7331</url>
	<cvename>CVE-2015-7331</cvename>
	</references>
	<dates>
	<discovery>2016-08-09</discovery>
	<entry>2016-08-15</entry>
	</dates>
	</vuln>

	<vuln vid="7d4f4955-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Heap vulnerability in bspatch</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_6</lt></range>
	<range><ge>10.2</ge><lt>10.2_20</lt></range>
	<range><ge>10.1</ge><lt>10.1_37</lt></range>
	<range><ge>9.3</ge><lt>9.3_45</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The implementation of bspatch does not check for a
	negative value on numbers of bytes read from the diff and
	extra streams, allowing an attacker who can control the
	patch file to write at arbitrary locations in the heap.</p>
	<p>This issue was first discovered by The Chromium Project
	and reported independently by Lu Tung-Pin to the FreeBSD
	project.</p>
	<h1>Impact:</h1>
	<p>An attacker who can control the patch file can cause a
	crash or run arbitrary code under the credentials of the
	user who runs bspatch, in many cases, root.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9862</cvename>
	<freebsdsa>SA-16:25.bspatch</freebsdsa>
	</references>
	<dates>
	<discovery>2016-07-25</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7cfcea05-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Multiple ntp vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_5</lt></range>
	<range><ge>10.2</ge><lt>10.2_19</lt></range>
	<range><ge>10.1</ge><lt>10.1_36</lt></range>
	<range><ge>9.3</ge><lt>9.3_44</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Multiple vulnerabilities have been discovered in the NTP
	suite:</p>
	<p>The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that
	could cause ntpd to crash. [CVE-2016-4957, Reported by
	Nicolas Edet of Cisco]</p>
	<p>An attacker who knows the origin timestamp and can send
	a spoofed packet containing a CRYPTO-NAK to an ephemeral
	peer target before any other response is sent can demobilize
	that association. [CVE-2016-4953, Reported by Miroslav
	Lichvar of Red Hat]</p>
	<p>An attacker who is able to spoof packets with correct
	origin timestamps from enough servers before the expected
	response packets arrive at the target machine can affect
	some peer variables and, for example, cause a false leap
	indication to be set. [CVE-2016-4954, Reported by Jakub
	Prokes of Red Hat]</p>
	<p>An attacker who is able to spoof a packet with a correct
	origin timestamp before the expected response packet arrives
	at the target machine can send a CRYPTO_NAK or a bad MAC
	and cause the association's peer variables to be cleared.
	If this can be done often enough, it will prevent that
	association from working. [CVE-2016-4955, Reported by
	Miroslav Lichvar of Red Hat]</p>
	<p>The fix for NtpBug2978 does not cover broadcast associations,
	so broadcast clients can be triggered to flip into interleave
	mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red
	Hat.]</p>
	<h1>Impact:</h1>
	<p>Malicious remote attackers may be able to break time
	synchronization, or cause the ntpd(8) daemon to crash.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4953</cvename>
	<cvename>CVE-2016-4954</cvename>
	<cvename>CVE-2016-4955</cvename>
	<cvename>CVE-2016-4956</cvename>
	<cvename>CVE-2016-4957</cvename>
	<freebsdsa>SA-16:24.ntp</freebsdsa>
	</references>
	<dates>
	<discovery>2016-06-04</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7cad4795-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_4</lt></range>
	<range><ge>10.2</ge><lt>10.2_18</lt></range>
	<range><ge>10.1</ge><lt>10.1_35</lt></range>
	<range><ge>9.3</ge><lt>9.3_43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The implementation of historic stat(2) system call does
	not clear the output struct before copying it out to
	userland.</p>
	<h1>Impact:</h1>
	<p>An unprivileged user can read a portion of uninitialised
	kernel stack data, which may contain sensitive information,
	such as the stack guard, portions of the file cache or
	terminal buffers, which an attacker might leverage to obtain
	elevated privileges.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:21.43bsd</freebsdsa>
	</references>
	<dates>
	<discovery>2016-05-31</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7c5d64dd-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Kernel stack disclosure in Linux compatibility layer</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_4</lt></range>
	<range><ge>10.2</ge><lt>10.2_18</lt></range>
	<range><ge>10.1</ge><lt>10.1_35</lt></range>
	<range><ge>9.3</ge><lt>9.3_43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The implementation of the TIOCGSERIAL ioctl(2) does not
	clear the output struct before copying it out to userland.</p>
	<p>The implementation of the Linux sysinfo() system call
	does not clear the output struct before copying it out to
	userland.</p>
	<h1>Impact:</h1>
	<p>An unprivileged user can read a portion of uninitialised
	kernel stack data, which may contain sensitive information,
	such as the stack guard, portions of the file cache or
	terminal buffers, which an attacker might leverage to obtain
	elevated privileges.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:20.linux</freebsdsa>
	</references>
	<dates>
	<discovery>2016-05-31</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7c0bac69-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Incorrect argument handling in sendmsg(2)</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_3</lt></range>
	<range><ge>10.2</ge><lt>10.2_17</lt></range>
	<range><ge>10.1</ge><lt>10.1_34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Incorrect argument handling in the socket code allows
	malicious local user to overwrite large portion of the
	kernel memory.</p>
	<h1>Impact:</h1>
	<p>Malicious local user may crash kernel or execute arbitrary
	code in the kernel, potentially gaining superuser privileges.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1887</cvename>
	<freebsdsa>SA-16:19.sendmsg</freebsdsa>
	</references>
	<dates>
	<discovery>2016-05-17</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7bbc0e8c-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Buffer overflow in keyboard driver</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_3</lt></range>
	<range><ge>10.2</ge><lt>10.2_17</lt></range>
	<range><ge>10.1</ge><lt>10.1_34</lt></range>
	<range><ge>9.3</ge><lt>9.3_42</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Incorrect signedness comparison in the ioctl(2) handler
	allows a malicious local user to overwrite a portion of the
	kernel memory.</p>
	<h1>Impact:</h1>
	<p>A local user may crash the kernel, read a portion of
	kernel memory and execute arbitrary code in kernel context.
	The result of executing an arbitrary kernel code is privilege
	escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1886</cvename>
	<freebsdsa>SA-16:18.atkbd</freebsdsa>
	</references>
	<dates>
	<discovery>2016-05-17</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7b6a11b5-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Incorrect argument validation in sysarch(2)</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.0</ge><lt>11.0_2</lt></range>
	<range><ge>10.3</ge><lt>10.3_11</lt></range>
	<range><ge>10.2</ge><lt>10.2_24</lt></range>
	<range><ge>10.1</ge><lt>10.1_41</lt></range>
	<range><ge>9.3</ge><lt>9.3_49</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A special combination of sysarch(2) arguments, specify
	a request to uninstall a set of descriptors from the LDT.
	The start descriptor is cleared and the number of descriptors
	are provided. Due to lack of sufficient bounds checking
	during argument validity verification, unbound zero'ing of
	the process LDT and adjacent memory can be initiated from
	usermode.</p>
	<h1>Impact:</h1>
	<p>This vulnerability could cause the kernel to panic. In
	addition it is possible to perform a local Denial of Service
	against the system by unprivileged processes.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1885</cvename>
	<freebsdsa>SA-16:15.sysarch</freebsdsa>
	</references>
	<dates>
	<discovery>2016-03-16</discovery>
	<entry>2016-08-11</entry>
	<modified>2016-10-25</modified>
	</dates>
	</vuln>

	<vuln vid="7b1a4a27-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Multiple OpenSSL vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_13</lt></range>
	<range><ge>10.1</ge><lt>10.1_30</lt></range>
	<range><ge>9.3</ge><lt>9.3_38</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A cross-protocol attack was discovered that could lead
	to decryption of TLS sessions by using a server supporting
	SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA
	padding oracle. Note that traffic between clients and
	non-vulnerable servers can be decrypted provided another
	server supporting SSLv2 and EXPORT ciphers (even with a
	different protocol such as SMTP, IMAP or POP3) shares the
	RSA keys of the non-vulnerable server. This vulnerability
	is known as DROWN. [CVE-2016-0800]</p>
	<p>A double free bug was discovered when OpenSSL parses
	malformed DSA private keys and could lead to a DoS attack
	or memory corruption for applications that receive DSA
	private keys from untrusted sources. This scenario is
	considered rare. [CVE-2016-0705]</p>
	<p>The SRP user database lookup method SRP_VBASE_get_by_user
	had confusing memory management semantics; the returned
	pointer was sometimes newly allocated, and sometimes owned
	by the callee. The calling code has no way of distinguishing
	these two cases. [CVE-2016-0798]</p>
	<p>In the BN_hex2bn function, the number of hex digits is
	calculated using an int value \|i\|. Later \|bn_expand\| is
	called with a value of \|i * 4\|. For large values of \|i\|
	this can result in \|bn_expand\| not allocating any memory
	because \|i * 4\| is negative. This can leave the internal
	BIGNUM data field as NULL leading to a subsequent NULL
	pointer dereference. For very large values of \|i\|, the
	calculation \|i * 4\| could be a positive value smaller than
	\|i\|. In this case memory is allocated to the internal BIGNUM
	data field, but it is insufficiently sized leading to heap
	corruption. A similar issue exists in BN_dec2bn. This could
	have security consequences if BN_hex2bn/BN_dec2bn is ever
	called by user applications with very large untrusted hex/dec
	data. This is anticipated to be a rare occurrence.
	[CVE-2016-0797]</p>
	<p>The internal \|fmtstr\| function used in processing a "%s"
	formatted string in the BIO_*printf functions could overflow
	while calculating the length of a string and cause an
	out-of-bounds read when printing very long strings.
	[CVE-2016-0799]</p>
	<p>A side-channel attack was found which makes use of
	cache-bank conflicts on the Intel Sandy-Bridge microarchitecture
	which could lead to the recovery of RSA keys. [CVE-2016-0702]</p>
	<p>s2_srvr.c did not enforce that clear-key-length is 0 for
	non-export ciphers. If clear-key bytes are present for these
	ciphers, they displace encrypted-key bytes. [CVE-2016-0703]</p>
	<p>s2_srvr.c overwrites the wrong bytes in the master key
	when applying Bleichenbacher protection for export cipher
	suites. [CVE-2016-0704]</p>
	<h1>Impact:</h1>
	<p>Servers that have SSLv2 protocol enabled are vulnerable
	to the "DROWN" attack which allows a remote attacker to
	fast attack many recorded TLS connections made to the server,
	even when the client did not make any SSLv2 connections
	themselves.</p>
	<p>An attacker who can supply malformed DSA private keys
	to OpenSSL applications may be able to cause memory corruption
	which would lead to a Denial of Service condition.
	[CVE-2016-0705]</p>
	<p>An attacker connecting with an invalid username can cause
	memory leak, which could eventually lead to a Denial of
	Service condition. [CVE-2016-0798]</p>
	<p>An attacker who can inject malformed data into an
	application may be able to cause memory corruption which
	would lead to a Denial of Service condition. [CVE-2016-0797,
	CVE-2016-0799]</p>
	<p>A local attacker who has control of code in a thread
	running on the same hyper-threaded core as the victim thread
	which is performing decryptions could recover RSA keys.
	[CVE-2016-0702]</p>
	<p>An eavesdropper who can intercept SSLv2 handshake can
	conduct an efficient divide-and-conquer key recovery attack
	and use the server as an oracle to determine the SSLv2
	master-key, using only 16 connections to the server and
	negligible computation. [CVE-2016-0703]</p>
	<p>An attacker can use the Bleichenbacher oracle, which
	enables more efficient variant of the DROWN attack.
	[CVE-2016-0704]</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0702</cvename>
	<cvename>CVE-2016-0703</cvename>
	<cvename>CVE-2016-0704</cvename>
	<cvename>CVE-2016-0705</cvename>
	<cvename>CVE-2016-0797</cvename>
	<cvename>CVE-2016-0798</cvename>
	<cvename>CVE-2016-0799</cvename>
	<cvename>CVE-2016-0800</cvename>
	<freebsdsa>SA-16:12.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2016-03-10</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7ac28df1-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Linux compatibility layer issetugid(2) system call</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_11</lt></range>
	<range><ge>10.1</ge><lt>10.1_28</lt></range>
	<range><ge>9.3</ge><lt>9.3_35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A programming error in the Linux compatibility layer
	could cause the issetugid(2) system call to return incorrect
	information.</p>
	<h1>Impact:</h1>
	<p>If an application relies on output of the issetugid(2)
	system call and that information is incorrect, this could
	lead to a privilege escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1883</cvename>
	<freebsdsa>SA-16:10.linux</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-27</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7a31dfba-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Insecure default snmpd.config permissions</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The SNMP protocol supports an authentication model called
	USM, which relies on a shared secret. The default permission
	of the snmpd configuration file, /etc/snmpd.config, is
	weak and does not provide adequate protection against local
	unprivileged users.</p>
	<h1>Impact:</h1>
	<p>A local user may be able to read the shared secret, if
	configured and used by the system administrator.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5677</cvename>
	<freebsdsa>SA-16:06.bsnmpd</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="79dfc135-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- TCP MD5 signature denial of service</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A programming error in processing a TCP connection with
	both TCP_MD5SIG and TCP_NOOPT socket options may lead to
	kernel crash.</p>
	<h1>Impact:</h1>
	<p>A local attacker can crash the kernel, resulting in a
	denial-of-service.</p>
	<p>A remote attack is theoretically possible, if server has
	a listening socket with TCP_NOOPT set, and server is either
	out of SYN cache entries, or SYN cache is disabled by
	configuration.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1882</cvename>
	<freebsdsa>SA-16:05.tcp</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="798f63e0-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Linux compatibility layer setgroups(2) system call</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A programming error in the Linux compatibility layer
	setgroups(2) system call can lead to an unexpected results,
	such as overwriting random kernel memory contents.</p>
	<h1>Impact:</h1>
	<p>It is possible for a local attacker to overwrite portions
	of kernel memory, which may result in a privilege escalation
	or cause a system panic.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1881</cvename>
	<freebsdsa>SA-16:04.linux</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="793fb19c-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Linux compatibility layer incorrect futex handling</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A programming error in the handling of Linux futex robust
	lists may result in incorrect memory locations being
	accessed.</p>
	<h1>Impact:</h1>
	<p>It is possible for a local attacker to read portions of
	kernel memory, which may result in a privilege escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1880</cvename>
	<freebsdsa>SA-16:03.linux</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="78f06a6c-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- SCTP ICMPv6 error message vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A lack of proper input checks in the ICMPv6 processing
	in the SCTP stack can lead to either a failed kernel assertion
	or to a NULL pointer dereference. In either case, a kernel
	panic will follow.</p>
	<h1>Impact:</h1>
	<p>A remote, unauthenticated attacker can reliably trigger
	a kernel panic in a vulnerable system running IPv6. Any
	kernel compiled with both IPv6 and SCTP support is vulnerable.
	There is no requirement to have an SCTP socket open.</p>
	<p>IPv4 ICMP processing is not impacted by this vulnerability.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1879</cvename>
	<freebsdsa>SA-16:01.sctp</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0e5d6969-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- rpcbind(8) remote denial of service [REVISED]</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_5</lt></range>
	<range><ge>10.1</ge><lt>10.1_22</lt></range>
	<range><ge>9.3</ge><lt>9.3_28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>In rpcbind(8), netbuf structures are copied directly,
	which would result in two netbuf structures that reference
	to one shared address buffer. When one of the two netbuf
	structures is freed, access to the other netbuf structure
	would result in an undefined result that may crash the
	rpcbind(8) daemon.</p>
	<h1>Impact:</h1>
	<p>A remote attacker who can send specifically crafted
	packets to the rpcbind(8) daemon can cause it to crash,
	resulting in a denial of service condition.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7236</cvename>
	<freebsdsa>SA-15:24.rpcbind</freebsdsa>
	</references>
	<dates>
	<discovery>2015-09-29</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0dfa5dde-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Local privilege escalation in IRET handler</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_19</lt></range>
	<range><ge>9.3</ge><lt>9.3_24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>If the kernel-mode IRET instruction generates an #SS or
	#NP exception, but the exception handler does not properly
	ensure that the right GS register base for kernel is reloaded,
	the userland GS segment may be used in the context of the
	kernel exception handler.</p>
	<h1>Impact:</h1>
	<p>By causing an IRET with #SS or #NP exceptions, a local
	attacker can cause the kernel to use an arbitrary GS base,
	which may allow escalated privileges or panic the system.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5675</cvename>
	<freebsdsa>SA-15:21.amd64</freebsdsa>
	</references>
	<dates>
	<discovery>2015-08-25</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0da8a68e-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_18</lt></range>
	<range><ge>10.2</ge><lt>10.2_1</lt></range>
	<range><ge>9.3</ge><lt>9.3_23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Multiple integer overflows have been discovered in the
	XML_GetBuffer() function in the expat library.</p>
	<h1>Impact:</h1>
	<p>The integer overflows may be exploited by using specifically
	crafted XML data and lead to infinite loop, or a heap buffer
	overflow, which results in a Denial of Service condition,
	or enables remote attackers to execute arbitrary code.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1283</cvename>
	<freebsdsa>SA-15:20.expat</freebsdsa>
	</references>
	<dates>
	<discovery>2015-08-18</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0d584493-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_17</lt></range>
	<range><ge>9.3</ge><lt>9.3_22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The input path in routed(8) will accept queries from any
	source and attempt to answer them. However, the output path
	assumes that the destination address for the response is
	on a directly connected network.</p>
	<h1>Impact:</h1>
	<p>Upon receipt of a query from a source which is not on a
	directly connected network, routed(8) will trigger an
	assertion and terminate. The affected system's routing table
	will no longer be updated. If the affected system is a
	router, its routes will eventually expire from other routers'
	routing tables, and its networks will no longer be reachable
	unless they are also connected to another router.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5674</cvename>
	<freebsdsa>SA-15:19.routed</freebsdsa>
	</references>
	<dates>
	<discovery>2015-08-05</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0d090952-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to insufficient sanitization of the input patch
	stream, it is possible for a patch file to cause patch(1)
	to pass certain ed(1) scripts to the ed(1) editor, which
	would run commands.</p>
	<h1>Impact:</h1>
	<p>This issue could be exploited to execute arbitrary
	commands as the user invoking patch(1) against a specially
	crafted patch file, which could be leveraged to obtain
	elevated privileges.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1418</cvename>
	<freebsdsa>SA-15:18.bsdpatch</freebsdsa>
	</references>
	<dates>
	<discovery>2015-08-05</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0cb9d5bb-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_21</lt></range>
	<range><ge>8.4</ge><lt>8.4_35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>There is a mistake with the introduction of VNET, which
	converted the global limit on the number of segments that
	could belong to reassembly queues into a per-VNET limit.
	Because mbufs are allocated from a global pool, in the
	presence of a sufficient number of VNETs, the total number
	of mbufs attached to reassembly queues can grow to the total
	number of mbufs in the system, at which point all network
	traffic would cease.</p>
	<h1>Impact:</h1>
	<p>An attacker who can establish concurrent TCP connections
	across a sufficient number of VNETs and manipulate the
	inbound packet streams such that the maximum number of mbufs
	are enqueued on each reassembly queue can cause mbuf cluster
	exhaustion on the target system, resulting in a Denial of
	Service condition.</p>
	<p>As the default per-VNET limit on the number of segments
	that can belong to reassembly queues is 1/16 of the total
	number of mbuf clusters in the system, only systems that
	have 16 or more VNET instances are vulnerable.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1417</cvename>
	<freebsdsa>SA-15:15.tcp</freebsdsa>
	</references>
	<dates>
	<discovery>2015-07-28</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0c6759dd-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to insufficient sanitization of the input patch
	stream, it is possible for a patch file to cause patch(1)
	to run commands in addition to the desired SCCS or RCS
	commands.</p>
	<h1>Impact:</h1>
	<p>This issue could be exploited to execute arbitrary
	commands as the user invoking patch(1) against a specially
	crafted patch file, which could be leveraged to obtain
	elevated privileges.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1416</cvename>
	<freebsdsa>SA-15:14.bsdpatch</freebsdsa>
	</references>
	<dates>
	<discovery>2015-07-28</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0c064c43-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_15</lt></range>
	<range><ge>9.3</ge><lt>9.3_20</lt></range>
	<range><ge>8.4</ge><lt>8.4_34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>TCP connections transitioning to the LAST_ACK state can
	become permanently stuck due to mishandling of protocol
	state in certain situations, which in turn can lead to
	accumulated consumption and eventual exhaustion of system
	resources, such as mbufs and sockets.</p>
	<h1>Impact:</h1>
	<p>An attacker who can repeatedly establish TCP connections
	to a victim system (for instance, a Web server) could create
	many TCP connections that are stuck in LAST_ACK state and
	cause resource exhaustion, resulting in a denial of service
	condition. This may also happen in normal operation where
	no intentional attack is conducted, but an attacker who can
	send specifically crafted packets can trigger this more
	reliably.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5358</cvename>
	<freebsdsa>SA-15:13.tcp</freebsdsa>
	</references>
	<dates>
	<discovery>2015-07-21</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0bb55a18-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Denial of Service with IPv6 Router Advertisements</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_13</lt></range>
	<range><ge>8.4</ge><lt>8.4_27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The Neighbor Discover Protocol allows a local router to
	advertise a suggested Current Hop Limit value of a link,
	which will replace Current Hop Limit on an interface connected
	to the link on the FreeBSD system.</p>
	<h1>Impact:</h1>
	<p>When the Current Hop Limit (similar to IPv4's TTL) is
	small, IPv6 packets may get dropped before they reached
	their destinations.</p>
	<p>By sending specifically crafted Router Advertisement
	packets, an attacker on the local network can cause the
	FreeBSD system to lose the ability to communicate with
	another IPv6 node on a different network.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2923</cvename>
	<freebsdsa>SA-15:09.ipv6</freebsdsa>
	</references>
	<dates>
	<discovery>2015-04-07</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0b65f297-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Insecure default GELI keyfile permissions</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The default permission set by bsdinstall(8) installer
	when configuring full disk encrypted ZFS is too open.</p>
	<h1>Impact:</h1>
	<p>A local attacker may be able to get a copy of the geli(8)
	provider's keyfile which is located at a fixed location.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1415</cvename>
	<freebsdsa>SA-15:08.bsdinstall</freebsdsa>
	</references>
	<dates>
	<discovery>2015-04-07</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0afe8b29-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Integer overflow in IGMP protocol</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_13</lt></range>
	<range><ge>8.4</ge><lt>8.4_27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>An integer overflow in computing the size of IGMPv3 data
	buffer can result in a buffer which is too small for the
	requested operation.</p>
	<h1>Impact:</h1>
	<p>An attacker who can send specifically crafted IGMP packets
	could cause a denial of service situation by causing the
	kernel to crash.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1414</cvename>
	<freebsdsa>SA-15:04.igmp</freebsdsa>
	</references>
	<dates>
	<discovery>2015-02-25</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0aad3ce5-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- SCTP stream reset vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_5</lt></range>
	<range><ge>10.0</ge><lt>10.0_17</lt></range>
	<range><ge>9.3</ge><lt>9.3_9</lt></range>
	<range><ge>8.4</ge><lt>8.4_23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The input validation of received SCTP RE_CONFIG chunks
	is insufficient, and can result in a NULL pointer deference
	later.</p>
	<h1>Impact:</h1>
	<p>A remote attacker who can send a malformed SCTP packet
	to a FreeBSD system that serves SCTP can cause a kernel
	panic, resulting in a Denial of Service.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8613</cvename>
	<freebsdsa>SA-15:03.sctp</freebsdsa>
	</references>
	<dates>
	<discovery>2015-01-27</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="0a5cf6d8-600a-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_5</lt></range>
	<range><ge>10.0</ge><lt>10.0_17</lt></range>
	<range><ge>9.3</ge><lt>9.3_9</lt></range>
	<range><ge>8.4</ge><lt>8.4_23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to insufficient validation of the SCTP stream ID,
	which serves as an array index, a local unprivileged attacker
	can read or write 16-bits of kernel memory.</p>
	<h1>Impact:</h1>
	<p>An unprivileged process can read or modify 16-bits of
	memory which belongs to the kernel. This may lead to
	exposure of sensitive information or allow privilege
	escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8612</cvename>
	<freebsdsa>SA-15:02.kmem</freebsdsa>
	</references>
	<dates>
	<discovery>2015-01-27</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="74ded00e-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Buffer overflow in stdio</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A programming error in the standard I/O library's
	__sflush() function could erroneously adjust the buffered
	stream's internal state even when no write actually occurred
	in the case when write(2) system call returns an error.</p>
	<h1>Impact:</h1>
	<p>The accounting mismatch would accumulate, if the caller
	does not check for stream status and will eventually lead
	to a heap buffer overflow.</p>
	<p>Such overflows may lead to data corruption or the execution
	of arbitrary code at the privilege level of the calling
	program.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8611</cvename>
	<freebsdsa>SA-14:27.stdio</freebsdsa>
	</references>
	<dates>
	<discovery>2014-12-10</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7488378d-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Remote command execution in ftp(1)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_12</lt></range>
	<range><ge>9.3</ge><lt>9.3_5</lt></range>
	<range><ge>9.2</ge><lt>9.2_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_22</lt></range>
	<range><ge>8.4</ge><lt>8.4_19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A malicious HTTP server could cause ftp(1) to execute
	arbitrary commands.</p>
	<h1>Impact:</h1>
	<p>When operating on HTTP URIs, the ftp(1) client follows
	HTTP redirects, and uses the part of the path after the
	last '/' from the last resource it accesses as the output
	filename if '-o' is not specified.</p>
	<p>If the output file name provided by the server begins
	with a pipe ('\|'), the output is passed to popen(3), which
	might be used to execute arbitrary commands on the ftp(1)
	client machine.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8517</cvename>
	<freebsdsa>SA-14:26.ftp</freebsdsa>
	</references>
	<dates>
	<discovery>2014-11-04</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="74389f22-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2)</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_12</lt></range>
	<range><ge>9.3</ge><lt>9.3_5</lt></range>
	<range><ge>9.2</ge><lt>9.2_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_22</lt></range>
	<range><ge>8.4</ge><lt>8.4_19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When setlogin(2) is called while setting up a new login
	session, the login name is copied into an uninitialized
	stack buffer, which is then copied into a buffer of the
	same size in the session structure. The getlogin(2) system
	call returns the entire buffer rather than just the portion
	occupied by the login name associated with the session.</p>
	<h1>Impact:</h1>
	<p>An unprivileged user can access this memory by calling
	getlogin(2) and reading beyond the terminating NUL character
	of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD
	9 and 10) bytes of kernel memory may be leaked in this
	manner for each invocation of setlogin(2).</p>
	<p>This memory may contain sensitive information, such as
	portions of the file cache or terminal buffers, which an
	attacker might leverage to obtain elevated privileges.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8476</cvename>
	<freebsdsa>SA-14:25.setlogin</freebsdsa>
	</references>
	<dates>
	<discovery>2014-11-04</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="73e9a137-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Denial of service attack against sshd(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_12</lt></range>
	<range><ge>9.2</ge><lt>9.2_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Although OpenSSH is not multithreaded, when OpenSSH is
	compiled with Kerberos support, the Heimdal libraries bring
	in the POSIX thread library as a dependency. Due to incorrect
	library ordering while linking sshd(8), symbols in the C
	library which are shadowed by the POSIX thread library may
	not be resolved correctly at run time.</p>
	<p>Note that this problem is specific to the FreeBSD build
	system and does not affect other operating systems or the
	version of OpenSSH available from the FreeBSD ports tree.</p>
	<h1>Impact:</h1>
	<p>An incorrectly linked sshd(8) child process may deadlock
	while handling an incoming connection. The connection may
	then time out or be interrupted by the client, leaving the
	deadlocked sshd(8) child process behind. Eventually, the
	sshd(8) parent process stops accepting new connections.</p>
	<p>An attacker may take advantage of this by repeatedly
	connecting and then dropping the connection after having
	begun, but not completed, the authentication process.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8475</cvename>
	<freebsdsa>SA-14:24.sshd</freebsdsa>
	</references>
	<dates>
	<discovery>2014-11-04</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="73964eac-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- memory leak in sandboxed namei lookup</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The namei facility will leak a small amount of kernel
	memory every time a sandboxed process looks up a nonexistent
	path name.</p>
	<h1>Impact:</h1>
	<p>A remote attacker that can cause a sandboxed process
	(for instance, a web server) to look up a large number of
	nonexistent path names can cause memory exhaustion.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3711</cvename>
	<freebsdsa>SA-14:22.namei</freebsdsa>
	</references>
	<dates>
	<discovery>2014-10-21</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="734233f4-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
	<range><ge>8.4</ge><lt>8.4_17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The input path in routed(8) will accept queries from any
	source and attempt to answer them. However, the output path
	assumes that the destination address for the response is
	on a directly connected network.</p>
	<h1>Impact:</h1>
	<p>Upon receipt of a query from a source which is not on a
	directly connected network, routed(8) will trigger an
	assertion and terminate. The affected system's routing table
	will no longer be updated. If the affected system is a
	router, its routes will eventually expire from other routers'
	routing tables, and its networks will no longer be reachable
	unless they are also connected to another router.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3955</cvename>
	<freebsdsa>SA-14:21.routed</freebsdsa>
	</references>
	<dates>
	<discovery>2014-10-21</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="72ee7111-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- rtsold(8) remote buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to a missing length check in the code that handles
	DNS parameters, a malformed router advertisement message
	can result in a stack buffer overflow in rtsold(8).</p>
	<h1>Impact:</h1>
	<p>Receipt of a router advertisement message with a malformed
	DNSSL option, for instance from a compromised host on the
	same network, can cause rtsold(8) to crash.</p>
	<p>While it is theoretically possible to inject code into
	rtsold(8) through malformed router advertisement messages,
	it is normally compiled with stack protection enabled,
	rendering such an attack extremely difficult.</p>
	<p>When rtsold(8) crashes, the existing DNS configuration
	will remain in force, and the kernel will continue to receive
	and process periodic router advertisements.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3954</cvename>
	<freebsdsa>SA-14:20.rtsold</freebsdsa>
	</references>
	<dates>
	<discovery>2014-10-21</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="729c4a9f-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Denial of Service in TCP packet processing</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_2</lt></range>
	<range><ge>9.2</ge><lt>9.2_12</lt></range>
	<range><ge>9.1</ge><lt>9.1_19</lt></range>
	<range><ge>8.4</ge><lt>8.4_16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When a segment with the SYN flag for an already existing
	connection arrives, the TCP stack tears down the connection,
	bypassing a check that the sequence number in the segment
	is in the expected window.</p>
	<h1>Impact:</h1>
	<p>An attacker who has the ability to spoof IP traffic can
	tear down a TCP connection by sending only 2 packets, if
	they know both TCP port numbers. In case one of the two
	port numbers is unknown, a successful attack requires less
	than 2**17 packets spoofed, which can be generated within
	less than a second on a decent connection to the Internet.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2004-0230</cvename>
	<freebsdsa>SA-14:19.tcp</freebsdsa>
	</references>
	<dates>
	<discovery>2014-09-16</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="7240de58-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Kernel memory disclosure in control messages and SCTP</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_7</lt></range>
	<range><ge>9.2</ge><lt>9.2_10</lt></range>
	<range><ge>9.1</ge><lt>9.1_17</lt></range>
	<range><ge>8.4</ge><lt>8.4_14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Buffer between control message header and data may not
	be completely initialized before being copied to userland.
	[CVE-2014-3952]</p>
	<p>Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO,
	have implicit padding that may not be completely initialized
	before being copied to userland. In addition, three SCTP
	notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and
	SCTP_AUTHENTICATION_EVENT, have padding in the returning
	data structure that may not be completely initialized before
	being copied to userland. [CVE-2014-3953]</p>
	<h1>Impact:</h1>
	<p>An unprivileged local process may be able to retrieve
	portion of kernel memory.</p>
	<p>For the generic control message, the process may be able
	to retrieve a maximum of 4 bytes of kernel memory.</p>
	<p>For SCTP, the process may be able to retrieve 2 bytes
	of kernel memory for all three control messages, plus 92
	bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the
	local process is permitted to receive SCTP notification, a
	maximum of 112 bytes of kernel memory may be returned to
	userland.</p>
	<p>This information might be directly useful, or it might
	be leveraged to obtain elevated privileges in some way. For
	example, a terminal buffer might include a user-entered
	password.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3952</cvename>
	<cvename>CVE-2014-3953</cvename>
	<freebsdsa>SA-14:17.kmem</freebsdsa>
	</references>
	<dates>
	<discovery>2014-07-08</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="70140f20-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_6</lt></range>
	<range><ge>9.2</ge><lt>9.2_9</lt></range>
	<range><ge>9.1</ge><lt>9.1_16</lt></range>
	<range><ge>8.4</ge><lt>8.4_13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A specifically crafted Composite Document File (CDF)
	file can trigger an out-of-bounds read or an invalid pointer
	dereference. [CVE-2012-1571]</p>
	<p>A flaw in regular expression in the awk script detector
	makes use of multiple wildcards with unlimited repetitions.
	[CVE-2013-7345]</p>
	<p>A malicious input file could trigger infinite recursion
	in libmagic(3). [CVE-2014-1943]</p>
	<p>A specifically crafted Portable Executable (PE) can
	trigger out-of-bounds read. [CVE-2014-2270]</p>
	<h1>Impact:</h1>
	<p>An attacker who can cause file(1) or any other applications
	using the libmagic(3) library to be run on a maliciously
	constructed input can the application to crash or consume
	excessive CPU resources, resulting in a denial-of-service.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1571</cvename>
	<cvename>CVE-2013-7345</cvename>
	<cvename>CVE-2014-1943</cvename>
	<cvename>CVE-2014-2270</cvename>
	<freebsdsa>SA-14:16.file</freebsdsa>
	</references>
	<dates>
	<discovery>2014-06-24</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6f91a709-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A NULL pointer dereference in the initialization code
	of the HZ module and an out of bounds array access in the
	initialization code of the VIQR module make iconv_open(3)
	calls involving HZ or VIQR result in an application crash.</p>
	<h1>Impact:</h1>
	<p>Services where an attacker can control the arguments of
	an iconv_open(3) call can be caused to crash resulting in
	a denial-of-service. For example, an email encoded in HZ
	may cause an email delivery service to crash if it converts
	emails to a more generic encoding like UTF-8 before applying
	filtering rules.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3951</cvename>
	<freebsdsa>SA-14:15.iconv</freebsdsa>
	</references>
	<dates>
	<discovery>2014-06-24</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6e8f9003-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Incorrect error handling in PAM policy parser</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.2</ge><lt>9.2_7</lt></range>
	<range><ge>10.0</ge><lt>10.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The OpenPAM library searches for policy definitions in
	several locations. While doing so, the absence of a policy
	file is a soft failure (handled by searching in the next
	location) while the presence of an invalid file is a hard
	failure (handled by returning an error to the caller).</p>
	<p>The policy parser returns the same error code (ENOENT)
	when a syntactically valid policy references a non-existent
	module as when the requested policy file does not exist.
	The search loop regards this as a soft failure and looks
	for the next similarly-named policy, without discarding the
	partially-loaded configuration.</p>
	<p>A similar issue can arise if a policy contains an include
	directive that refers to a non-existent policy.</p>
	<h1>Impact:</h1>
	<p>If a module is removed, or the name of a module is
	misspelled in the policy file, the PAM library will proceed
	with a partially loaded configuration. Depending on the
	exact circumstances, this may result in a fail-open scenario
	where users are allowed to log in without a password, or
	with an incorrect password.</p>
	<p>In particular, if a policy references a module installed
	by a package or port, and that package or port is being
	reinstalled or upgraded, there is a brief window of time
	during which the module is absent and policies that use it
	may fail open. This can be especially damaging to Internet-facing
	SSH servers, which are regularly subjected to brute-force
	scans.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3879</cvename>
	<freebsdsa>SA-14:13.pam</freebsdsa>
	</references>
	<dates>
	<discovery>2014-06-03</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6e04048b-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- ktrace kernel memory disclosure</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.2</ge><lt>9.2_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_14</lt></range>
	<range><ge>8.4</ge><lt>8.4_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to an overlooked merge to -STABLE branches, the size
	for page fault kernel trace entries was set incorrectly.</p>
	<h1>Impact:</h1>
	<p>A user who can enable kernel process tracing could end
	up reading the contents of kernel memory.</p>
	<p>Such memory might contain sensitive information, such
	as portions of the file cache or terminal buffers. This
	information might be directly useful, or it might be leveraged
	to obtain elevated privileges in some way; for example, a
	terminal buffer might include a user-entered password.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3873</cvename>
	<freebsdsa>SA-14:12.ktrace</freebsdsa>
	</references>
	<dates>
	<discovery>2014-06-03</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6d9eadaf-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- sendmail improper close-on-exec flag handling</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_4</lt></range>
	<range><ge>9.2</ge><lt>9.2_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_14</lt></range>
	<range><ge>8.4</ge><lt>8.4_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>There is a programming error in sendmail(8) that prevented
	open file descriptors have close-on-exec properly set.
	Consequently a subprocess will be able to access all open
	files that the parent process have open.</p>
	<h1>Impact:</h1>
	<p>A local user who can execute their own program for mail
	delivery will be able to interfere with an open SMTP
	connection.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-14:11.sendmail</freebsdsa>
	</references>
	<dates>
	<discovery>2014-06-03</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6d472244-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- TCP reassembly vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>8.4</ge><lt>8.4_9</lt></range>
	<range><ge>8.3</ge><lt>8.3_16</lt></range>
	<range><ge>9.2</ge><lt>9.2_5</lt></range>
	<range><ge>9.1</ge><lt>9.1_12</lt></range>
	<range><ge>10.0</ge><lt>10.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>FreeBSD may add a reassemble queue entry on the stack
	into the segment list when the reassembly queue reaches its
	limit. The memory from the stack is undefined after the
	function returns. Subsequent iterations of the reassembly
	function will attempt to access this entry.</p>
	<h1>Impact:</h1>
	<p>An attacker who can send a series of specifically crafted
	packets with a connection could cause a denial of service
	situation by causing the kernel to crash.</p>
	<p>Additionally, because the undefined on stack memory may
	be overwritten by other kernel threads, while extremely
	difficult, it may be possible for an attacker to construct
	a carefully crafted attack to obtain portion of kernel
	memory via a connected socket. This may result in the
	disclosure of sensitive information such as login credentials,
	etc. before or even without crashing the system.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3000</cvename>
	<freebsdsa>SA-14:08.tcp</freebsdsa>
	</references>
	<dates>
	<discovery>2014-04-30</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6b6ca5b6-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- devfs rules not applied by default for jails</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The default devfs rulesets are not loaded on boot, even
	when jails are used. Device nodes will be created in the
	jail with their normal default access permissions, while
	most of them should be hidden and inaccessible.</p>
	<h1>Impact:</h1>
	<p>Jailed processes can get access to restricted resources
	on the host system. For jailed processes running with
	superuser privileges this implies access to all devices on
	the system. This level of access could lead to information
	leakage and privilege escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3001</cvename>
	<freebsdsa>SA-14:07.devfs</freebsdsa>
	</references>
	<dates>
	<discovery>2014-04-30</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="6a384960-6007-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Deadlock in the NFS server</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_1</lt></range>
	<range><ge>9.2</ge><lt>9.2_4</lt></range>
	<range><ge>9.1</ge><lt>9.1_11</lt></range>
	<range><ge>8.4</ge><lt>8.4_8</lt></range>
	<range><ge>8.3</ge><lt>8.3_15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The kernel holds a lock over the source directory vnode
	while trying to convert the target directory file handle
	to a vnode, which needs to be returned with the lock held,
	too. This order may be in violation of normal lock order,
	which in conjunction with other threads that grab locks in
	the right order, constitutes a deadlock condition because
	no thread can proceed.</p>
	<h1>Impact:</h1>
	<p>An attacker on a trusted client could cause the NFS
	server become deadlocked, resulting in a denial of service.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1453</cvename>
	<freebsdsa>SA-14:05.nfsserver</freebsdsa>
	</references>
	<dates>
	<discovery>2014-04-08</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="4c96ecf2-5fd9-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- bsnmpd remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.2</ge><lt>9.2_3</lt></range>
	<range><ge>9.1</ge><lt>9.1_10</lt></range>
	<range><ge>8.4</ge><lt>8.4_7</lt></range>
	<range><ge>8.3</ge><lt>8.3_14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem Description:</p>
	<p>The bsnmpd(8) daemon is prone to a stack-based
	buffer-overflow when it has received a specifically crafted
	GETBULK PDU request.</p>
	<p>Impact:</p>
	<p>This issue could be exploited to execute arbitrary code in
	the context of the service daemon, or crash the service daemon, causing
	a denial-of-service.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1452</cvename>
	<freebsdsa>SA-14:01.bsnmpd</freebsdsa>
	</references>
	<dates>
	<discovery>2014-01-14</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="ca16fd0b-5fd1-11e6-a6f2-6cc21735f730">
	<topic>PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.23</lt></range>
	</package>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.18</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1688/">
	<p>
	Security Fixes nested CASE expressions +
	database and role names with embedded special characters
	</p>
	<ul>
	<li>CVE-2016-5423: certain nested CASE expressions can cause the
	server to crash.
	</li>
	<li>CVE-2016-5424: database and role names with embedded special
	characters can allow code injection during administrative operations
	like pg_dumpall.
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5423</cvename>
	<cvename>CVE-2016-5424</cvename>
	</references>
	<dates>
	<discovery>2016-08-11</discovery>
	<entry>2016-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="28bf62ef-5e2c-11e6-a15f-00248c0c745d">
	<topic>piwik -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><lt>2.16.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Piwik reports:</p>
	<blockquote cite="https://piwik.org/changelog/piwik-2-16-2/">
	<p>We have identified and fixed several XSS security issues in this release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>We have identified and fixed several XSS security issues in this release.</url>
	</references>
	<dates>
	<discovery>2016-08-03</discovery>
	<entry>2016-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="7d08e608-5e95-11e6-b334-002590263bf5">
	<topic>BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><le>9.9.9P2</le></range>
	</package>
	<package>
	<name>bind910</name>
	<range><le>9.10.4P2</le></range>
	</package>
	<package>
	<name>bind911</name>
	<range><le>9.11.0.b2</le></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2016.11.02</le></range>
	</package>
	<package>
	<name>knot</name>
	<name>knot1</name>
	<range><lt>1.6.8</lt></range>
	</package>
	<package>
	<name>knot2</name>
	<range><lt>2.3.0</lt></range>
	</package>
	<package>
	<name>nsd</name>
	<range><lt>4.1.11</lt></range>
	</package>
	<package>
	<name>powerdns</name>
	<range><lt>4.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01390">
	<p>DNS protocols were designed with the assumption that a certain
	amount of trust could be presumed between the operators of primary
	and secondary servers for a given zone. However, in current
	practice some organizations have scenarios which require them to
	accept zone data from sources that are not fully trusted (for
	example: providers of secondary name service). A party who is
	allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS
	updates) can overwhelm the server which is accepting data by
	intentionally or accidentally exhausting that server's memory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6170</cvename>
	<cvename>CVE-2016-6171</cvename>
	<cvename>CVE-2016-6172</cvename>
	<cvename>CVE-2016-6173</cvename>
	<url>https://kb.isc.org/article/AA-01390</url>
	<mlist>http://www.openwall.com/lists/oss-security/2016/07/06/4</mlist>
	</references>
	<dates>
	<discovery>2016-07-06</discovery>
	<entry>2016-08-10</entry>
	<modified>2017-04-24</modified>
	</dates>
	</vuln>

	<vuln vid="dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Kernel memory disclosure in sctp(4)</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.1</ge><lt>9.1_6</lt></range>
	<range><ge>8.4</ge><lt>8.4_3</lt></range>
	<range><ge>8.3</ge><lt>8.3_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem Description:</p>
	<p>When initializing the SCTP state cookie being sent in INIT-ACK chunks,
	a buffer allocated from the kernel stack is not completely initialized.</p>
	<p>Impact:</p>
	<p>Fragments of kernel memory may be included in SCTP packets and
	transmitted over the network. For each SCTP session, there are two
	separate instances in which a 4-byte fragment may be transmitted.</p>
	<p>This memory might contain sensitive information, such as portions of the
	file cache or terminal buffers. This information might be directly
	useful, or it might be leveraged to obtain elevated privileges in
	some way. For example, a terminal buffer might include a user-entered
	password.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-13:10.sctp</freebsdsa>
	<cvename>CVE-2013-5209</cvename>
	</references>
	<dates>
	<discovery>2013-08-22</discovery>
	<entry>2016-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="0844632f-5e78-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- integer overflow in IP_MSFILTER</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.1</ge><lt>9.1_6</lt></range>
	<range><ge>8.4</ge><lt>8.4_3</lt></range>
	<range><ge>8.3</ge><lt>8.3_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem Description:</p>
	<p>An integer overflow in computing the size of a temporary
	buffer can result in a buffer which is too small for the requested
	operation.</p>
	<p>Impact:</p>
	<p>An unprivileged process can read or write pages of memory
	which belong to the kernel. These may lead to exposure of sensitive
	information or allow privilege escalation.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3077</cvename>
	<freebsdsa>SA-13:09.ip_multicast</freebsdsa>
	</references>
	<dates>
	<discovery>2013-08-22</discovery>
	<entry>2016-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="e5d2442d-5e76-11e6-a6c3-14dae9d210b8">
	<topic>FreeBSD -- Incorrect privilege validation in the NFS server</topic>
	<affects>
	<package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.1</ge><lt>9.1_5</lt></range>
	<range><ge>8.3</ge><lt>8.3_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem Description:</p>
	<p>The kernel incorrectly uses client supplied credentials
	instead of the one configured in exports(5) when filling out the
	anonymous credential for a NFS export, when -network or -host
	restrictions are used at the same time.</p>
	<p>Impact:</p>
	<p>The remote client may supply privileged credentials (e.g. the
	root user) when accessing a file under the NFS share, which will bypass
	the normal access checks.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4851</cvename>
	<freebsdsa>SA-13:08.nfsserver</freebsdsa>
	</references>
	<dates>
	<discovery>2013-07-06</discovery>
	<entry>2016-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="6da45e38-5b55-11e6-8859-000c292ee6b8">
	<topic>collectd -- Network plugin heap overflow</topic>
	<affects>
	<package>
	<name>collectd5</name>
	<range><lt>5.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The collectd Project reports:</p>
	<blockquote cite="http://collectd.org/news.shtml#news98">
	<p>Emilien Gaspar has identified a heap overflow in collectd's
	network plugin which can be triggered remotely and is potentially
	exploitable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6254</cvename>
	<url>http://collectd.org/news.shtml#news98</url>
	</references>
	<dates>
	<discovery>2016-07-26</discovery>
	<entry>2016-08-05</entry>
	</dates>
	</vuln>

	<vuln vid="3ddcb42b-5b78-11e6-b334-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle28</name>
	<range><le>2.8.12</le></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.7</lt></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.5</lt></range>
	</package>
	<package>
	<name>moodle31</name>
	<range><lt>3.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-16-0019: Glossary search displays entries without
	checking user permissions to view them</p></li>
	<li><p>MSA-16-0020: Text injection in email headers</p></li>
	<li><p>MSA-16-0021: Unenrolled user still receives event monitor
	notifications even though they can no longer access course</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5012</cvename>
	<cvename>CVE-2016-5013</cvename>
	<cvename>CVE-2016-5014</cvename>
	<url>https://moodle.org/security/</url>
	</references>
	<dates>
	<discovery>2016-07-19</discovery>
	<entry>2016-08-06</entry>
	</dates>
	</vuln>

	<vuln vid="7a31e0de-5b6d-11e6-b334-002590263bf5">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.9P2</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.4P2</lt></range>
	</package>
	<package>
	<name>bind911</name>
	<range><lt>9.11.0.b2</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><lt>9.12.0.a.2016.07.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01393">
	<p>A query name which is too long can cause a segmentation fault in
	lwresd.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2775</cvename>
	<url>https://kb.isc.org/article/AA-01393</url>
	</references>
	<dates>
	<discovery>2016-07-18</discovery>
	<entry>2016-08-06</entry>
	</dates>
	</vuln>

	<vuln vid="610101ea-5b6a-11e6-b334-002590263bf5">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html">
	<p>The following vulnerabilities have been fixed:</p>
	<ul>
	<li><p>wnpa-sec-2016-41</p>
	<p>PacketBB crash. (Bug 12577)</p></li>
	<li><p>wnpa-sec-2016-42</p>
	<p>WSP infinite loop. (Bug 12594)</p></li>
	<li><p>wnpa-sec-2016-44</p>
	<p>RLC long loop. (Bug 12660)</p></li>
	<li><p>wnpa-sec-2016-45</p>
	<p>LDSS dissector crash. (Bug 12662)</p></li>
	<li><p>wnpa-sec-2016-46</p>
	<p>RLC dissector crash. (Bug 12664)</p></li>
	<li><p>wnpa-sec-2016-47</p>
	<p>OpenFlow long loop. (Bug 12659)</p></li>
	<li><p>wnpa-sec-2016-48</p>
	<p>MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)</p></li>
	<li><p>wnpa-sec-2016-49</p>
	<p>WBXML crash. (Bug 12663)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6505</cvename>
	<cvename>CVE-2016-6506</cvename>
	<cvename>CVE-2016-6508</cvename>
	<cvename>CVE-2016-6509</cvename>
	<cvename>CVE-2016-6510</cvename>
	<cvename>CVE-2016-6511</cvename>
	<cvename>CVE-2016-6512</cvename>
	<cvename>CVE-2016-6513</cvename>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/08/01/4</url>
	</references>
	<dates>
	<discovery>2016-07-27</discovery>
	<entry>2016-08-06</entry>
	</dates>
	</vuln>

	<vuln vid="3e08047f-5a6c-11e6-a6c3-14dae9d210b8">
	<topic>p5-XSLoader -- local arbitrary code execution</topic>
	<affects>
	<package>
	<name>p5-XSLoader</name>
	<range><lt>0.22</lt></range>
	</package>
	<package>
	<name>perl5</name>
	<name>perl5.18</name>
	<name>perl5.20</name>
	<name>perl5.22</name>
	<name>perl5.24</name>
	<name>perl5-devel</name>
	<range><lt>5.18.4_24</lt></range>
	<range><ge>5.20</ge><lt>5.20.3_15</lt></range>
	<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
	<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
	<range><ge>5.25</ge><lt>5.25.2.87</lt></range>
	</package>
	<package>
	<name>perl</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakub Wilk reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578">
	<p>XSLoader tries to load code from a subdirectory in the cwd when
	called inside a string eval</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578</url>
	<cvename>CVE-2016-6185</cvename>
	</references>
	<dates>
	<discovery>2016-06-30</discovery>
	<entry>2016-08-04</entry>
	<modified>2016-08-22</modified>
	</dates>
	</vuln>

	<vuln vid="72bfbb09-5a6a-11e6-a6c3-14dae9d210b8">
	<topic>perl -- local arbitrary code execution</topic>
	<affects>
	<package>
	<name>perl5</name>
	<name>perl5.18</name>
	<name>perl5.20</name>
	<name>perl5.22</name>
	<name>perl5.24</name>
	<name>perl5-devel</name>
	<range><lt>5.18.4_23</lt></range>
	<range><ge>5.20</ge><lt>5.20.3_14</lt></range>
	<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
	<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
	<range><ge>5.25</ge><lt>5.25.3.18</lt></range>
	</package>
	<package>
	<name>perl</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sawyer X reports:</p>
	<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html">
	<p>Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do
	not properly remove . (period) characters from the end of the includes
	directory array, which might allow local users to gain privileges via a
	Trojan horse module under the current working directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html</url>
	<cvename>CVE-2016-1238</cvename>
	</references>
	<dates>
	<discovery>2016-07-21</discovery>
	<entry>2016-08-04</entry>
	<modified>2016-08-22</modified>
	</dates>
	</vuln>

	<vuln vid="556d2286-5a51-11e6-a6c3-14dae9d210b8">
	<topic>gd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gd</name>
	<range><lt>2.2.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pierre Joye reports:</p>
	<blockquote cite="https://github.com/libgd/libgd/releases/tag/gd-2.2.3">
	<ul>
	<li><p>fix php bug 72339, Integer Overflow in _gd2GetHeader
	(CVE-2016-5766)</p></li>
	<li><p>gd: Buffer over-read issue when parsing crafted TGA
	file (CVE-2016-6132)</p></li>
	<li><p>Integer overflow error within _gdContributionsAlloc()
	(CVE-2016-6207)</p></li>
	<li><p>fix php bug 72494, invalid color index not handled, can
	lead to crash ( CVE-2016-6128)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.3</url>
	<cvename>CVE-2016-5766</cvename>
	<cvename>CVE-2016-6132</cvename>
	<cvename>CVE-2016-6207</cvename>
	<cvename>CVE-2016-6128</cvename>
	</references>
	<dates>
	<discovery>2016-07-21</discovery>
	<entry>2016-08-04</entry>
	</dates>
	</vuln>

	<vuln vid="e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1">
	<topic>Vulnerabilities in Curl</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.32.0</ge><lt>7.50.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Curl security team reports:</p>
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	<p>CVE-2016-5419 - TLS session resumption client cert bypass</p>
	<p>CVE-2016-5420 - Re-using connections with wrong client cert</p>
	<p>CVE-2016-5421 - use of connection struct after free</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5419</cvename>
	<cvename>CVE-2016-5420</cvename>
	<cvename>CVE-2016-5421</cvename>
	<url>https://curl.haxx.se/docs/adv_20160803A.html</url>
	<url>https://curl.haxx.se/docs/adv_20160803B.html</url>
	<url>https://curl.haxx.se/docs/adv_20160803C.html</url>
	</references>
	<dates>
	<discovery>2016-08-03</discovery>
	<entry>2016-08-04</entry>
	</dates>
	</vuln>

	<vuln vid="ef0033ad-5823-11e6-80cc-001517f335e2">
	<topic>lighttpd - multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.41</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Lighttpd Project reports:</p>
	<blockquote cite="http://www.lighttpd.net/2016/7/31/1.4.41/">
	<p>Security fixes for Lighttpd:</p>
	<ul>
	<li><p>security: encode quoting chars in HTML and XML</p></li>
	<li><p>security: ensure gid != 0 if server.username is set, but not server.groupname</p></li>
	<li><p>security: disable stat_cache if server.follow-symlink = “disable”</p></li>
	<li><p>security: httpoxy defense: do not emit HTTP_PROXY to CGI env</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.lighttpd.net/2016/7/31/1.4.41/</url>
	<freebsdpr>ports/211495</freebsdpr>
	</references>
	<dates>
	<discovery>2016-07-31</discovery>
	<entry>2016-08-03</entry>
	</dates>
	</vuln>

	<vuln vid="06574c62-5854-11e6-b334-002590263bf5">
	<topic>xen-tools -- virtio: unbounded memory allocation issue</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">
	<p>A guest can submit virtio requests without bothering to wait for
	completion and is therefore not bound by virtqueue size...</p>
	<p>A malicious guest administrator can cause unbounded memory
	allocation in QEMU, which can cause an Out-of-Memory condition
	in the domain running qemu. Thus, a malicious guest administrator
	can cause a denial of service affecting the whole host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5403</cvename>
	<freebsdpr>ports/211482</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-184.html</url>
	</references>
	<dates>
	<discovery>2016-07-27</discovery>
	<entry>2016-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="04cf89e3-5854-11e6-b334-002590263bf5">
	<topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><gt>4.5</gt><lt>4.7.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">
	<p>Supervisor Mode Access Prevention is a hardware feature designed
	to make an Operating System more robust, by raising a pagefault
	rather than accidentally following a pointer into userspace.
	However, legitimate accesses into userspace require whitelisting,
	and the exception delivery mechanism for 32bit PV guests wasn't
	whitelisted.</p>
	<p>A malicious 32-bit PV guest kernel can trigger a safety check,
	crashing the hypervisor and causing a denial of service to other
	VMs on the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6259</cvename>
	<freebsdpr>ports/211482</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-183.html</url>
	</references>
	<dates>
	<discovery>2016-07-26</discovery>
	<entry>2016-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="032aa524-5854-11e6-b334-002590263bf5">
	<topic>xen-kernel -- x86: Privilege escalation in PV guests</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">
	<p>The PV pagetable code has fast-paths for making updates to
	pre-existing pagetable entries, to skip expensive re-validation
	in safe cases (e.g. clearing only Access/Dirty bits). The bits
	considered safe were too broad, and not actually safe.</p>
	<p>A malicious PV guest administrator can escalate their privilege to
	that of the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6258</cvename>
	<freebsdpr>ports/211482</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-182.html</url>
	</references>
	<dates>
	<discovery>2016-07-26</discovery>
	<entry>2016-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
	<topic>libidn -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libidn</name>
	<range><lt>1.33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Josefsson reports:</p>
	<blockquote cite="https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html">
	<p>libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.</p>
	<p>idn: Solve out-of-bounds-read when reading one zero byte as input.
	Also replaced fgets with getline.</p>
	<p>libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was
	always documented to only accept UTF-8 data, but now it doesn't
	crash when presented with such data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6261</cvename>
	<cvename>CVE-2015-8948</cvename>
	<cvename>CVE-2016-6262</cvename>
	<cvename>CVE-2016-6263</cvename>
	<url>https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/07/21/4</url>
	</references>
	<dates>
	<discovery>2016-07-20</discovery>
	<entry>2016-07-31</entry>
	</dates>
	</vuln>

	<vuln vid="6fb8a90f-c9d5-4d14-b940-aed3d63c2edc">
	<topic>The GIMP -- Use after Free vulnerability</topic>
	<affects>
	<package>
	<name>gimp-app</name>
	<range><lt>2.8.18,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GIMP team reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html">
	<p>A Use-after-free vulnerability was found in the xcf_load_image function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=767873</url>
	<cvename>CVE-2016-4994</cvename>
	</references>
	<dates>
	<discovery>2016-06-20</discovery>
	<entry>2016-07-19</entry>
	</dates>
	</vuln>

	<vuln vid="cb09a7aa-5344-11e6-a7bd-14dae9d210b8">
	<topic>xercesi-c3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xerces-c3</name>
	<range><lt>3.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache reports:</p>
	<blockquote cite="https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt">
	<p>The Xerces-C XML parser fails to successfully parse a
	DTD that is deeply nested, and this causes a stack overflow, which
	makes a denial of service attack against many applications possible
	by an unauthenticated attacker.</p>
	<p>Also, CVE-2016-2099: Use-after-free vulnerability in
	validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier
	allows context-dependent attackers to have unspecified impact via an
	invalid character in an XML document.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt</url>
	<url>http://www.openwall.com/lists/oss-security/2016/05/09/7</url>
	<cvename>CVE-2016-2099</cvename>
	<cvename>CVE-2016-4463</cvename>
	</references>
	<dates>
	<discovery>2016-05-09</discovery>
	<entry>2016-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="b6402385-533b-11e6-a7bd-14dae9d210b8">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php55</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php70-curl</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-bz2</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-bz2</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-bz2</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-exif</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-exif</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-exif</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-gd</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-gd</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-gd</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php70-mcrypt</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-odbc</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-odbc</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-odbc</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-snmp</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-snmp</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-snmp</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-xmlrpc</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-xmlrpc</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-xmlrpc</name>
	<range><lt>7.0.9</lt></range>
	</package>
	<package>
	<name>php55-zip</name>
	<range><lt>5.5.38</lt></range>
	</package>
	<package>
	<name>php56-zip</name>
	<range><lt>5.6.24</lt></range>
	</package>
	<package>
	<name>php70-zip</name>
	<range><lt>7.0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.38">
	<ul>
	<li><p>Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)</p></li>
	<li><p>Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).</p></li>
	<li><p>Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).</p></li>
	<li><p>Fixed bug #72519 (imagegif/output out-of-bounds access).</p></li>
	<li><p>Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).</p></li>
	<li><p>Fixed bug #72533 (locale_accept_from_http out-of-bounds access).</p></li>
	<li><p>Fixed bug #72541 (size_t overflow lead to heap corruption).</p></li>
	<li><p>Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).</p></li>
	<li><p>Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).</p></li>
	<li><p>Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).</p></li>
	<li><p>Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).</p></li>
	<li><p>Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).</p></li>
	<li><p>Fixed bug #72613 (Inadequate error handling in bzread()).</p></li>
	<li><p>Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.php.net/ChangeLog-5.php#5.5.38</url>
	<url>http://www.php.net/ChangeLog-5.php#5.6.24</url>
	<url>http://www.php.net/ChangeLog-7.php#7.0.8</url>
	<url>http://seclists.org/oss-sec/2016/q3/121</url>
	<cvename>CVE-2015-8879</cvename>
	<cvename>CVE-2016-5385</cvename>
	<cvename>CVE-2016-5399</cvename>
	<cvename>CVE-2016-6288</cvename>
	<cvename>CVE-2016-6289</cvename>
	<cvename>CVE-2016-6290</cvename>
	<cvename>CVE-2016-6291</cvename>
	<cvename>CVE-2016-6292</cvename>
	<cvename>CVE-2016-6294</cvename>
	<cvename>CVE-2016-6295</cvename>
	<cvename>CVE-2016-6296</cvename>
	<cvename>CVE-2016-6297</cvename>
	</references>
	<dates>
	<discovery>2016-07-21</discovery>
	<entry>2016-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>52.0.2743.82</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">
	<p>48 security fixes in this release, including:</p>
	<ul>
	<li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to
	Pinkie Pie xisigr of Tencent's Xuanwu Lab</li>
	<li>[613949] High CVE-2016-1708: Use-after-free in Extensions.
	Credit to Adam Varsan</li>
	<li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly.
	Credit to ChenQin of Topsec Security Team</li>
	<li>[616907] High CVE-2016-1710: Same-origin bypass in Blink.
	Credit to Mariusz Mlynski</li>
	<li>[617495] High CVE-2016-1711: Same-origin bypass in Blink.
	Credit to Mariusz Mlynski</li>
	<li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit
	to cloudfuzzer</li>
	<li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit
	to Anonymous</li>
	<li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to
	Jeonghoon Shin</li>
	<li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih
	Matar</li>
	<li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit
	to Nick Wellnhofer</li>
	<li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in
	Service Workers. Credit to Ben Kelly</li>
	<li>[613626] Medium CVE-2016-5133: Origin confusion in proxy
	authentication. Credit to Patch Eudor</li>
	<li>[593759] Medium CVE-2016-5134: URL leakage via PAC script.
	Credit to Paul Stone</li>
	<li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
	Credit to kingxwy</li>
	<li>[625393] Medium CVE-2016-5136: Use after free in extensions.
	Credit to Rob Wu</li>
	<li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and
	CSP. Credit to Xiaoyin Liu</li>
	<li>[629852] CVE-2016-1705: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1705</cvename>
	<cvename>CVE-2016-1706</cvename>
	<cvename>CVE-2016-1708</cvename>
	<cvename>CVE-2016-1709</cvename>
	<cvename>CVE-2016-1710</cvename>
	<cvename>CVE-2016-1711</cvename>
	<cvename>CVE-2016-5127</cvename>
	<cvename>CVE-2016-5128</cvename>
	<cvename>CVE-2016-5129</cvename>
	<cvename>CVE-2016-5130</cvename>
	<cvename>CVE-2016-5131</cvename>
	<cvename>CVE-2016-5132</cvename>
	<cvename>CVE-2016-5133</cvename>
	<cvename>CVE-2016-5134</cvename>
	<cvename>CVE-2016-5135</cvename>
	<cvename>CVE-2016-5136</cvename>
	<cvename>CVE-2016-5137</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2016-07-20</discovery>
	<entry>2016-07-22</entry>
	</dates>
	</vuln>

	<vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317">
	<topic>krb5 -- KDC denial of service vulnerability</topic>
	<affects>
	<package>
	<name>krb5-113</name>
	<range><lt>1.13.6</lt></range>
	</package>
	<package>
	<name>krb5-114</name>
	<range><lt>1.14.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Major changes in krb5 1.14.3 and krb5 1.13.6:</p>
	<blockquote cite="http://web.mit.edu/kerberos/krb5-1.14/">
	<p>Fix a rare KDC denial of service vulnerability when anonymous
	client principals are restricted to obtaining TGTs only
	[CVE-2016-3120] .</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3120</cvename>
	<url>http://web.mit.edu/kerberos/krb5-1.14/</url>
	</references>
	<dates>
	<discovery>2016-07-20</discovery>
	<entry>2016-07-21</entry>
	<modified>2016-07-26</modified>
	</dates>
	</vuln>

	<vuln vid="72f71e26-4f69-11e6-ac37-ac9e174be3af">
	<topic>Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations)</topic>
	<affects>
	<package>
	<name>apache-openoffice</name>
	<range><lt>4.1.2_8</lt></range>
	</package>
	<package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1753426,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache OpenOffice Project reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2016-1513.html">
	<p>An OpenDocument Presentation .ODP or Presentation Template
	.OTP file can contain invalid presentation elements that lead
	to memory corruption when the document is loaded in Apache
	OpenOffice Impress. The defect may cause the document to appear
	as corrupted and OpenOffice may crash in a recovery-stuck mode
	requiring manual intervention. A crafted exploitation of the
	defect can allow an attacker to cause denial of service
	(memory corruption and application crash) and possible
	execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1513</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
	</references>
	<dates>
	<discovery>2016-07-17</discovery>
	<entry>2016-07-21</entry>
	</dates>
	</vuln>

	<vuln vid="ca5cb202-4f51-11e6-b2ec-b499baebfeaf">
	<topic>MySQL -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><le>5.5.49</le></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><le>10.0.25</le></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><le>10.1.14</le></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><le>5.5.49</le></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.30</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.12_1</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><le>5.5.49</le></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><le>5.6.30</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL">
	<p>The quarterly Critical Patch Update contains 22 new security fixes for
	Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL</url>
	<cvename>CVE-2016-3477</cvename>
	<cvename>CVE-2016-3440</cvename>
	<cvename>CVE-2016-2105</cvename>
	<cvename>CVE-2016-3471</cvename>
	<cvename>CVE-2016-3486</cvename>
	<cvename>CVE-2016-3501</cvename>
	<cvename>CVE-2016-3518</cvename>
	<cvename>CVE-2016-3521</cvename>
	<cvename>CVE-2016-3588</cvename>
	<cvename>CVE-2016-3615</cvename>
	<cvename>CVE-2016-3614</cvename>
	<cvename>CVE-2016-5436</cvename>
	<cvename>CVE-2016-3459</cvename>
	<cvename>CVE-2016-5437</cvename>
	<cvename>CVE-2016-3424</cvename>
	<cvename>CVE-2016-5439</cvename>
	<cvename>CVE-2016-5440</cvename>
	<cvename>CVE-2016-5441</cvename>
	<cvename>CVE-2016-5442</cvename>
	<cvename>CVE-2016-5443</cvename>
	<cvename>CVE-2016-5444</cvename>
	<cvename>CVE-2016-3452</cvename>
	</references>
	<dates>
	<discovery>2016-07-20</discovery>
	<entry>2016-07-21</entry>
	<modified>2016-08-08</modified>
	</dates>
	</vuln>

	<vuln vid="3caf4e6c-4cef-11e6-a15f-00248c0c745d">
	<topic>typo3 -- Missing access check in Extbase</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><lt>7.6.8</lt></range>
	</package>
	<package>
	<name>typo3-lts</name>
	<range><lt>6.2.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TYPO3 reports:</p>
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/">
	<p>Extbase request handling fails to implement a proper access check for
	requested controller/ action combinations, which makes it possible for an
	attacker to execute arbitrary Extbase actions by crafting a special request. To
	successfully exploit this vulnerability, an attacker must have access to at
	least one Extbase plugin or module action in a TYPO3 installation. The missing
	access check inevitably leads to information disclosure or remote code
	execution, depending on the action that an attacker is able to execute.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5091</cvename>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/</url>
	<url>https://wiki.typo3.org/TYPO3_CMS_7.6.8</url>
	<url>https://wiki.typo3.org/TYPO3_CMS_6.2.24</url>
	</references>
	<dates>
	<discovery>2016-05-24</discovery>
	<entry>2016-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="cf0b5668-4d1b-11e6-b2ec-b499baebfeaf">
	<cancelled/>
	</vuln>

	<vuln vid="00cb1469-4afc-11e6-97ea-002590263bf5">
	<topic>atutor -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>atutor</name>
	<range><lt>2.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ATutor reports:</p>
	<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2">
	<p>Security Fixes: Added a new layer of security over all php
	superglobals, fixed several XSS, CSRF, and SQL injection
	vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2</url>
	</references>
	<dates>
	<discovery>2016-07-01</discovery>
	<entry>2016-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="ffa8ca79-4afb-11e6-97ea-002590263bf5">
	<topic>atutor -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>atutor</name>
	<range><lt>2.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ATutor reports:</p>
	<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1">
	<p>Security Fixes: A number of minor XSS vulnerabilities discovered in
	the previous version of ATutor have been corrected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1</url>
	</references>
	<dates>
	<discovery>2016-01-30</discovery>
	<entry>2016-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="a522d6ac-4aed-11e6-97ea-002590263bf5">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.632</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-25.htmL">
	<p>These updates resolve a race condition vulnerability that could
	lead to information disclosure (CVE-2016-4247).</p>
	<p>These updates resolve type confusion vulnerabilities that could
	lead to code execution (CVE-2016-4223, CVE-2016-4224,
	CVE-2016-4225).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222,
	CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
	CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).</p>
	<p>These updates resolve a heap buffer overflow vulnerability that
	could lead to code execution (CVE-2016-4249).</p>
	<p>These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,
	CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183,
	CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
	CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,
	CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221,
	CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236,
	CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
	CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
	CVE-2016-4245, CVE-2016-4246).</p>
	<p>These updates resolve a memory leak vulnerability (CVE-2016-4232).
	</p>
	<p>These updates resolve stack corruption vulnerabilities that could
	lead to code execution (CVE-2016-4176, CVE-2016-4177).</p>
	<p>These updates resolve a security bypass vulnerability that could
	lead to information disclosure (CVE-2016-4178).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4172</cvename>
	<cvename>CVE-2016-4173</cvename>
	<cvename>CVE-2016-4174</cvename>
	<cvename>CVE-2016-4175</cvename>
	<cvename>CVE-2016-4176</cvename>
	<cvename>CVE-2016-4177</cvename>
	<cvename>CVE-2016-4178</cvename>
	<cvename>CVE-2016-4179</cvename>
	<cvename>CVE-2016-4180</cvename>
	<cvename>CVE-2016-4181</cvename>
	<cvename>CVE-2016-4182</cvename>
	<cvename>CVE-2016-4183</cvename>
	<cvename>CVE-2016-4184</cvename>
	<cvename>CVE-2016-4185</cvename>
	<cvename>CVE-2016-4186</cvename>
	<cvename>CVE-2016-4187</cvename>
	<cvename>CVE-2016-4188</cvename>
	<cvename>CVE-2016-4189</cvename>
	<cvename>CVE-2016-4190</cvename>
	<cvename>CVE-2016-4217</cvename>
	<cvename>CVE-2016-4218</cvename>
	<cvename>CVE-2016-4219</cvename>
	<cvename>CVE-2016-4220</cvename>
	<cvename>CVE-2016-4221</cvename>
	<cvename>CVE-2016-4222</cvename>
	<cvename>CVE-2016-4223</cvename>
	<cvename>CVE-2016-4224</cvename>
	<cvename>CVE-2016-4225</cvename>
	<cvename>CVE-2016-4226</cvename>
	<cvename>CVE-2016-4227</cvename>
	<cvename>CVE-2016-4228</cvename>
	<cvename>CVE-2016-4229</cvename>
	<cvename>CVE-2016-4230</cvename>
	<cvename>CVE-2016-4231</cvename>
	<cvename>CVE-2016-4232</cvename>
	<cvename>CVE-2016-4233</cvename>
	<cvename>CVE-2016-4234</cvename>
	<cvename>CVE-2016-4235</cvename>
	<cvename>CVE-2016-4236</cvename>
	<cvename>CVE-2016-4237</cvename>
	<cvename>CVE-2016-4238</cvename>
	<cvename>CVE-2016-4239</cvename>
	<cvename>CVE-2016-4240</cvename>
	<cvename>CVE-2016-4241</cvename>
	<cvename>CVE-2016-4242</cvename>
	<cvename>CVE-2016-4243</cvename>
	<cvename>CVE-2016-4244</cvename>
	<cvename>CVE-2016-4245</cvename>
	<cvename>CVE-2016-4246</cvename>
	<cvename>CVE-2016-4247</cvename>
	<cvename>CVE-2016-4248</cvename>
	<cvename>CVE-2016-4249</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-25.html</url>
	</references>
	<dates>
	<discovery>2016-07-12</discovery>
	<entry>2016-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="61b8c359-4aab-11e6-a7bd-14dae9d210b8">
	<cancelled superseded="cbceeb49-3bc7-11e6-8e82-002590263bf5"/>
	</vuln>

	<vuln vid="3159cd70-4aaa-11e6-a7bd-14dae9d210b8">
	<topic>libreoffice -- use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>libreoffice</name>
	<range><lt>5.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos reports:</p>
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0126/">
	<p>An exploitable Use After Free vulnerability exists in the
	RTF parser LibreOffice. A specially crafted file can cause a use after
	free resulting in a possible arbitrary code execution. To exploit the
	vulnerability a malicious file needs to be opened by the user via
	vulnerable application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.talosintelligence.com/reports/TALOS-2016-0126/</url>
	<url>http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/</url>
	<cvename>CVE-2016-4324</cvename>
	</references>
	<dates>
	<discovery>2016-06-27</discovery>
	<entry>2016-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="c17fe91d-4aa6-11e6-a7bd-14dae9d210b8">
	<cancelled/>
	</vuln>

	<vuln vid="0ab66088-4aa5-11e6-a7bd-14dae9d210b8">
	<topic>tiff -- buffer overflow</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><lt>4.0.6_2</lt></range>
	</package>
	<package>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_2</lt></range>
	</package>
	<package>
	<name>linux-f10-tiff</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mathias Svensson reports:</p>
	<blockquote cite="https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2">
	<p>potential buffer write overrun in PixarLogDecode() on
	corrupted/unexpected images</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2</url>
	<cvename>CVE-2016-5314</cvename>
	<cvename>CVE-2016-5320</cvename>
	<cvename>CVE-2016-5875</cvename>
	</references>
	<dates>
	<discovery>2016-06-28</discovery>
	<entry>2016-07-15</entry>
	<modified>2016-09-06</modified>
	</dates>
	</vuln>

	<vuln vid="42ecf370-4aa4-11e6-a7bd-14dae9d210b8">
	<cancelled/>
	</vuln>

	<vuln vid="d706a3a3-4a7c-11e6-97f7-5453ed2e2b49">
	<topic>p7zip -- out-of-bounds read vulnerability</topic>
	<affects>
	<package>
	<name>p7zip</name>
	<range><lt>15.14_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cisco Talos reports:</p>
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0094/">
	<p>An out-of-bounds read vulnerability exists in the way 7-Zip
	handles Universal Disk Format (UDF) files.</p>
	<p>Central to 7-Zip’s processing of UDF files is the
	CInArchive::ReadFileItem method. Because volumes can have more than
	one partition map, their objects are kept in an object vector. To
	start looking for an item, this method tries to reference the proper
	object using the partition map’s object vector and the "PartitionRef"
	field from the Long Allocation Descriptor. Lack of checking whether
	the "PartitionRef" field is bigger than the available amount of
	partition map objects causes a read out-of-bounds and can lead, in
	some circumstances, to arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2335</cvename>
	<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
	</references>
	<dates>
	<discovery>2016-05-11</discovery>
	<entry>2016-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49">
	<topic>p7zip -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>p7zip</name>
	<range><lt>15.14_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cisco Talos reports:</p>
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0093/">
	<p>An exploitable heap overflow vulnerability exists in the
	NArchive::NHfs::CHandler::ExtractZlibFile method functionality of
	7zip that can lead to arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2334</cvename>
	<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
	</references>
	<dates>
	<discovery>2016-05-11</discovery>
	<entry>2016-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="4729c849-4897-11e6-b704-000c292e4fd8">
	<topic>samba -- client side SMB2/3 required signing can be downgraded</topic>
	<affects>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
	</package>
	<package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><lt>4.2.14</lt></range>
	</package>
	<package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.11</lt></range>
	</package>
	<package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba team reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2016-2119.html">
	<p>A man in the middle attack can disable client signing over
	SMB2/3, even if enforced by configuration parameters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2119</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2119.html</url>
	</references>
	<dates>
	<discovery>2016-07-07</discovery>
	<entry>2016-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="3fcd52b2-4510-11e6-a15f-00248c0c745d">
	<topic>ruby-saml -- XML signature wrapping attack</topic>
	<affects>
	<package>
	<name>rubygem-ruby-saml</name>
	<range><lt>1.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RubySec reports:</p>
	<blockquote cite="http://rubysec.com/advisories/CVE-2016-5697/">
	<p>ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack
	in the specific scenario where there was a signature that referenced at the same
	time 2 elements (but past the scheme validator process since 1 of the element was
	inside the encrypted assertion).</p>
	<p>ruby-saml users must update to 1.3.0, which implements 3 extra validations to
	mitigate this kind of attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5697</cvename>
	<url>http://rubysec.com/advisories/CVE-2016-5697/</url>
	<url>https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995</url>
	</references>
	<dates>
	<discovery>2016-06-24</discovery>
	<entry>2016-07-08</entry>
	</dates>
	</vuln>

	<vuln vid="7d64d00c-43e3-11e6-ab34-002590263bf5">
	<topic>quassel -- remote denial of service</topic>
	<affects>
	<package>
	<name>quassel</name>
	<range><lt>0.12.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414">
	<p>The onReadyRead function in core/coreauthhandler.cpp in Quassel
	before 0.12.4 allows remote attackers to cause a denial of service
	(NULL pointer dereference and crash) via invalid handshake data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4414</cvename>
	<url>http://quassel-irc.org/node/129</url>
	<url>https://github.com/quassel/quassel/commit/e678873</url>
	<url>http://www.openwall.com/lists/oss-security/2016/04/30/2</url>
	<url>http://www.openwall.com/lists/oss-security/2016/04/30/4</url>
	</references>
	<dates>
	<discovery>2016-04-24</discovery>
	<entry>2016-07-07</entry>
	</dates>
	</vuln>

	<vuln vid="e9d1e040-42c9-11e6-9608-20cf30e32f6d">
	<topic>apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><ge>2.4.18</ge><lt>2.4.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Software Foundation reports:</p>
	<blockquote cite="INSERT URL HERE">
	<p>The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509
	client certificate correctly when experimental module for the HTTP/2
	protocol is used to access a resource.</p>
	<p>The net result is that a resource that should require a valid client
	certificate in order to get access can be accessed without that credential.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4979</cvename>
	<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283</url>
	</references>
	<dates>
	<discovery>2016-07-01</discovery>
	<entry>2016-07-05</entry>
	</dates>
	</vuln>

	<vuln vid="e800cd4b-4212-11e6-942d-bc5ff45d0f28">
	<topic>xen-tools -- Unrestricted qemu logging</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-180.html">
	<p>When the libxl toolstack launches qemu for HVM guests, it pipes the
	output of stderr to a file in /var/log/xen. This output is not
	rate-limited in any way. The guest can easily cause qemu to print
	messages to stderr, causing this file to become arbitrarily large.
	</p>
	<p>The disk containing the logfile can be exhausted, possibly causing a
	denial-of-service (DoS).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3672</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-180.html</url>
	</references>
	<dates>
	<discovery>2016-05-23</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="e6ce6f50-4212-11e6-942d-bc5ff45d0f28">
	<topic>xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-179.html">
	<p>Qemu VGA module allows banked access to video memory using the
	window at 0xa00000 and it supports different access modes with
	different address calculations.</p>
	<p>Qemu VGA module allows guest to edit certain registers in 'vbe'
	and 'vga' modes.</p>
	<p>A privileged guest user could use CVE-2016-3710 to exceed the bank
	address window and write beyond the said memory area, potentially
	leading to arbitrary code execution with privileges of the Qemu
	process. If the system is not using stubdomains, this will be in
	domain 0.</p>
	<p>A privileged guest user could use CVE-2016-3712 to cause potential
	integer overflow or OOB read access issues in Qemu, resulting in a DoS
	of the guest itself. More dangerous effect, such as data leakage or
	code execution, are not known but cannot be ruled out.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3710</cvename>
	<cvename>CVE-2016-3712</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-179.html</url>
	</references>
	<dates>
	<discovery>2016-05-09</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="e589ae90-4212-11e6-942d-bc5ff45d0f28">
	<topic>xen-tools -- Unsanitised driver domain input in libxl device handling</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-178.html">
	<p>libxl's device-handling code freely uses and trusts information
	from the backend directories in xenstore.</p>
	<p>A malicious driver domain can deny service to management tools.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4963</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-178.html</url>
	</references>
	<dates>
	<discovery>2016-06-02</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="e43b210a-4212-11e6-942d-bc5ff45d0f28">
	<topic>xen-kernel -- x86 software guest page walk PS bit handling flaw</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-176.html">
	<p>The Page Size (PS) page table entry bit exists at all page table
	levels other than L1. Its meaning is reserved in L4, and
	conditionally reserved in L3 and L2 (depending on hardware
	capabilities). The software page table walker in the hypervisor,
	however, so far ignored that bit in L4 and (on respective hardware)
	L3 entries, resulting in pages to be treated as page tables which
	the guest OS may not have designated as such. If the page in
	question is writable by an unprivileged user, then that user will
	be able to map arbitrary guest memory.</p>
	<p>On vulnerable OSes, guest user mode code may be able to establish
	mappings of arbitrary memory inside the guest, allowing it to
	elevate its privileges inside the guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4480</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-176.html</url>
	</references>
	<dates>
	<discovery>2016-05-17</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="e2fca11b-4212-11e6-942d-bc5ff45d0f28">
	<topic>xen-tools -- Unsanitised guest input in libxl device handling code</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.7.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-175.html">
	<p>Various parts of libxl device-handling code inappropriately use
	information from (partially) guest controlled areas of xenstore.</p>
	<p>A malicious guest administrator can cause denial of service by
	resource exhaustion.</p>
	<p>A malicious guest administrator can confuse and/or deny service to
	management facilities.</p>
	<p>A malicious guest administrator of a guest configured with channel
	devices may be able to escalate their privilege to that of the
	backend domain (i.e., normally, to that of the host).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4962</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-175.html</url>
	</references>
	<dates>
	<discovery>2016-06-02</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="d51ced72-4212-11e6-942d-bc5ff45d0f28">
	<topic>xen-kernel -- x86 shadow pagetables: address width overflow</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>3.4</ge><lt>4.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-173.html">
	<p>In the x86 shadow pagetable code, the guest frame number of a
	superpage mapping is stored in a 32-bit field. If a shadowed guest
	can cause a superpage mapping of a guest-physical address at or
	above 2^44 to be shadowed, the top bits of the address will be lost,
	causing an assertion failure or NULL dereference later on, in code
	that removes the shadow.</p>
	<p>A HVM guest using shadow pagetables can cause the host to crash.
	</p>
	<p>A PV guest using shadow pagetables (i.e. being migrated) with PV
	superpages enabled (which is not the default) can crash the host, or
	corrupt hypervisor memory, and so a privilege escalation cannot be
	ruled out.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3960</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-173.html</url>
	</references>
	<dates>
	<discovery>2016-04-18</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="313e9557-41e8-11e6-ab34-002590263bf5">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html">
	<p>The following vulnerabilities have been fixed:</p>
	<ul>
	<li><p>wnpa-sec-2016-29</p>
	<p>The SPOOLS dissector could go into an infinite loop. Discovered
	by the CESG.</p></li>
	<li><p>wnpa-sec-2016-30</p>
	<p>The IEEE 802.11 dissector could crash. (Bug 11585)</p></li>
	<li><p>wnpa-sec-2016-31</p>
	<p>The IEEE 802.11 dissector could crash. Discovered by Mateusz
	Jurczyk. (Bug 12175)</p></li>
	<li><p>wnpa-sec-2016-32</p>
	<p>The UMTS FP dissector could crash. (Bug 12191)</p></li>
	<li><p>wnpa-sec-2016-33</p>
	<p>Some USB dissectors could crash. Discovered by Mateusz
	Jurczyk. (Bug 12356)</p></li>
	<li><p>wnpa-sec-2016-34</p>
	<p>The Toshiba file parser could crash. Discovered by iDefense
	Labs. (Bug 12394)</p></li>
	<li><p>wnpa-sec-2016-35</p>
	<p>The CoSine file parser could crash. Discovered by iDefense
	Labs. (Bug 12395)</p></li>
	<li><p>wnpa-sec-2016-36</p>
	<p>The NetScreen file parser could crash. Discovered by iDefense
	Labs. (Bug 12396)</p></li>
	<li><p>wnpa-sec-2016-37</p>
	<p>The Ethernet dissector could crash. (Bug 12440)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5350</cvename>
	<cvename>CVE-2016-5351</cvename>
	<cvename>CVE-2016-5352</cvename>
	<cvename>CVE-2016-5353</cvename>
	<cvename>CVE-2016-5354</cvename>
	<cvename>CVE-2016-5355</cvename>
	<cvename>CVE-2016-5356</cvename>
	<cvename>CVE-2016-5357</cvename>
	<cvename>CVE-2016-5358</cvename>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/06/09/4</url>
	</references>
	<dates>
	<discovery>2016-06-07</discovery>
	<entry>2016-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="8656cf5f-4170-11e6-8dfe-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle28</name>
	<range><lt>2.8.12</lt></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.6</lt></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-16-0013: Users are able to change profile fields that
	were locked by the administrator.</p></li>
	<li><p>MSA-16-0015: Information disclosure of hidden forum names
	and sub-names.</p></li>
	<li><p>MSA-16-0016: User can view badges of other users without
	proper permissions.</p></li>
	<li><p>MSA-16-0017: Course idnumber not protected from teacher
	restore.</p></li>
	<li><p>MSA-16-0018: CSRF in script marking forum posts as read.</p>
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3729</cvename>
	<cvename>CVE-2016-3731</cvename>
	<cvename>CVE-2016-3732</cvename>
	<cvename>CVE-2016-3733</cvename>
	<cvename>CVE-2016-3734</cvename>
	<url>https://moodle.org/security/</url>
	</references>
	<dates>
	<discovery>2016-05-18</discovery>
	<entry>2016-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="ad9b77f6-4163-11e6-b05b-14dae9d210b8">
	<topic>icingaweb2 -- remote code execution</topic>
	<affects>
	<package>
	<name>icingaweb2</name>
	<range><lt>2.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Eric Lippmann reports:</p>
	<blockquote cite="https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/">
	<p>Possibility of remote code execution via the remote command
	transport.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/</url>
	</references>
	<dates>
	<discovery>2016-06-23</discovery>
	<entry>2016-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="a5c204b5-4153-11e6-8dfe-002590263bf5">
	<topic>hive -- authorization logic vulnerability</topic>
	<affects>
	<package>
	<name>hive</name>
	<range><lt>2.0.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sushanth Sowmyan reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E">
	<p>Some partition-level operations exist that do not explicitly also
	authorize privileges of the parent table. This can lead to issues when
	the parent table would have denied the operation, but no denial occurs
	because the partition-level privilege is not checked by the
	authorization framework, which defines authorization entities only
	from the table level upwards.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7521</cvename>
	<url>http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E</url>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="546deeea-3fc6-11e6-a671-60a44ce6887b">
	<topic>SQLite3 -- Tempdir Selection Vulnerability</topic>
	<affects>
	<package>
	<name>sqlite3</name>
	<range><lt>3.13.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>KoreLogic security reports:</p>
	<blockquote cite="https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt">
	<p>Affected versions of SQLite reject potential tempdir locations if
	they are not readable, falling back to '.'. Thus, SQLite will favor
	e.g. using cwd for tempfiles on such a system, even if cwd is an
	unsafe location. Notably, SQLite also checks the permissions of
	'.', but ignores the results of that check.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6153</cvename>
	<freebsdpr>ports/209827</freebsdpr>
	<url>https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt</url>
	<url>http://openwall.com/lists/oss-security/2016/07/01/2</url>
	<url>http://www.sqlite.org/cgi/src/info/67985761aa93fb61</url>
	<url>http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3</url>
	<url>http://www.sqlite.org/cgi/src/info/614bb709d34e1148</url>
	</references>
	<dates>
	<discovery>2016-07-01</discovery>
	<entry>2016-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="8d5368ef-40fe-11e6-b2ec-b499baebfeaf">
	<topic>Python -- smtplib StartTLS stripping vulnerability</topic>
	<affects>
	<package>
	<name>python27</name>
	<range><lt>2.7.12</lt></range>
	</package>
	<package>
	<name>python33</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>python34</name>
	<range><lt>3.4.5</lt></range>
	</package>
	<package>
	<name>python35</name>
	<range><lt>3.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Red Hat reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772">
	<p>A vulnerability in smtplib allowing MITM attacker to perform a
	startTLS stripping attack. smtplib does not seem to raise an exception
	when the remote end (smtp server) is capable of negotiating starttls but
	fails to respond with 220 (ok) to an explicit call of SMTP.starttls().
	This may allow a malicious MITM to perform a startTLS stripping attack
	if the client code does not explicitly check the response code for startTLS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772</url>
	<cvename>CVE-2016-0772</cvename>
	</references>
	<dates>
	<discovery>2016-06-14</discovery>
	<entry>2016-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="e7028e1d-3f9b-11e6-81f9-6805ca0b3d42">
	<topic>phpMyAdmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.6.0</ge><lt>4.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Please reference CVE/URL list for details</p>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-17/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-18/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-19/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-20/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-21/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-22/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-23/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-24/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-25/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-26/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-27/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-28/</url>
	<cvename>CVE-2016-5701</cvename>
	<cvename>CVE-2016-5702</cvename>
	<cvename>CVE-2016-5703</cvename>
	<cvename>CVE-2016-5704</cvename>
	<cvename>CVE-2016-5705</cvename>
	<cvename>CVE-2016-5706</cvename>
	<cvename>CVE-2016-5730</cvename>
	<cvename>CVE-2016-5731</cvename>
	<cvename>CVE-2016-5732</cvename>
	<cvename>CVE-2016-5733</cvename>
	<cvename>CVE-2016-5734</cvename>
	<cvename>CVE-2016-5739</cvename>
	</references>
	<dates>
	<discovery>2016-06-23</discovery>
	<entry>2016-07-01</entry>
	</dates>
	</vuln>

	<vuln vid="f1c219ba-3f14-11e6-b3c8-14dae9d210b8">
	<topic>haproxy -- denial of service</topic>
	<affects>
	<package>
	<name>haproxy</name>
	<range><ge>1.6.0</ge><lt>1.6.5_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>HAproxy reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/06/09/5">
	<p>HAproxy 1.6.x before 1.6.6, when a deny comes from a
	reqdeny rule, allows remote attackers to cause a denial of service
	(uninitialized memory access and crash) or possibly have unspecified
	other impact via unknown vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2016/06/09/5</url>
	<cvename>CVE-2016-5360</cvename>
	</references>
	<dates>
	<discovery>2016-06-09</discovery>
	<entry>2016-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="093584f2-3f14-11e6-b3c8-14dae9d210b8">
	<topic>libtorrent-rasterbar -- denial of service</topic>
	<affects>
	<package>
	<name>libtorrent-rasterbar</name>
	<range><lt>1.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Brandon Perry reports:</p>
	<blockquote cite="https://github.com/arvidn/libtorrent/issues/780">
	<p>The parse_chunk_header function in libtorrent before 1.1.1
	allows remote attackers to cause a denial of service (crash) via a
	crafted (1) HTTP response or possibly a (2) UPnP broadcast.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/arvidn/libtorrent/issues/780</url>
	<cvename>CVE-2016-5301</cvename>
	</references>
	<dates>
	<discovery>2016-06-03</discovery>
	<entry>2016-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="ff76f0e0-3f11-11e6-b3c8-14dae9d210b8">
	<topic>expat2 -- denial of service</topic>
	<affects>
	<package>
	<name>expat</name>
	<range><lt>2.1.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam Maris reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1344251">
	<p>It was found that original patch for issues CVE-2015-1283
	and CVE-2015-2716 used overflow checks that could be optimized out by
	some compilers applying certain optimization settings, which can cause
	the vulnerability to remain even after applying the patch.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1344251</url>
	<cvename>CVE-2016-4472</cvename>
	</references>
	<dates>
	<discovery>2016-06-09</discovery>
	<entry>2016-06-30</entry>
	<modified>2016-11-30</modified>
	</dates>
	</vuln>

	<vuln vid="875e4cf8-3f0e-11e6-b3c8-14dae9d210b8">
	<topic>dnsmasq -- denial of service</topic>
	<affects>
	<package>
	<name>dnsmasq</name>
	<range><lt>2.76,1</lt></range>
	</package>
	<package>
	<name>dnsmasq-devel</name>
	<range><lt>2.76.0test1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> reports:</p>
	<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html">
	<p>Dnsmasq before 2.76 allows remote servers to cause a denial
	of service (crash) via a reply with an empty DNS address that has an (1)
	A or (2) AAAA record defined locally.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/06/03/7</url>
	<cvename>CVE-2015-8899</cvename>
	</references>
	<dates>
	<discovery>2016-04-18</discovery>
	<entry>2016-06-30</entry>
	<modified>2016-06-30</modified>
	</dates>
	</vuln>

	<vuln vid="a61374fc-3a4d-11e6-a671-60a44ce6887b">
	<topic>Python -- HTTP Header Injection in Python urllib</topic>
	<affects>
	<package>
	<name>python27</name>
	<range><lt>2.7.10</lt></range>
	</package>
	<package>
	<name>python33</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>python34</name>
	<range><lt>3.4.4</lt></range>
	</package>
	<package>
	<name>python35</name>
	<range><lt>3.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Guido Vranken reports:</p>
	<blockquote cite="https://bugs.python.org/issue22928">
	<p>HTTP header injection in urrlib2/urllib/httplib/http.client with
	newlines in header values, where newlines have a semantic consequence of
	denoting the start of an additional header line.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.python.org/issue22928</url>
	<url>http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/06/14/7</url>
	<cvename>CVE-2016-5699</cvename>
	</references>
	<dates>
	<discovery>2014-11-24</discovery>
	<entry>2016-06-30</entry>
	<modified>2016-07-04</modified>
	</dates>
	</vuln>

	<vuln vid="0ca24682-3f03-11e6-b3c8-14dae9d210b8">
	<topic>openssl -- denial of service</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2_14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177">
	<p>OpenSSL through 1.0.2h incorrectly uses pointer arithmetic
	for heap-buffer boundary checks, which might allow remote attackers to
	cause a denial of service (integer overflow and application crash) or
	possibly have unspecified other impact by leveraging unexpected malloc
	behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177</url>
	<url>ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705</url>
	<url>https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/</url>
	<cvename>CVE-2016-2177</cvename>
	</references>
	<dates>
	<discovery>2016-06-01</discovery>
	<entry>2016-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="cbceeb49-3bc7-11e6-8e82-002590263bf5">
	<topic>Apache Commons FileUpload -- denial of service (DoS) vulnerability</topic>
	<affects>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.70</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.36</lt></range>
	</package>
	<package>
	<name>apache-struts</name>
	<range><lt>2.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Thomas reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E">
	<p>CVE-2016-3092 is a denial of service vulnerability that has been
	corrected in the Apache Commons FileUpload component. It occurred
	when the length of the multipart boundary was just below the size of
	the buffer (4096 bytes) used to read the uploaded file. This caused
	the file upload process to take several orders of magnitude longer
	than if the boundary length was the typical tens of bytes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3092</cvename>
	<freebsdpr>ports/209669</freebsdpr>
	<url>http://tomcat.apache.org/security-7.html</url>
	<url>http://tomcat.apache.org/security-8.html</url>
	<url>http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E</url>
	<url>http://jvn.jp/en/jp/JVN89379547/index.html</url>
	</references>
	<dates>
	<discovery>2016-06-20</discovery>
	<entry>2016-06-26</entry>
	<modified>2017-08-10</modified>
	</dates>
	</vuln>

	<vuln vid="bfcc23b6-3b27-11e6-8e82-002590263bf5">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.5.3,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam Silverstein reports:</p>
	<blockquote cite="https://wordpress.org/news/2016/06/wordpress-4-5-3/">
	<p>WordPress 4.5.3 is now available. This is a security release for
	all previous versions and we strongly encourage you to update your
	sites immediately.</p>
	<p>WordPress versions 4.5.2 and earlier are affected by several
	security issues: redirect bypass in the customizer, reported by
	Yassine Aboukir; two different XSS problems via attachment names,
	reported by Jouko Pynnönenand Divyesh Prajapati; revision history
	information disclosure, reported independently by John Blackbourn
	from the WordPress security team and by Dan Moen from the Wordfence
	Research Team; oEmbed denial of service reported by Jennifer Dodd
	from Automattic; unauthorized category removal from a post, reported
	by David Herrera from Alley Interactive; password change via stolen
	cookie, reported by Michael Adams from the WordPress security team;
	and some less secure sanitize_file_name edge cases reported by Peter
	Westwood of the WordPress security team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5832</cvename>
	<cvename>CVE-2016-5833</cvename>
	<cvename>CVE-2016-5834</cvename>
	<cvename>CVE-2016-5835</cvename>
	<cvename>CVE-2016-5836</cvename>
	<cvename>CVE-2016-5837</cvename>
	<cvename>CVE-2016-5838</cvename>
	<cvename>CVE-2016-5839</cvename>
	<freebsdpr>ports/210480</freebsdpr>
	<freebsdpr>ports/210581</freebsdpr>
	<url>https://wordpress.org/news/2016/06/wordpress-4-5-3/</url>
	<url>http://www.openwall.com/lists/oss-security/2016/06/23/9</url>
	</references>
	<dates>
	<discovery>2016-06-18</discovery>
	<entry>2016-06-25</entry>
	</dates>
	</vuln>

	<vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php55</name>
	<name>php55-gd</name>
	<name>php55-mbstring</name>
	<name>php55-wddx</name>
	<name>php55-zip</name>
	<range><lt>5.5.37</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-gd</name>
	<name>php56-mbstring</name>
	<name>php56-phar</name>
	<name>php56-wddx</name>
	<name>php56-zip</name>
	<range><lt>5.6.23</lt></range>
	</package>
	<package>
	<name>php70</name>
	<name>php70-gd</name>
	<name>php70-mbstring</name>
	<name>php70-phar</name>
	<name>php70-wddx</name>
	<name>php70-zip</name>
	<range><lt>7.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Group reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.5.37">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8874</cvename>
	<cvename>CVE-2016-5766</cvename>
	<cvename>CVE-2016-5767</cvename>
	<cvename>CVE-2016-5768</cvename>
	<cvename>CVE-2016-5769</cvename>
	<cvename>CVE-2016-5770</cvename>
	<cvename>CVE-2016-5771</cvename>
	<cvename>CVE-2016-5772</cvename>
	<cvename>CVE-2016-5773</cvename>
	<freebsdpr>ports/210491</freebsdpr>
	<freebsdpr>ports/210502</freebsdpr>
	<url>http://php.net/ChangeLog-5.php#5.5.37</url>
	<url>http://php.net/ChangeLog-5.php#5.6.23</url>
	<url>http://php.net/ChangeLog-7.php#7.0.8</url>
	</references>
	<dates>
	<discovery>2016-06-23</discovery>
	<entry>2016-06-25</entry>
	</dates>
	</vuln>

	<vuln vid="4a0d9b53-395d-11e6-b3c8-14dae9d210b8">
	<topic>libarchive -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libarchive</name>
	<range><lt>3.2.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanno Bock and Cisco Talos report:</p>
	<blockquote cite="http://openwall.com/lists/oss-security/2016/06/23/6">
	<ul>
	<li><p>Out of bounds heap read in RAR parser</p></li>
	<li><p>Signed integer overflow in ISO parser</p></li>
	<li><p>TALOS-2016-0152 [CVE-2016-4300]: 7-Zip
	read_SubStreamsInfo Integer Overflow</p></li>
	<li><p>TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack
	Based Buffer Overflow</p></li>
	<li><p>TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel
	Heap Overflow</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://openwall.com/lists/oss-security/2016/06/23/6</url>
	<url>https://github.com/libarchive/libarchive/issues/521</url>
	<url>https://github.com/libarchive/libarchive/issues/717#event-697151157</url>
	<url>http://blog.talosintel.com/2016/06/the-poisoned-archives.html</url>
	<cvename>CVE-2015-8934</cvename>
	<cvename>CVE-2016-4300</cvename>
	<cvename>CVE-2016-4301</cvename>
	<cvename>CVE-2016-4302</cvename>
	</references>
	<dates>
	<discovery>2016-06-23</discovery>
	<entry>2016-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="22775cdd-395a-11e6-b3c8-14dae9d210b8">
	<topic>piwik -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><lt>2.16.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Piwik reports:</p>
	<blockquote cite="http://piwik.org/changelog/piwik-2-16-1/">
	<p>The Piwik Security team is grateful for the responsible
	disclosures by our security researchers: Egidio Romano (granted a
	critical security bounty), James Kettle and Paweł Bartunek (XSS) and
	Emanuel Bronshtein (limited XSS).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://piwik.org/changelog/piwik-2-16-1/</url>
	</references>
	<dates>
	<discovery>2016-04-11</discovery>
	<entry>2016-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="6df56c60-3738-11e6-a671-60a44ce6887b">
	<topic>wget -- HTTP to FTP redirection file name confusion vulnerability</topic>
	<affects>
	<package>
	<name>wget</name>
	<range><lt>1.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Giuseppe Scrivano reports:</p>
	<blockquote cite="http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html">
	<p>On a server redirect from HTTP to a FTP resource, wget would trust the
	HTTP server and uses the name in the redirected URL as the destination
	filename.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html</url>
	<cvename>CVE-2016-4971</cvename>
	</references>
	<dates>
	<discovery>2016-06-09</discovery>
	<entry>2016-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="1a2aa04f-3718-11e6-b3c8-14dae9d210b8">
	<topic>libxslt -- Denial of Service</topic>
	<affects>
	<package>
	<name>libxslt</name>
	<range><lt>1.1.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google reports:</p>
	<blockquote cite="http://seclists.org/bugtraq/2016/Jun/81">
	<ul>
	<li>[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt.
	Credit to Nicolas Gregoire.</li>
	<li>[583171] Medium CVE-2016-1684: Integer overflow in libxslt.
	Credit to Nicolas Gregoire.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html</url>
	<cvename>CVE-2016-1683</cvename>
	<cvename>CVE-2016-1684</cvename>
	</references>
	<dates>
	<discovery>2016-05-25</discovery>
	<entry>2016-06-20</entry>
	</dates>
	</vuln>

	<vuln vid="0e3dfdde-35c4-11e6-8e82-002590263bf5">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.626</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-18.html">
	<p>These updates resolve type confusion vulnerabilities that could
	lead to code execution (CVE-2016-4144, CVE-2016-4149).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,
	CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).</p>
	<p>These updates resolve heap buffer overflow vulnerabilities that
	could lead to code execution (CVE-2016-4135, CVE-2016-4136,
	CVE-2016-4138).</p>
	<p>These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
	CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129,
	CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133,
	CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,
	CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154,
	CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).</p>
	<p>These updates resolve a vulnerability in the directory search path
	used to find resources that could lead to code execution
	(CVE-2016-4140).</p>
	<p>These updates resolve a vulnerability that could be exploited to
	bypass the same-origin-policy and lead to information disclosure
	(CVE-2016-4139).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4122</cvename>
	<cvename>CVE-2016-4123</cvename>
	<cvename>CVE-2016-4124</cvename>
	<cvename>CVE-2016-4125</cvename>
	<cvename>CVE-2016-4127</cvename>
	<cvename>CVE-2016-4128</cvename>
	<cvename>CVE-2016-4129</cvename>
	<cvename>CVE-2016-4130</cvename>
	<cvename>CVE-2016-4131</cvename>
	<cvename>CVE-2016-4132</cvename>
	<cvename>CVE-2016-4133</cvename>
	<cvename>CVE-2016-4134</cvename>
	<cvename>CVE-2016-4135</cvename>
	<cvename>CVE-2016-4136</cvename>
	<cvename>CVE-2016-4137</cvename>
	<cvename>CVE-2016-4138</cvename>
	<cvename>CVE-2016-4139</cvename>
	<cvename>CVE-2016-4140</cvename>
	<cvename>CVE-2016-4141</cvename>
	<cvename>CVE-2016-4142</cvename>
	<cvename>CVE-2016-4143</cvename>
	<cvename>CVE-2016-4144</cvename>
	<cvename>CVE-2016-4145</cvename>
	<cvename>CVE-2016-4146</cvename>
	<cvename>CVE-2016-4147</cvename>
	<cvename>CVE-2016-4148</cvename>
	<cvename>CVE-2016-4149</cvename>
	<cvename>CVE-2016-4150</cvename>
	<cvename>CVE-2016-4151</cvename>
	<cvename>CVE-2016-4152</cvename>
	<cvename>CVE-2016-4153</cvename>
	<cvename>CVE-2016-4154</cvename>
	<cvename>CVE-2016-4155</cvename>
	<cvename>CVE-2016-4156</cvename>
	<cvename>CVE-2016-4166</cvename>
	<cvename>CVE-2016-4171</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-18.html</url>
	</references>
	<dates>
	<discovery>2016-06-16</discovery>
	<entry>2016-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="0c6b008d-35c4-11e6-8e82-002590263bf5">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.621</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-15.html">
	<p>These updates resolve type confusion vulnerabilities that could
	lead to code execution (CVE-2016-1105, CVE-2016-4117).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107,
	CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,
	CVE-2016-4110, CVE-2016-4121).</p>
	<p>These updates resolve a heap buffer overflow vulnerability that
	could lead to code execution (CVE-2016-1101).</p>
	<p>These updates resolve a buffer overflow vulnerability that could
	lead to code execution (CVE-2016-1103).</p>
	<p>These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099,
	CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,
	CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,
	CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161,
	CVE-2016-4162, CVE-2016-4163).</p>
	<p>These updates resolve a vulnerability in the directory search path
	used to find resources that could lead to code execution
	(CVE-2016-4116).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1096</cvename>
	<cvename>CVE-2016-1097</cvename>
	<cvename>CVE-2016-1098</cvename>
	<cvename>CVE-2016-1099</cvename>
	<cvename>CVE-2016-1100</cvename>
	<cvename>CVE-2016-1101</cvename>
	<cvename>CVE-2016-1102</cvename>
	<cvename>CVE-2016-1103</cvename>
	<cvename>CVE-2016-1104</cvename>
	<cvename>CVE-2016-1105</cvename>
	<cvename>CVE-2016-1106</cvename>
	<cvename>CVE-2016-1107</cvename>
	<cvename>CVE-2016-1108</cvename>
	<cvename>CVE-2016-1109</cvename>
	<cvename>CVE-2016-1110</cvename>
	<cvename>CVE-2016-4108</cvename>
	<cvename>CVE-2016-4109</cvename>
	<cvename>CVE-2016-4110</cvename>
	<cvename>CVE-2016-4111</cvename>
	<cvename>CVE-2016-4112</cvename>
	<cvename>CVE-2016-4113</cvename>
	<cvename>CVE-2016-4114</cvename>
	<cvename>CVE-2016-4115</cvename>
	<cvename>CVE-2016-4116</cvename>
	<cvename>CVE-2016-4117</cvename>
	<cvename>CVE-2016-4120</cvename>
	<cvename>CVE-2016-4121</cvename>
	<cvename>CVE-2016-4160</cvename>
	<cvename>CVE-2016-4161</cvename>
	<cvename>CVE-2016-4162</cvename>
	<cvename>CVE-2016-4163</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-15.html</url>
	</references>
	<dates>
	<discovery>2016-05-12</discovery>
	<entry>2016-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="07888b49-35c4-11e6-8e82-002590263bf5">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.616</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-10.html">
	<p>These updates harden a mitigation against JIT spraying attacks that
	could be used to bypass memory layout randomization mitigations
	(CVE-2016-1006).</p>
	<p>These updates resolve type confusion vulnerabilities that could
	lead to code execution (CVE-2016-1015, CVE-2016-1019).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016,
	CVE-2016-1017, CVE-2016-1031).</p>
	<p>These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021,
	CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025,
	CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,
	CVE-2016-1032, CVE-2016-1033).</p>
	<p>These updates resolve a stack overflow vulnerability that could
	lead to code execution (CVE-2016-1018).</p>
	<p>These updates resolve a security bypass vulnerability
	(CVE-2016-1030).</p>
	<p>These updates resolve a vulnerability in the directory search path
	used to find resources that could lead to code execution
	(CVE-2016-1014).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1006</cvename>
	<cvename>CVE-2016-1011</cvename>
	<cvename>CVE-2016-1012</cvename>
	<cvename>CVE-2016-1013</cvename>
	<cvename>CVE-2016-1014</cvename>
	<cvename>CVE-2016-1015</cvename>
	<cvename>CVE-2016-1016</cvename>
	<cvename>CVE-2016-1017</cvename>
	<cvename>CVE-2016-1018</cvename>
	<cvename>CVE-2016-1019</cvename>
	<cvename>CVE-2016-1020</cvename>
	<cvename>CVE-2016-1021</cvename>
	<cvename>CVE-2016-1022</cvename>
	<cvename>CVE-2016-1023</cvename>
	<cvename>CVE-2016-1024</cvename>
	<cvename>CVE-2016-1025</cvename>
	<cvename>CVE-2016-1026</cvename>
	<cvename>CVE-2016-1027</cvename>
	<cvename>CVE-2016-1028</cvename>
	<cvename>CVE-2016-1029</cvename>
	<cvename>CVE-2016-1030</cvename>
	<cvename>CVE-2016-1031</cvename>
	<cvename>CVE-2016-1032</cvename>
	<cvename>CVE-2016-1033</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-10.html</url>
	</references>
	<dates>
	<discovery>2016-04-07</discovery>
	<entry>2016-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="d59ebed4-34be-11e6-be25-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>51.0.2704.103</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html">
	<p>3 security fixes in this release, including:</p>
	<ul>
	<li>[620742] CVE-2016-1704: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1704</cvename>
	<url>https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html</url>
	</references>
	<dates>
	<discovery>2016-06-16</discovery>
	<entry>2016-06-17</entry>
	</dates>
	</vuln>

	<vuln vid="1d0f6852-33d8-11e6-a671-60a44ce6887b">
	<topic>Python -- Integer overflow in zipimport module</topic>
	<affects>
	<package>
	<name>python35</name>
	<range><lt>3.5.1_3</lt></range>
	</package>
	<package>
	<name>python34</name>
	<range><lt>3.4.4_3</lt></range>
	</package>
	<package>
	<name>python33</name>
	<range><lt>3.3.6_5</lt></range>
	</package>
	<package>
	<name>python27</name>
	<range><lt>2.7.11_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Python reports:</p>
	<blockquote cite="http://bugs.python.org/issue26171">
	<p>Possible integer overflow and heap corruption in
	zipimporter.get_data()</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bugs.python.org/issue26171</url>
	<cvename>CVE-2016-5636</cvename>
	</references>
	<dates>
	<discovery>2016-01-21</discovery>
	<entry>2016-06-17</entry>
	</dates>
	</vuln>

	<vuln vid="7932548e-3427-11e6-8e82-002590263bf5">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.44</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><lt>8.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2016-002">
	<ul>
	<li><p>Saving user accounts can sometimes grant the user all roles
	(User module - Drupal 7 - Moderately Critical)</p></li>
	<li><p>Views can allow unauthorized users to see Statistics
	information (Views module - Drupal 8 - Less Critical)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-6211</cvename>
	<cvename>CVE-2016-6212</cvename>
	<url>https://www.drupal.org/SA-CORE-2016-002</url>
	<url>http://www.openwall.com/lists/oss-security/2016/07/13/7</url>
	</references>
	<dates>
	<discovery>2016-06-15</discovery>
	<entry>2016-06-17</entry>
	<modified>2016-07-16</modified>
	</dates>
	</vuln>

	<vuln vid="ac0900df-31d0-11e6-8e82-002590263bf5">
	<topic>botan -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>botan110</name>
	<range><lt>1.10.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jack Lloyd reports:</p>
	<blockquote cite="https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html">
	<p>Botan 1.10.13 has been released backporting some side channel
	protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA
	decryption (CVE-2015-7827).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2849</cvename>
	<cvename>CVE-2015-7827</cvename>
	<url>https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html</url>
	</references>
	<dates>
	<discovery>2016-04-28</discovery>
	<entry>2016-06-14</entry>
	</dates>
	</vuln>

	<vuln vid="f771880c-31cf-11e6-8e82-002590263bf5">
	<topic>botan -- cryptographic vulnerability</topic>
	<affects>
	<package>
	<name>botan110</name>
	<range><lt>1.10.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9742">
	<p>The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x
	before 1.11.9 improperly uses a single random base, which makes it
	easier for remote attackers to defeat cryptographic protection
	mechanisms via a DH group.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9742</cvename>
	</references>
	<dates>
	<discovery>2014-04-11</discovery>
	<entry>2016-06-14</entry>
	</dates>
	</vuln>

	<vuln vid="6d402857-2fba-11e6-9f31-5404a68ad561">
	<topic>VLC -- Possibly remote code execution via crafted file</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>2.2.4,4</lt></range>
	</package>
	<package>
	<name>vlc-qt4</name>
	<range><lt>2.2.4,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The VLC project reports:</p>
	<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
	<p>Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5108</cvename>
	</references>
	<dates>
	<discovery>2016-05-25</discovery>
	<entry>2016-06-11</entry>
	</dates>
	</vuln>

	<vuln vid="97e86d10-2ea7-11e6-ae88-002590263bf5">
	<topic>roundcube -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>1.1.5_1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Roundcube reports:</p>
	<blockquote cite="https://github.com/roundcube/roundcubemail/wiki/Changelog">
	<p>Fix XSS issue in href attribute on area tag (#5240).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5103</cvename>
	<freebsdpr>ports/209841</freebsdpr>
	<url>https://github.com/roundcube/roundcubemail/issues/5240</url>
	<url>http://seclists.org/oss-sec/2016/q2/414</url>
	</references>
	<dates>
	<discovery>2016-05-06</discovery>
	<entry>2016-06-10</entry>
	</dates>
	</vuln>

	<vuln vid="6f0529e2-2e82-11e6-b2ec-b499baebfeaf">
	<topic>OpenSSL -- vulnerability in DSA signing</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2_13</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><lt>2.2.9</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
	</package>
	<package>
	<name>libressl-devel</name>
	<range><lt>2.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL team reports:</p>
	<blockquote cite="https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2">
	<p>Operations in the DSA signing algorithm should run in constant time
	in order to avoid side channel attacks. A flaw in the OpenSSL DSA
	implementation means that a non-constant time codepath is followed for
	certain operations. This has been demonstrated through a cache-timing
	attack to be sufficient for an attacker to recover the private DSA key.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2</url>
	<cvename>CVE-2016-2178</cvename>
	</references>
	<dates>
	<discovery>2016-06-09</discovery>
	<entry>2016-06-09</entry>
	<modified>2016-12-20</modified>
	</dates>
	</vuln>

	<vuln vid="c9c252f5-2def-11e6-ae88-002590263bf5">
	<topic>expat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>expat</name>
	<range><lt>2.1.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Pipping reports:</p>
	<blockquote cite="https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/">
	<p>CVE-2012-6702 -- Resolve troublesome internal call to srand that
	was introduced with Expat 2.1.0 when addressing CVE-2012-0876
	(issue #496)</p>
	<p>CVE-2016-5300 -- Use more entropy for hash initialization than the
	original fix to CVE-2012-0876.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-6702</cvename>
	<cvename>CVE-2016-5300</cvename>
	<freebsdpr>ports/210155</freebsdpr>
	<url>https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/</url>
	<url>http://www.openwall.com/lists/oss-security/2016/03/18/3</url>
	</references>
	<dates>
	<discovery>2016-03-18</discovery>
	<entry>2016-06-09</entry>
	<modified>2016-11-06</modified>
	</dates>
	</vuln>

	<vuln vid="d6bbf2d8-2cfc-11e6-800b-080027468580">
	<topic>iperf3 -- buffer overflow</topic>
	<affects>
	<package>
	<name>iperf3</name>
	<range><ge>3.1</ge><lt>3.1.3</lt></range>
	<range><ge>3.0</ge><lt>3.0.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ESnet reports:</p>
	<blockquote cite="https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc">
	<p>A malicious process can connect to an iperf3 server and,
	by sending a malformed message on the control channel,
	corrupt the server process's heap area. This can lead to a
	crash (and a denial of service), or theoretically a remote
	code execution as the user running the iperf3 server. A
	malicious iperf3 server could potentially mount a similar
	attack on an iperf3 client.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4303</cvename>
	<url>https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc</url>
	</references>
	<dates>
	<discovery>2016-06-08</discovery>
	<entry>2016-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="9c196cfd-2ccc-11e6-94b0-0011d823eebd">
	<topic>gnutls -- file overwrite by setuid programs</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><ge>3.4.12</ge><lt>3.4.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>gnutls.org reports:</p>
	<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-1">
	<p>Setuid programs using GnuTLS 3.4.12 could potentially allow an
	attacker to overwrite and corrupt arbitrary files in the
	filesystem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://gnutls.org/security.html#GNUTLS-SA-2016-1</url>
	</references>
	<dates>
	<discovery>2016-06-06</discovery>
	<entry>2016-06-07</entry>
	</dates>
	</vuln>

	<vuln vid="32166082-53fa-41fa-b081-207e7a989a0a">
	<topic>NSS -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nss</name>
	<range><lt>3.23</lt></range>
	</package>
	<package>
	<name>linux-c6-nss</name>
	<name>linux-c7-nss</name>
	<range><lt>3.21.3</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.44</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-61/">
	<p>Mozilla has updated the version of Network Security
	Services (NSS) library used in Firefox to NSS 3.23. This
	addresses four moderate rated networking security issues
	reported by Mozilla engineers Tyson Smith and Jed Davis.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2834</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-61/</url>
	<url>https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672</url>
	<url>https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a</url>
	<url>https://hg.mozilla.org/projects/nss/rev/5fde729fdbff</url>
	<url>https://hg.mozilla.org/projects/nss/rev/329932eb1700</url>
	</references>
	<dates>
	<discovery>2016-06-07</discovery>
	<entry>2016-06-07</entry>
	<modified>2016-11-23</modified>
	</dates>
	</vuln>

	<vuln vid="8065d37b-8e7c-4707-a608-1b0a2b8509c3">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>47.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.44</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>45.2.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.2.0,2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47">
	<p>MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 /
	rv:45.2)</p>
	<p>MFSA 2016-50 Buffer overflow parsing HTML5 fragments</p>
	<p>MFSA 2016-51 Use-after-free deleting tables from a
	contenteditable document</p>
	<p>MFSA 2016-52 Addressbar spoofing though the SELECT element</p>
	<p>MFSA 2016-54 Partial same-origin-policy through setting
	location.host through data URI</p>
	<p>MFSA 2016-56 Use-after-free when textures are used in WebGL
	operations after recycle pool destruction</p>
	<p>MFSA 2016-57 Incorrect icon displayed on permissions
	notifications</p>
	<p>MFSA 2016-58 Entering fullscreen and persistent pointerlock
	without user permission</p>
	<p>MFSA 2016-59 Information disclosure of disabled plugins
	through CSS pseudo-classes</p>
	<p>MFSA 2016-60 Java applets bypass CSP protections</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2815</cvename>
	<cvename>CVE-2016-2818</cvename>
	<cvename>CVE-2016-2819</cvename>
	<cvename>CVE-2016-2821</cvename>
	<cvename>CVE-2016-2822</cvename>
	<cvename>CVE-2016-2825</cvename>
	<cvename>CVE-2016-2828</cvename>
	<cvename>CVE-2016-2829</cvename>
	<cvename>CVE-2016-2831</cvename>
	<cvename>CVE-2016-2832</cvename>
	<cvename>CVE-2016-2833</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-49/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-50/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-51/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-52/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-54/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-56/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-57/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-58/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-59/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-60/</url>
	</references>
	<dates>
	<discovery>2016-06-07</discovery>
	<entry>2016-06-07</entry>
	</dates>
	</vuln>

	<vuln vid="c039a761-2c29-11e6-8912-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>51.0.2704.79</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html">
	<p>15 security fixes in this release, including:</p>
	<ul>
	<li>601073] High CVE-2016-1696: Cross-origin bypass in Extension
	bindings. Credit to anonymous.</li>
	<li>[613266] High CVE-2016-1697: Cross-origin bypass in Blink.
	Credit to Mariusz Mlynski.</li>
	<li>[603725] Medium CVE-2016-1698: Information leak in Extension
	bindings. Credit to Rob Wu.</li>
	<li>[607939] Medium CVE-2016-1699: Parameter sanitization failure
	in DevTools. Credit to Gregory Panakkal.</li>
	<li>[608104] Medium CVE-2016-1700: Use-after-free in Extensions.
	Credit to Rob Wu.</li>
	<li>[608101] Medium CVE-2016-1701: Use-after-free in Autofill.
	Credit to Rob Wu.</li>
	<li>[609260] Medium CVE-2016-1702: Out-of-bounds read in Skia.
	Credit to cloudfuzzer.</li>
	<li>[616539] CVE-2016-1703: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1695</cvename>
	<cvename>CVE-2016-1696</cvename>
	<cvename>CVE-2016-1697</cvename>
	<cvename>CVE-2016-1698</cvename>
	<cvename>CVE-2016-1699</cvename>
	<cvename>CVE-2016-1700</cvename>
	<cvename>CVE-2016-1701</cvename>
	<cvename>CVE-2016-1702</cvename>
	<cvename>CVE-2016-1703</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2016-06-01</discovery>
	<entry>2016-06-06</entry>
	</dates>
	</vuln>

	<vuln vid="bcbd3fe0-2b46-11e6-ae88-002590263bf5">
	<topic>openafs -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openafs</name>
	<range><lt>1.6.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenAFS development team reports:</p>
	<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt">
	<p>Foreign users can bypass access controls to create groups as
	system:administrators, including in the user namespace and the
	system: namespace.</p>
	</blockquote>
	<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt">
	<p>The contents of uninitialized memory are sent on the wire when
	clients perform certain RPCs. Depending on the RPC, the information
	leaked may come from kernel memory or userspace.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2860</cvename>
	<cvename>CVE-2016-4536</cvename>
	<freebsdpr>ports/209534</freebsdpr>
	<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt</url>
	<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt</url>
	</references>
	<dates>
	<discovery>2016-03-16</discovery>
	<entry>2016-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="2e8fe57e-2b46-11e6-ae88-002590263bf5">
	<topic>openafs -- local DoS vulnerability</topic>
	<affects>
	<package>
	<name>openafs</name>
	<range><lt>1.6.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenAFS development team reports:</p>
	<blockquote cite="https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16">
	<p>Avoid a potential denial of service issue, by fixing a bug in
	pioctl logic that allowed a local user to overrun a kernel buffer
	with a single NUL byte.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8312</cvename>
	<url>https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16</url>
	</references>
	<dates>
	<discovery>2016-03-16</discovery>
	<entry>2016-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="0297b260-2b3b-11e6-ae88-002590263bf5">
	<topic>ikiwiki -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>3.20160509</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4561">
	<p>Cross-site scripting (XSS) vulnerability in the cgierror function
	in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers
	to inject arbitrary web script or HTML via unspecified vectors
	involving an error message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4561</cvename>
	<freebsdpr>ports/209593</freebsdpr>
	</references>
	<dates>
	<discovery>2016-05-04</discovery>
	<entry>2016-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="65bb1858-27de-11e6-b714-74d02b9a84d5">
	<topic>h2o -- use after free on premature connection close</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range><lt>1.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Newsha reports:</p>
	<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
	<p>When H2O tries to disconnect a premature HTTP/2 connection, it
	calls free(3) to release memory allocated for the connection and
	immediately after then touches the memory. No malloc-related
	operation is performed by the same thread between the time it calls
	free and the time the memory is touched. Fixed by Frederik
	Deweerdt.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://h2o.examp1e.net/vulnerabilities.html</url>
	</references>
	<dates>
	<discovery>2016-05-17</discovery>
	<entry>2016-06-01</entry>
	</dates>
	</vuln>

	<vuln vid="36cf7670-2774-11e6-af29-f0def16c5c1b">
	<topic>nginx -- a specially crafted request might result in worker process crash</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><ge>1.4.0</ge><lt>1.8.1_3,2</lt></range>
	<range><ge>1.10.0,2</ge><lt>1.10.1,2</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><ge>1.3.9</ge><lt>1.9.15_1</lt></range>
	<range><ge>1.10.0</ge><lt>1.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Maxim Dounin reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html">
	<p>A problem was identified in nginx code responsible for saving
	client request body to a temporary file. A specially crafted
	request might result in worker process crash due to a NULL
	pointer dereference while writing client request body to a
	temporary file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html</url>
	<cvename>CVE-2016-4450</cvename>
	</references>
	<dates>
	<discovery>2016-05-31</discovery>
	<entry>2016-05-31</entry>
	<modified>2016-06-05</modified>
	</dates>
	</vuln>

	<vuln vid="6167b341-250c-11e6-a6fb-003048f2e514">
	<topic>cacti -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.8h</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cacti Group, Inc. reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8h.php">
	<p>Changelog</p>
	<ul>
	<li>bug:0002667: Cacti SQL Injection Vulnerability</li>
	<li>bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection
	Vulnerability</li>
	<li>bug:0002656: Authentication using web authentication as a user
	not in the cacti database allows complete access (regression)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3659</cvename>
	<url>http://www.cacti.net/release_notes_0_8_8h.php</url>
	<url>http://bugs.cacti.net/view.php?id=2673</url>
	<url>http://seclists.org/fulldisclosure/2016/Apr/4</url>
	<url>http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html</url>
	</references>
	<dates>
	<discovery>2016-04-04</discovery>
	<entry>2016-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="b53bbf58-257f-11e6-9f4d-20cf30e32f6d">
	<topic>openvswitch -- MPLS buffer overflow</topic>
	<affects>
	<package>
	<name>openvswitch</name>
	<range><ge>2.2.0</ge><lt>2.3.3</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Open vSwitch reports:</p>
	<blockquote cite="http://openvswitch.org/pipermail/announce/2016-March/000082.html">
	<p>Multiple versions of Open vSwitch are vulnerable to remote buffer
	overflow attacks, in which crafted MPLS packets could overflow the
	buffer reserved for MPLS labels in an OVS internal data structure.
	The MPLS packets that trigger the vulnerability and the potential for
	exploitation vary depending on version:</p>
	<p>Open vSwitch 2.1.x and earlier are not vulnerable.</p>
	<p>In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be
	exploited for arbitrary remote code execution.</p>
	<p>In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead
	to a remote code execution exploit, but testing shows that it can allow a
	remote denial of service. See the mitigation section for details.</p>
	<p>Open vSwitch 2.5.x is not vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2074</cvename>
	<url>http://openvswitch.org/pipermail/announce/2016-March/000082.html</url>
	<url>http://openvswitch.org/pipermail/announce/2016-March/000083.html</url>
	</references>
	<dates>
	<discovery>2016-03-28</discovery>
	<entry>2016-05-29</entry>
	<modified>2016-07-03</modified>
	</dates>
	</vuln>

	<vuln vid="1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>51.0.2704.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html">
	<p>42 security fixes in this release</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1672</cvename>
	<cvename>CVE-2016-1673</cvename>
	<cvename>CVE-2016-1674</cvename>
	<cvename>CVE-2016-1675</cvename>
	<cvename>CVE-2016-1672</cvename>
	<cvename>CVE-2016-1677</cvename>
	<cvename>CVE-2016-1678</cvename>
	<cvename>CVE-2016-1679</cvename>
	<cvename>CVE-2016-1680</cvename>
	<cvename>CVE-2016-1681</cvename>
	<cvename>CVE-2016-1682</cvename>
	<cvename>CVE-2016-1685</cvename>
	<cvename>CVE-2016-1686</cvename>
	<cvename>CVE-2016-1687</cvename>
	<cvename>CVE-2016-1688</cvename>
	<cvename>CVE-2016-1689</cvename>
	<cvename>CVE-2016-1690</cvename>
	<cvename>CVE-2016-1691</cvename>
	<cvename>CVE-2016-1692</cvename>
	<cvename>CVE-2016-1693</cvename>
	<cvename>CVE-2016-1694</cvename>
	<cvename>CVE-2016-1695</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html</url>
	</references>
	<dates>
	<discovery>2016-05-25</discovery>
	<entry>2016-05-28</entry>
	<modified>2016-06-20</modified>
	</dates>
	</vuln>

	<vuln vid="4dfafa16-24ba-11e6-bd31-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>50.0.2661.102</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html">
	<p>5 security fixes in this release, including:</p>
	<ul>
	<li>[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit
	to Mariusz Mlynski.</li>
	<li>[605910] High CVE-2016-1668: Same origin bypass in Blink V8
	bindings. Credit to Mariusz Mlynski.</li>
	<li>[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to
	Choongwoo Han.</li>
	<li>[578882] Medium CVE-2016-1670: Race condition in loader. Credit
	to anonymous.</li>
	<li>[586657] Medium CVE-2016-1671: Directory traversal using the
	file scheme on Android. Credit to Jann Horn.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1667</cvename>
	<cvename>CVE-2016-1668</cvename>
	<cvename>CVE-2016-1669</cvename>
	<cvename>CVE-2016-1670</cvename>
	<cvename>CVE-2016-1671</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2016-05-11</discovery>
	<entry>2016-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="7da1da96-24bb-11e6-bd31-3065ec8fd3ec">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>50.0.2661.94</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html">
	<p>9 security fixes in this release, including:</p>
	<ul>
	<li>[574802] High CVE-2016-1660: Out-of-bounds write in Blink.
	Credit to Atte Kettunen of OUSPG.</li>
	<li>[601629] High CVE-2016-1661: Memory corruption in cross-process
	frames. Credit to Wadih Matar.</li>
	<li>[603732] High CVE-2016-1662: Use-after-free in extensions.
	Credit to Rob Wu.</li>
	<li>[603987] High CVE-2016-1663: Use-after-free in Blink's V8
	bindings. Credit to anonymous.</li>
	<li>[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to
	Wadih Matar.</li>
	<li>[606181] Medium CVE-2016-1665: Information leak in V8. Credit
	to HyungSeok Han.</li>
	<li>[607652] CVE-2016-1666: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1660</cvename>
	<cvename>CVE-2016-1661</cvename>
	<cvename>CVE-2016-1662</cvename>
	<cvename>CVE-2016-1663</cvename>
	<cvename>CVE-2016-1664</cvename>
	<cvename>CVE-2016-1665</cvename>
	<cvename>CVE-2016-1666</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html</url>
	</references>
	<dates>
	<discovery>2016-04-28</discovery>
	<entry>2016-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="6b110175-246d-11e6-8dd3-002590263bf5">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70-gd</name>
	<name>php70-intl</name>
	<range><lt>7.0.7</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-gd</name>
	<range><lt>5.6.22</lt></range>
	</package>
	<package>
	<name>php55</name>
	<name>php55-gd</name>
	<name>php55-phar</name>
	<range><lt>5.5.36</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Group reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.5.36">
	<ul><li>Core:
	<ul>
	<li>Fixed bug #72114 (Integer underflow / arbitrary null write in
	fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)</li>
	<li>Fixed bug #72135 (Integer Overflow in php_html_entities).
	(CVE-2016-5094) (PHP 5.5/5.6 only)</li>
	</ul></li>
	<li>GD:
	<ul>
	<li>Fixed bug #72227 (imagescale out-of-bounds read).
	(CVE-2013-7456)</li>
	</ul></li>
	<li>Intl:
	<ul>
	<li>Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
	(CVE-2016-5093)</li>
	</ul></li>
	<li>Phar:
	<ul>
	<li>Fixed bug #71331 (Uninitialized pointer in
	phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-5096</cvename>
	<cvename>CVE-2016-5094</cvename>
	<cvename>CVE-2013-7456</cvename>
	<cvename>CVE-2016-5093</cvename>
	<cvename>CVE-2016-4343</cvename>
	<freebsdpr>ports/209779</freebsdpr>
	<url>http://php.net/ChangeLog-7.php#7.0.7</url>
	<url>http://php.net/ChangeLog-5.php#5.6.22</url>
	<url>http://php.net/ChangeLog-5.php#5.5.36</url>
	</references>
	<dates>
	<discovery>2016-05-26</discovery>
	<entry>2016-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="00ec1be1-22bb-11e6-9ead-6805ca0b3d42">
	<topic>phpmyadmin -- XSS and sensitive data leakage</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.6.0</ge><lt>4.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpmyadmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-14/">
	<h2>Description</h2>
	<p>Because user SQL queries are part of the URL, sensitive
	information made as part of a user query can be exposed by
	clicking on external links to attackers monitoring user GET
	query parameters or included in the webserver logs.</p>
	<h2>Severity</h2>
	<p>We consider this to be non-critical.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-16/">
	<h2>Description</h2>
	<p>A specially crafted attack could allow for special HTML
	characters to be passed as URL encoded values and displayed
	back as special characters in the page.</p>
	<h2>Severity</h2>
	<p>We consider this to be non-critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-14/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-16/</url>
	<cvename>CVE-2016-5097</cvename>
	<cvename>CVE-2016-5099</cvename>
	</references>
	<dates>
	<discovery>2016-05-25</discovery>
	<entry>2016-05-25</entry>
	<modified>2016-05-26</modified>
	</dates>
	</vuln>

	<vuln vid="b50f53ce-2151-11e6-8dd3-002590263bf5">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki123</name>
	<range><lt>1.23.14</lt></range>
	</package>
	<package>
	<name>mediawiki124</name>
	<range><le>1.24.6</le></range>
	</package>
	<package>
	<name>mediawiki125</name>
	<range><lt>1.25.6</lt></range>
	</package>
	<package>
	<name>mediawiki126</name>
	<range><lt>1.26.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mediawiki reports:</p>
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html">
	<p>Security fixes:</p>
	<p>T122056: Old tokens are remaining valid within a new session</p>
	<p>T127114: Login throttle can be tricked using non-canonicalized
	usernames</p>
	<p>T123653: Cross-domain policy regexp is too narrow</p>
	<p>T123071: Incorrectly identifying http link in a's href
	attributes, due to m modifier in regex</p>
	<p>T129506: MediaWiki:Gadget-popups.js isn't renderable</p>
	<p>T125283: Users occasionally logged in as different users after
	SessionManager deployment</p>
	<p>T103239: Patrol allows click catching and patrolling of any
	page</p>
	<p>T122807: [tracking] Check php crypto primatives</p>
	<p>T98313: Graphs can leak tokens, leading to CSRF</p>
	<p>T130947: Diff generation should use PoolCounter</p>
	<p>T133507: Careless use of $wgExternalLinkTarget is insecure</p>
	<p>T132874: API action=move is not rate limited</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html</url>
	</references>
	<dates>
	<discovery>2016-05-20</discovery>
	<entry>2016-05-24</entry>
	</dates>
	</vuln>

	<vuln vid="967b852b-1e28-11e6-8dd3-002590263bf5">
	<topic>hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written</topic>
	<affects>
	<package>
	<name>wpa_supplicant</name>
	<range><lt>2.5_2</lt></range>
	</package>
	<package>
	<name>hostapd</name>
	<range><lt>2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jouni Malinen reports:</p>
	<blockquote cite="http://w1.fi/security/2016-1/psk-parameter-config-update.txt">
	<p>psk configuration parameter update allowing arbitrary data to be
	written (2016-1 - CVE-2016-4476/CVE-2016-4477).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4476</cvename>
	<cvename>CVE-2016-4477</cvename>
	<freebsdpr>ports/209564</freebsdpr>
	<url>http://w1.fi/security/2016-1/psk-parameter-config-update.txt</url>
	</references>
	<dates>
	<discovery>2016-05-02</discovery>
	<entry>2016-05-20</entry>
	<modified>2017-03-22</modified>
	</dates>
	</vuln>

	<vuln vid="57b3aba7-1e25-11e6-8dd3-002590263bf5">
	<topic>expat -- denial of service vulnerability on malformed input</topic>
	<affects>
	<package>
	<name>expat</name>
	<range><lt>2.1.1</lt></range>
	</package>
	<package>
	<name>linux-c6-expat</name>
	<range><lt>2.0.1_3</lt></range>
	</package>
	<package>
	<name>linux-c7-expat</name>
	<range><lt>2.1.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Grieco reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/17/12">
	<p>The Expat XML parser mishandles certain kinds of malformed input
	documents, resulting in buffer overflows during processing and error
	reporting. The overflows can manifest as a segmentation fault or as
	memory corruption during a parse operation. The bugs allow for a
	denial of service attack in many applications by an unauthenticated
	attacker, and could conceivably result in remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0718</cvename>
	<freebsdpr>ports/209360</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2016/05/17/12</url>
	</references>
	<dates>
	<discovery>2016-05-17</discovery>
	<entry>2016-05-20</entry>
	<modified>2016-11-30</modified>
	</dates>
	</vuln>

	<vuln vid="036d6c38-1c5b-11e6-b9e0-20cf30e32f6d">
	<topic>Bugzilla security issues</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.12</lt></range>
	</package>
	<package>
	<name>bugzilla50</name>
	<range><lt>5.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bugzilla Security Advisory</p>
	<blockquote cite="https://www.bugzilla.org/security/4.4.11/">
	<p>A specially crafted bug summary could trigger XSS in dependency graphs.
	Due to an incorrect parsing of the image map generated by the dot script,
	a specially crafted bug summary could trigger XSS in dependency graphs.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2803</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1253263</url>
	</references>
	<dates>
	<discovery>2016-03-03</discovery>
	<entry>2016-05-17</entry>
	</dates>
	</vuln>

	<vuln vid="0dc8be9e-19af-11e6-8de0-080027ef73ec">
	<topic>OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing</topic>
	<affects>
	<package>
	<name>openvpn</name>
	<range><lt>2.3.11</lt></range>
	</package>
	<package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samuli Seppänen reports:</p>
	<blockquote cite="https://sourceforge.net/p/openvpn/mailman/message/35076507/">
	<p>OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug
	with DoS potential and a buffer overflow by user supplied data when
	using pam authentication.[...]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://sourceforge.net/p/openvpn/mailman/message/35076507/</url>
	<url>https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11</url>
	</references>
	<dates>
	<discovery>2016-03-03</discovery>
	<entry>2016-05-14</entry>
	</dates>
	</vuln>

	<vuln vid="82b702e0-1907-11e6-857b-00221503d280">
	<topic>imagemagick -- buffer overflow</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.4.1,1</lt></range>
	</package>
	<package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ImageMagick reports:</p>
	<blockquote cite="http://legacy.imagemagick.org/script/changelog.php">
	<p>Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://legacy.imagemagick.org/script/changelog.php</url>
	</references>
	<dates>
	<discovery>2016-05-09</discovery>
	<entry>2016-05-13</entry>
	</dates>
	</vuln>

	<vuln vid="e387834a-17ef-11e6-9947-7054d2909b71">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>2.2</le></range>
	</package>
	<package>
	<name>jenkins2</name>
	<range><le>2.2</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>1.651.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11">
	<h1>Description</h1>
	<h5>SECURITY-170 / CVE-2016-3721</h5>
	<p>Arbitrary build parameters are passed to build scripts as environment variables</p>
	<h5>SECURITY-243 / CVE-2016-3722</h5>
	<p>Malicious users with multiple user accounts can prevent other users from logging in</p>
	<h5>SECURITY-250 / CVE-2016-3723</h5>
	<p>Information on installed plugins exposed via API</p>
	<h5>SECURITY-266 / CVE-2016-3724</h5>
	<p>Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration</p>
	<h5>SECURITY-273 / CVE-2016-3725</h5>
	<p>Regular users can trigger download of update site metadata</p>
	<h5>SECURITY-276 / CVE-2016-3726</h5>
	<p>Open redirect to scheme-relative URLs</p>
	<h5>SECURITY-281 / CVE-2016-3727</h5>
	<p>Granting the permission to read node configurations allows access to overall system configuration</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3721</cvename>
	<cvename>CVE-2016-3722</cvename>
	<cvename>CVE-2016-3723</cvename>
	<cvename>CVE-2016-3724</cvename>
	<cvename>CVE-2016-3725</cvename>
	<cvename>CVE-2016-3726</cvename>
	<cvename>CVE-2016-3727</cvename>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11</url>
	</references>
	<dates>
	<discovery>2016-05-11</discovery>
	<entry>2016-05-12</entry>
	</dates>
	</vuln>

	<vuln vid="d9f99491-1656-11e6-94fa-002590263bf5">
	<topic>perl5 -- taint mechanism bypass vulnerability</topic>
	<affects>
	<package>
	<name>perl5</name>
	<range><lt>5.18.4_21</lt></range>
	<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
	<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
	</package>
	<package>
	<name>perl5.18</name>
	<range><ge>5.18.0</ge><lt>5.18.4_21</lt></range>
	</package>
	<package>
	<name>perl5.20</name>
	<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
	</package>
	<package>
	<name>perl5.22</name>
	<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
	</package>
	<package>
	<name>perl</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2381">
	<p>Perl might allow context-dependent attackers to bypass the taint
	protection mechanism in a child process via duplicate environment
	variables in envp.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2381</cvename>
	<freebsdpr>ports/208879</freebsdpr>
	</references>
	<dates>
	<discovery>2016-04-08</discovery>
	<entry>2016-05-10</entry>
	<modified>2016-08-22</modified>
	</dates>
	</vuln>

	<vuln vid="3686917b-164d-11e6-94fa-002590263bf5">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.5.2,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Helen Hou-Sandi reports:</p>
	<blockquote cite="https://wordpress.org/news/2016/05/wordpress-4-5-2/">
	<p>WordPress 4.5.2 is now available. This is a security release for
	all previous versions and we strongly encourage you to update your
	sites immediately.</p>
	<p>WordPress versions 4.5.1 and earlier are affected by a SOME
	vulnerability through Plupload, the third-party library WordPress
	uses for uploading files. WordPress versions 4.2 through 4.5.1 are
	vulnerable to reflected XSS using specially crafted URIs through
	MediaElement.js, the third-party library used for media players.
	MediaElement.js and Plupload have also released updates fixing
	these issues.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4566</cvename>
	<cvename>CVE-2016-4567</cvename>
	<url>https://wordpress.org/news/2016/05/wordpress-4-5-2/</url>
	<url>http://www.openwall.com/lists/oss-security/2016/05/07/7</url>
	</references>
	<dates>
	<discovery>2016-05-06</discovery>
	<entry>2016-05-10</entry>
	</dates>
	</vuln>

	<vuln vid="2b4c8e1f-1609-11e6-b55e-b499baebfeaf">
	<topic>libarchive -- RCE vulnerability</topic>
	<affects>
	<package>
	<name>libarchive</name>
	<range><lt>3.2.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The libarchive project reports:</p>
	<blockquote cite="https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7">
	<p>Heap-based buffer overflow in the zip_read_mac_metadata function
	in archive_read_support_format_zip.c in libarchive before 3.2.0
	allows remote attackers to execute arbitrary code via crafted
	entry-size values in a ZIP archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1541</cvename>
	<url>https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7</url>
	</references>
	<dates>
	<discovery>2016-05-01</discovery>
	<entry>2016-05-09</entry>
	<modified>2016-05-10</modified>
	</dates>
	</vuln>

	<vuln vid="25e5205b-1447-11e6-9ead-6805ca0b3d42">
	<topic>squid -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.0.0</ge><lt>3.5.18</lt></range>
	</package>
	<package>
	<name>squid-devel</name>
	<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid development team reports:</p>
	<p>Please reference CVE/URL list for details</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4553</cvename>
	<cvename>CVE-2016-4554</cvename>
	<cvename>CVE-2016-4555</cvename>
	<cvename>CVE-2016-4556</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_7.txt</url>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_8.txt</url>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_9.txt</url>
	</references>
	<dates>
	<discovery>2016-05-06</discovery>
	<entry>2016-05-07</entry>
	<modified>2016-05-09</modified>
	</dates>
	</vuln>

	<vuln vid="0d724b05-687f-4527-9c03-af34d3b094ec">
	<topic>ImageMagick -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.3.9_1,1</lt></range>
	</package>
	<package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Openwall reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/03/18">
	<p>Insufficient filtering for filename passed to delegate's command
	allows remote code execution during conversion of several file
	formats. Any service which uses ImageMagick to process user
	supplied images and uses default delegates.xml / policy.xml,
	may be vulnerable to this issue.</p>
	<p>It is possible to make ImageMagick perform a HTTP GET or FTP
	request</p>
	<p>It is possible to delete files by using ImageMagick's 'ephemeral'
	pseudo protocol which deletes files after reading.</p>
	<p>It is possible to move image files to file with any extension
	in any folder by using ImageMagick's 'msl' pseudo protocol.
	msl.txt and image.gif should exist in known location - /tmp/
	for PoC (in real life it may be web service written in PHP,
	which allows to upload raw txt files and process images with
	ImageMagick).</p>
	<p>It is possible to get content of the files from the server
	by using ImageMagick's 'label' pseudo protocol.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3714</cvename>
	<cvename>CVE-2016-3715</cvename>
	<cvename>CVE-2016-3716</cvename>
	<cvename>CVE-2016-3717</cvename>
	<cvename>CVE-2016-3718</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/05/03/18</url>
	<url>https://imagetragick.com/</url>
	</references>
	<dates>
	<discovery>2016-05-03</discovery>
	<entry>2016-05-06</entry>
	<modified>2016-05-07</modified>
	</dates>
	</vuln>

	<vuln vid="a6cd01fa-11bd-11e6-bb3c-9cb654ea3e1c">
	<topic>jansson -- local denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>jansson</name>
	<range><lt>2.7_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>QuickFuzz reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/01/5">
	<p>A crash caused by stack exhaustion parsing a JSON was found.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2016/05/01/5</url>
	<url>http://www.openwall.com/lists/oss-security/2016/05/02/1</url>
	<cvename>CVE-2016-4425</cvename>
	</references>
	<dates>
	<discovery>2016-05-01</discovery>
	<entry>2016-05-04</entry>
	</dates>
	</vuln>

	<vuln vid="01d729ca-1143-11e6-b55e-b499baebfeaf">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2_11</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_8</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><ge>2.3.0</ge><lt>2.3.4</lt></range>
	<range><lt>2.2.7</lt></range>
	</package>
	<package>
	<name>libressl-devel</name>
	<range><lt>2.3.4</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_2</lt></range>
	<range><ge>10.2</ge><lt>10.2_16</lt></range>
	<range><ge>10.1</ge><lt>10.1_33</lt></range>
	<range><ge>9.3</ge><lt>9.3_41</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20160503.txt">
	<p>Memory corruption in the ASN.1 encoder</p>
	<p>Padding oracle in AES-NI CBC MAC check</p>
	<p>EVP_EncodeUpdate overflow</p>
	<p>EVP_EncryptUpdate overflow</p>
	<p>ASN.1 BIO excessive memory allocation</p>
	<p>EBCDIC overread (OpenSSL only)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv/20160503.txt</url>
	<url>https://marc.info/?l=openbsd-tech&m=146228598730414</url>
	<cvename>CVE-2016-2105</cvename>
	<cvename>CVE-2016-2106</cvename>
	<cvename>CVE-2016-2107</cvename>
	<cvename>CVE-2016-2108</cvename>
	<cvename>CVE-2016-2109</cvename>
	<cvename>CVE-2016-2176</cvename>
	<freebsdsa>SA-16:17.openssl</freebsdsa>
	</references>
	<dates>
	<discovery>2016-05-03</discovery>
	<entry>2016-05-03</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="95564990-1138-11e6-b55e-b499baebfeaf">
	<cancelled superseded="01d729ca-1143-11e6-b55e-b499baebfeaf"/>
	</vuln>

	<vuln vid="be72e773-1131-11e6-94fa-002590263bf5">
	<topic>gitlab -- privilege escalation via "impersonate" feature</topic>
	<affects>
	<package>
	<name>gitlab</name>
	<range><ge>8.2.0</ge><lt>8.2.5</lt></range>
	<range><ge>8.3.0</ge><lt>8.3.9</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.12</lt></range>
	<range><ge>8.6.0</ge><lt>8.6.8</lt></range>
	<range><ge>8.7.0</ge><lt>8.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GitLab reports:</p>
	<blockquote cite="https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/">
	<p>During an internal code review, we discovered a critical security
	flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2,
	this feature was intended to allow an administrator to simulate
	being logged in as any other user.</p>
	<p>A part of this feature was not properly secured and it was possible
	for any authenticated user, administrator or not, to "log in" as any
	other user, including administrators. Please see the issue for more
	details.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4340</cvename>
	<freebsdpr>ports/209225</freebsdpr>
	<url>https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/</url>
	<url>https://gitlab.com/gitlab-org/gitlab-ce/issues/15548</url>
	</references>
	<dates>
	<discovery>2016-05-02</discovery>
	<entry>2016-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="5764c634-10d2-11e6-94fa-002590263bf5">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70</name>
	<name>php70-bcmath</name>
	<name>php70-exif</name>
	<name>php70-gd</name>
	<name>php70-xml</name>
	<range><lt>7.0.6</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-bcmath</name>
	<name>php56-exif</name>
	<name>php56-gd</name>
	<name>php56-xml</name>
	<range><lt>5.6.21</lt></range>
	</package>
	<package>
	<name>php55</name>
	<name>php55-bcmath</name>
	<name>php55-exif</name>
	<name>php55-gd</name>
	<name>php55-xml</name>
	<range><lt>5.5.35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Group reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.35">
	<ul><li>BCMath:
	<ul>
	<li>Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
	_one_ definition).</li>
	</ul></li>
	<li>Exif:
	<ul>
	<li>Fixed bug #72094 (Out of bounds heap read access in exif header
	processing).</li>
	</ul></li>
	<li>GD:
	<ul>
	<li>Fixed bug #71912 (libgd: signedness vulnerability).
	(CVE-2016-3074)</li>
	</ul></li>
	<li>Intl:
	<ul>
	<li>Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos
	with negative offset).</li>
	</ul></li>
	<li>XML:
	<ul>
	<li>Fixed bug #72099 (xml_parse_into_struct segmentation fault).
	</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3074</cvename>
	<freebsdpr>ports/209145</freebsdpr>
	<url>http://www.php.net/ChangeLog-7.php#7.0.6</url>
	<url>http://www.php.net/ChangeLog-5.php#5.6.21</url>
	<url>http://www.php.net/ChangeLog-5.php#5.5.35</url>
	</references>
	<dates>
	<discovery>2016-04-28</discovery>
	<entry>2016-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="a1134048-10c6-11e6-94fa-002590263bf5">
	<topic>libksba -- local denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>libksba</name>
	<range><lt>1.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin Prpic, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/29/5">
	<p>Denial of Service due to stack overflow in src/ber-decoder.c.</p>
	<p>Integer overflow in the BER decoder src/ber-decoder.c.</p>
	<p>Integer overflow in the DN decoder src/dn.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4353</cvename>
	<cvename>CVE-2016-4354</cvename>
	<cvename>CVE-2016-4355</cvename>
	<cvename>CVE-2016-4356</cvename>
	<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a</url>
	<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887</url>
	<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3</url>
	<url>https://security.gentoo.org/glsa/201604-04</url>
	<mlist>http://www.openwall.com/lists/oss-security/2016/04/29/5</mlist>
	</references>
	<dates>
	<discovery>2015-04-08</discovery>
	<entry>2016-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="7e36c369-10c0-11e6-94fa-002590263bf5">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html">
	<p>The following vulnerabilities have been fixed:</p>
	<ul>
	<li><p>wnpa-sec-2016-19</p>
	<p>The NCP dissector could crash. (Bug 11591)</p></li>
	<li><p>wnpa-sec-2016-20</p>
	<p>TShark could crash due to a packet reassembly bug. (Bug 11799)
	</p></li>
	<li><p>wnpa-sec-2016-21</p>
	<p>The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)
	</p></li>
	<li><p>wnpa-sec-2016-22</p>
	<p>The PKTC dissector could crash. (Bug 12206)</p></li>
	<li><p>wnpa-sec-2016-23</p>
	<p>The PKTC dissector could crash. (Bug 12242)</p></li>
	<li><p>wnpa-sec-2016-24</p>
	<p>The IAX2 dissector could go into an infinite loop. (Bug
	12260)</p></li>
	<li><p>wnpa-sec-2016-25</p>
	<p>Wireshark and TShark could exhaust the stack. (Bug 12268)</p>
	</li>
	<li><p>wnpa-sec-2016-26</p>
	<p>The GSM CBCH dissector could crash. (Bug 12278)</p></li>
	<li><p>wnpa-sec-2016-27</p>
	<p>MS-WSP dissector crash. (Bug 12341)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4076</cvename>
	<cvename>CVE-2016-4077</cvename>
	<cvename>CVE-2016-4078</cvename>
	<cvename>CVE-2016-4079</cvename>
	<cvename>CVE-2016-4080</cvename>
	<cvename>CVE-2016-4081</cvename>
	<cvename>CVE-2016-4006</cvename>
	<cvename>CVE-2016-4082</cvename>
	<cvename>CVE-2016-4083</cvename>
	<cvename>CVE-2016-4084</cvename>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/04/25/2</url>
	</references>
	<dates>
	<discovery>2016-04-22</discovery>
	<entry>2016-05-02</entry>
	<modified>2016-07-04</modified>
	</dates>
	</vuln>

	<vuln vid="78abc022-0fee-11e6-9a1c-0014a5a57822">
	<topic>mercurial -- arbitrary code execution vulnerability</topic>
	<affects>
	<package>
	<name>mercurial</name>
	<range><lt>3.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mercurial reports:</p>
	<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29">
	<p>CVE-2016-3105: Arbitrary code execution when converting
	Git repos</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3105</cvename>
	<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29</url>
	</references>
	<dates>
	<discovery>2016-05-01</discovery>
	<entry>2016-05-01</entry>
	</dates>
	</vuln>

	<vuln vid="8c2b2f11-0ebe-11e6-b55e-b499baebfeaf">
	<topic>MySQL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.49</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.25</lt></range>
	</package>
	<package>
	<name>mariadb101-server</name>
	<range><lt>10.1.12</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.49</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.30</lt></range>
	</package>
	<package>
	<name>mysql57-server</name>
	<range><lt>5.7.12</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.49</lt></range>
	</package>
	<package>
	<name>percona-server</name>
	<range><lt>5.6.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL">
	<p>Critical Patch Update contains 31 new security fixes for Oracle MySQL
	5.5.48, 5.6.29, 5.7.11 and earlier</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/</url>
	<cvename>CVE-2016-0705</cvename>
	<cvename>CVE-2016-0639</cvename>
	<cvename>CVE-2015-3194</cvename>
	<cvename>CVE-2016-0640</cvename>
	<cvename>CVE-2016-0641</cvename>
	<cvename>CVE-2016-3461</cvename>
	<cvename>CVE-2016-2047</cvename>
	<cvename>CVE-2016-0642</cvename>
	<cvename>CVE-2016-0643</cvename>
	<cvename>CVE-2016-0644</cvename>
	<cvename>CVE-2016-0646</cvename>
	<cvename>CVE-2016-0647</cvename>
	<cvename>CVE-2016-0648</cvename>
	<cvename>CVE-2016-0649</cvename>
	<cvename>CVE-2016-0650</cvename>
	<cvename>CVE-2016-0652</cvename>
	<cvename>CVE-2016-0653</cvename>
	<cvename>CVE-2016-0654</cvename>
	<cvename>CVE-2016-0655</cvename>
	<cvename>CVE-2016-0656</cvename>
	<cvename>CVE-2016-0657</cvename>
	<cvename>CVE-2016-0658</cvename>
	<cvename>CVE-2016-0651</cvename>
	<cvename>CVE-2016-0659</cvename>
	<cvename>CVE-2016-0661</cvename>
	<cvename>CVE-2016-0662</cvename>
	<cvename>CVE-2016-0663</cvename>
	<cvename>CVE-2016-0665</cvename>
	<cvename>CVE-2016-0666</cvename>
	<cvename>CVE-2016-0667</cvename>
	<cvename>CVE-2016-0668</cvename>
	</references>
	<dates>
	<discovery>2016-04-19</discovery>
	<entry>2016-04-30</entry>
	</dates>
	</vuln>

	<vuln vid="f2d4f879-0d7c-11e6-925f-6805ca0b3d42">
	<topic>logstash -- password disclosure vulnerability</topic>
	<affects>
	<package>
	<name>logstash</name>
	<range><ge>2.1.0</ge><lt>2.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Logstash developers report:</p>
	<blockquote cite="https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18">
	<h2>Passwords Printed in Log Files under Some Conditions</h2>
	<p>It was discovered that, in Logstash 2.1.0+, log messages
	generated by a stalled pipeline during shutdown will print
	plaintext contents of password fields. While investigating
	this issue we also discovered that debug logging has
	included this data for quite some time. Our latest releases
	fix both leaks. You will want to scrub old log files if this
	is of particular concern to you. This was fixed in issue
	#4965</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18</url>
	<url>https://github.com/elastic/logstash/pull/4965</url>
	</references>
	<dates>
	<discovery>2016-04-01</discovery>
	<entry>2016-04-28</entry>
	</dates>
	</vuln>

	<vuln vid="c8174b63-0d3a-11e6-b06e-d43d7eed0ce2">
	<topic>subversion -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.9.0</ge><lt>1.9.4</lt></range>
	<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
	</package>
	<package>
	<name>subversion18</name>
	<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2016-2167-advisory.txt">
	<p>svnserve, the svn:// protocol server, can optionally use the Cyrus
	SASL library for authentication, integrity protection, and encryption.
	Due to a programming oversight, authentication against Cyrus SASL
	would permit the remote user to specify a realm string which is
	a prefix of the expected realm string.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2016-2168-advisory.txt">
	<p>Subversion's httpd servers are vulnerable to a remotely triggerable crash
	in the mod_authz_svn module. The crash can occur during an authorization
	check for a COPY or MOVE request with a specially crafted header value.</p>
	<p>This allows remote attackers to cause a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2167</cvename>
	<url>http://subversion.apache.org/security/CVE-2016-2167-advisory.txt</url>
	<cvename>CVE-2016-2168</cvename>
	<url>http://subversion.apache.org/security/CVE-2016-2168-advisory.txt</url>
	</references>
	<dates>
	<discovery>2016-04-21</discovery>
	<entry>2016-04-28</entry>
	</dates>
	</vuln>

	<vuln vid="b2487d9a-0c30-11e6-acd0-d050996490d0">
	<topic>ntp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p7</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><lt>4.3.92</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_1</lt></range>
	<range><ge>10.2</ge><lt>10.2_15</lt></range>
	<range><ge>10.1</ge><lt>10.1_32</lt></range>
	<range><ge>9.3</ge><lt>9.3_40</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Network Time Foundation reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security">
	<p>NTF's NTP Project has been notified of the following low-
	and medium-severity vulnerabilities that are fixed in
	ntp-4.2.8p7, released on Tuesday, 26 April 2016:</p>
	<ul>
	<li>Bug 3020 / CVE-2016-1551: Refclock impersonation
	vulnerability, AKA: refclock-peering. Reported by
	Matt Street and others of Cisco ASIG</li>
	<li>Bug 3012 / CVE-2016-1549: Sybil vulnerability:
	ephemeral association attack, AKA: ntp-sybil -
	MITIGATION ONLY. Reported by Matthew Van Gundy
	of Cisco ASIG</li>
	<li>Bug 3011 / CVE-2016-2516: Duplicate IPs on
	unconfig directives will cause an assertion botch.
	Reported by Yihan Lian of the Cloud Security Team,
	Qihoo 360</li>
	<li>Bug 3010 / CVE-2016-2517: Remote configuration
	trustedkey/requestkey values are not properly
	validated. Reported by Yihan Lian of the Cloud
	Security Team, Qihoo 360</li>
	<li>Bug 3009 / CVE-2016-2518: Crafted addpeer with
	hmode > 7 causes array wraparound with MATCH_ASSOC.
	Reported by Yihan Lian of the Cloud Security Team,
	Qihoo 360</li>
	<li>Bug 3008 / CVE-2016-2519: ctl_getitem() return
	value not always checked. Reported by Yihan Lian
	of the Cloud Security Team, Qihoo 360</li>
	<li>Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,
	AKA: nak-dos. Reported by Stephen Gray and
	Matthew Van Gundy of Cisco ASIG</li>
	<li>Bug 2978 / CVE-2016-1548: Interleave-pivot -
	MITIGATION ONLY. Reported by Miroslav Lichvar of
	RedHat and separately by Jonathan Gardner of
	Cisco ASIG.</li>
	<li>Bug 2952 / CVE-2015-7704: KoD fix: peer
	associations were broken by the fix for
	NtpBug2901, AKA: Symmetric active/passive mode
	is broken. Reported by Michael Tatarinov,
	NTP Project Developer Volunteer</li>
	<li>Bug 2945 / Bug 2901 / CVE-2015-8138: Zero
	Origin Timestamp Bypass, AKA: Additional KoD Checks.
	Reported by Jonathan Gardner of Cisco ASIG</li>
	<li>Bug 2879 / CVE-2016-1550: Improve NTP security
	against buffer comparison timing attacks,
	authdecrypt-timing, AKA: authdecrypt-timing.
	Reported independently by Loganaden Velvindron,
	and Matthew Van Gundy and Stephen Gray of
	Cisco ASIG.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:16.ntp</freebsdsa>
	<cvename>CVE-2015-7704</cvename>
	<cvename>CVE-2015-8138</cvename>
	<cvename>CVE-2016-1547</cvename>
	<cvename>CVE-2016-1548</cvename>
	<cvename>CVE-2016-1549</cvename>
	<cvename>CVE-2016-1550</cvename>
	<cvename>CVE-2016-1551</cvename>
	<cvename>CVE-2016-2516</cvename>
	<cvename>CVE-2016-2517</cvename>
	<cvename>CVE-2016-2518</cvename>
	<cvename>CVE-2016-2519</cvename>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security</url>
	</references>
	<dates>
	<discovery>2016-04-26</discovery>
	<entry>2016-04-27</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="92d44f83-a7bf-41cf-91ee-3d1b8ecf579f">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>46.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.43</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><ge>39.0,1</ge><lt>45.1.0,1</lt></range>
	<range><lt>38.8.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>39.0</ge><lt>45.1.0</lt></range>
	<range><lt>38.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46">
	<p>MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 /
	rv:45.1 / rv:38.8)</p>
	<p>MFSA 2016-42 Use-after-free and buffer overflow
	in Service Workers</p>
	<p>MFSA 2016-44 Buffer overflow in libstagefright with
	CENC offsets</p>
	<p>MFSA 2016-45 CSP not applied to pages sent with
	multipart/x-mixed-replace</p>
	<p>MFSA 2016-46 Elevation of privilege with
	chrome.tabs.update API in web extensions</p>
	<p>MFSA 2016-47 Write to invalid HashMap entry through
	JavaScript.watch()</p>
	<p>MFSA 2016-48 Firefox Health Reports could accept events
	from untrusted domains</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2804</cvename>
	<cvename>CVE-2016-2805</cvename>
	<cvename>CVE-2016-2806</cvename>
	<cvename>CVE-2016-2807</cvename>
	<cvename>CVE-2016-2808</cvename>
	<cvename>CVE-2016-2811</cvename>
	<cvename>CVE-2016-2812</cvename>
	<cvename>CVE-2016-2814</cvename>
	<cvename>CVE-2016-2816</cvename>
	<cvename>CVE-2016-2817</cvename>
	<cvename>CVE-2016-2820</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-39/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-42/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-44/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-45/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-46/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-47/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-48/</url>
	</references>
	<dates>
	<discovery>2016-04-26</discovery>
	<entry>2016-04-26</entry>
	</dates>
	</vuln>

	<vuln vid="f87a9376-0943-11e6-8fc4-00a0986f28c4">
	<topic>phpmyfaq -- cross-site request forgery vulnerability</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><lt>2.8.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyFAQ team reports:</p>
	<blockquote cite="http://www.phpmyfaq.de/security/advisory-2016-04-11">
	<p>The vulnerability exists due to application does not properly
	verify origin of HTTP requests in "Interface Translation"
	functionality.: A remote unauthenticated attacker can create
	a specially crafted malicious web page with CSRF exploit, trick
	a logged-in administrator to visit the page, spoof the HTTP
	request, as if it was coming from the legitimate user, inject
	and execute arbitrary PHP code on the target system with privileges
	of the webserver.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyfaq.de/security/advisory-2016-04-11</url>
	<url>https://www.htbridge.com/advisory/HTB23300</url>
	</references>
	<dates>
	<discovery>2016-04-11</discovery>
	<entry>2016-04-23</entry>
	</dates>
	</vuln>

	<vuln vid="1b0d2938-0766-11e6-94fa-002590263bf5">
	<topic>libtasn1 -- denial of service parsing malicious DER certificates</topic>
	<affects>
	<package>
	<name>libtasn1</name>
	<range><lt>4.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU Libtasn1 NEWS reports:</p>
	<blockquote cite="http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37">
	<p>Fixes to avoid an infinite recursion when decoding without the
	ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4008</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/04/13/3</url>
	<url>http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37</url>
	</references>
	<dates>
	<discovery>2016-04-11</discovery>
	<entry>2016-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="e05bfc92-0763-11e6-94fa-002590263bf5">
	<topic>squid -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>3.5.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2016:5 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_5.txt">
	<p>Due to incorrect buffer management Squid cachemgr.cgi tool is
	vulnerable to a buffer overflow when processing remotely supplied
	inputs relayed to it from Squid.</p>
	<p>This problem allows any client to seed the Squid manager reports
	with data that will cause a buffer overflow when processed by the
	cachemgr.cgi tool. However, this does require manual administrator
	actions to take place. Which greatly reduces the impact and
	possible uses.</p>
	</blockquote>
	<p>Squid security advisory 2016:6 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_6.txt">
	<p>Due to buffer overflow issues Squid is vulnerable to a denial of
	service attack when processing ESI responses. Due to incorrect input
	validation Squid is vulnerable to public information disclosure of
	the server stack layout when processing ESI responses. Due to
	incorrect input validation and buffer overflow Squid is vulnerable
	to remote code execution when processing ESI responses.</p>
	<p>These problems allow ESI components to be used to perform a denial
	of service attack on the Squid service and all other services on the
	same machine. Under certain build conditions these problems allow
	remote clients to view large sections of the server memory. However,
	the bugs are exploitable only if you have built and configured the
	ESI features to be used by a reverse-proxy and if the ESI components
	being processed by Squid can be controlled by an attacker.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-4051</cvename>
	<cvename>CVE-2016-4052</cvename>
	<cvename>CVE-2016-4053</cvename>
	<cvename>CVE-2016-4054</cvename>
	<freebsdpr>ports/208939</freebsdpr>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_5.txt</url>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_6.txt</url>
	</references>
	<dates>
	<discovery>2016-04-20</discovery>
	<entry>2016-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="253c6889-06f0-11e6-925f-6805ca0b3d42">
	<topic>ansible -- use of predictable paths in lxc_container</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><ge>2.0.0.0</ge><lt>2.0.2.0</lt></range>
	</package>
	<package>
	<name>ansible1</name>
	<range><lt>1.9.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansible developers report:</p>
	<blockquote cite="https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4">
	<p>CVE-2016-3096: do not use predictable paths in lxc_container</p>

	<ul>
	<li>do not use a predictable filename for the LXC attach
	script</li>
	<li>don't use predictable filenames for LXC attach script
	logging</li>
	<li>don't set a predictable archive_path</li>
	</ul>

	<p>this should prevent symlink attacks which could result
	in</p>

	<ul>
	<li>data corruption</li>
	<li>data leakage</li>
	<li>privilege escalation</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3096</cvename>
	<url>https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1322925</url>
	</references>
	<dates>
	<discovery>2016-04-02</discovery>
	<entry>2016-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="a733b5ca-06eb-11e6-817f-3085a9a4510d">
	<topic>proftpd -- vulnerability in mod_tls</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<range><lt>1.3.5b</lt></range>
	<range><eq>1.3.6.r1</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3125">
	<p>The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before
	1.3.6rc2 does not properly handle the TLSDHParamFile directive, which
	might cause a weaker than intended Diffie-Hellman (DH) key to be used
	and consequently allow attackers to have unspecified impact via
	unknown vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3125</cvename>
	</references>
	<dates>
	<discovery>2016-03-08</discovery>
	<entry>2016-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>50.0.2661.75</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
	<p>20 security fixes in this release, including:</p>
	<ul>
	<li>[590275] High CVE-2016-1652: Universal XSS in extension
	bindings. Credit to anonymous.</li>
	<li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
	to Choongwoo Han.</li>
	<li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
	JPEG2000 decoding. Credit to kdot working with HP's Zero Day
	Initiative.</li>
	<li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
	media. Credit to Atte Kettunen of OUSPG.</li>
	<li>[582008] Medium CVE-2016-1655: Use-after-free related to
	extensions. Credit to Rob Wu.</li>
	<li>[570750] Medium CVE-2016-1656: Android downloaded file path
	restriction bypass. Credit to Dzmitry Lukyanenko.</li>
	<li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
	Luan Herrera.</li>
	<li>[573317] Low CVE-2016-1658: Potential leak of sensitive
	information to malicious extensions. Credit to Antonio Sanso
	(@asanso) of Adobe.</li>
	<li>[602697] CVE-2016-1659: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1651</cvename>
	<cvename>CVE-2016-1652</cvename>
	<cvename>CVE-2016-1653</cvename>
	<cvename>CVE-2016-1654</cvename>
	<cvename>CVE-2016-1655</cvename>
	<cvename>CVE-2016-1656</cvename>
	<cvename>CVE-2016-1657</cvename>
	<cvename>CVE-2016-1658</cvename>
	<cvename>CVE-2016-1659</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
	</references>
	<dates>
	<discovery>2016-04-13</discovery>
	<entry>2016-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
	<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wpa_supplicant</name>
	<range><lt>2.5_1</lt></range>
	</package>
	<package>
	<name>hostapd</name>
	<range><lt>2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jouni Malinen reports:</p>
	<blockquote cite="http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt">
	<p>wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 -
	CVE-2015-5310)</p>
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt">
	<p>EAP-pwd missing last fragment length validation. (2015-7 -
	CVE-2015-5315)</p>
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt">
	<p>EAP-pwd peer error path failure on unexpected Confirm message.
	(2015-8 - CVE-2015-5316)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5310</cvename>
	<cvename>CVE-2015-5315</cvename>
	<cvename>CVE-2015-5316</cvename>
	<freebsdpr>ports/208482</freebsdpr>
	<url>http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt</url>
	<url>http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt</url>
	<url>http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt</url>
	</references>
	<dates>
	<discovery>2015-11-10</discovery>
	<entry>2016-04-19</entry>
	<modified>2017-03-22</modified>
	</dates>
	</vuln>

	<vuln vid="092156c9-04d7-11e6-b1ce-002590263bf5">
	<topic>dhcpcd -- remote code execution/denial of service</topic>
	<affects>
	<package>
	<name>dhcpcd</name>
	<range><lt>6.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7912">
	<p>The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
	in dhcpcd 5.x in Android before 5.1 and other products, does not
	validate the relationship between length fields and the amount of
	data, which allows remote DHCP servers to execute arbitrary code or
	cause a denial of service (memory corruption) via a large length
	value of an option in a DHCPACK message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-7912</cvename>
	<url>http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe</url>
	</references>
	<dates>
	<discovery>2015-06-19</discovery>
	<entry>2016-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1">
	<topic>dhcpcd -- remote code execution/denial of service</topic>
	<affects>
	<package>
	<name>dhcpcd</name>
	<range><lt>6.10.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913">
	<p>The print_option function in dhcp-common.c in dhcpcd through 6.9.1,
	as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other
	products, misinterprets the return value of the snprintf function,
	which allows remote DHCP servers to execute arbitrary code or cause
	a denial of service (memory corruption) via a crafted message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-7913</cvename>
	<freebsdpr>ports/208702</freebsdpr>
	<url>http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e</url>
	</references>
	<dates>
	<discovery>2016-01-22</discovery>
	<entry>2016-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="e21474c6-031a-11e6-aa86-001999f8d30b">
	<topic>PJSIP -- TCP denial of service in PJProject</topic>
	<affects>
	<package>
	<name>pjsip</name>
	<range><le>2.4.5</le></range>
	</package>
	<package>
	<name>pjsip-extsrtp</name>
	<range><le>2.4.5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>PJProject has a limit on the number of TCP connections
	that it can accept. Furthermore, PJProject does not close
	TCP connections it accepts. By default, this value is
	approximately 60.</p>
	<p>An attacker can deplete the number of allowed TCP
	connections by opening TCP connections and sending no
	data to Asterisk.</p>
	<p>If PJProject has been compiled in debug mode, then
	once the number of allowed TCP connections has been
	depleted, the next attempted TCP connection to Asterisk
	will crash due to an assertion in PJProject.</p>
	<p>If PJProject has not been compiled in debug mode, then
	any further TCP connection attempts will be rejected.
	This makes Asterisk unable to process TCP SIP traffic.</p>
	<p>Note that this only affects TCP/TLS, since UDP is
	connectionless.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-005.html</url>
	</references>
	<dates>
	<discovery>2016-02-15</discovery>
	<entry>2016-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="ee50726e-0319-11e6-aa86-001999f8d30b">
	<topic>asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>Asterisk may crash when processing an incoming REGISTER
	request if that REGISTER contains a Contact header with
	a lengthy URI.</p>
	<p>This crash will only happen for requests that pass
	authentication. Unauthenticated REGISTER requests will
	not result in a crash occurring.</p>
	<p>This vulnerability only affects Asterisk when using
	PJSIP as its SIP stack. The chan_sip module does not have
	this problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-004.html</url>
	</references>
	<dates>
	<discovery>2016-01-19</discovery>
	<entry>2016-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="f2217cdf-01e4-11e6-b1ce-002590263bf5">
	<topic>go -- remote denial of service</topic>
	<affects>
	<package>
	<name>go</name>
	<range><lt>1.6.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason Buberel reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/05/2">
	<p>Go has an infinite loop in several big integer routines that makes
	Go programs vulnerable to remote denial of service attacks. Programs
	using HTTPS client authentication or the Go ssh server libraries are
	both exposed to this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3959</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/04/05/2</url>
	<url>https://golang.org/cl/21533</url>
	</references>
	<dates>
	<discovery>2016-04-05</discovery>
	<entry>2016-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="a636fc26-00d9-11e6-b704-000c292e4fd8">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><le>3.6.25_3</le></range>
	</package>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
	</package>
	<package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><lt>4.2.11</lt></range>
	</package>
	<package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.8</lt></range>
	</package>
	<package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba team reports:</p>
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.4.2">
	<p>[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
	(crashes and high cpu consumption) and man in the middle attacks.</p>
	<p>[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected.
	A man in the middle is able to clear even required flags, especially
	NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.</p>
	<p>[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
	attackers to spoof the computer name of a secure channel's endpoints, and obtain
	sensitive session information, by running a crafted application and leveraging
	the ability to sniff network traffic.</p>
	<p>[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections
	to no integrity protection.</p>
	<p>[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
	connections (with ldaps://) and ncacn_http connections (with https://).</p>
	<p>[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.</p>
	<p>[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
	the default for most the file server related protocols) is inherited from the underlying SMB connection.</p>
	<p>[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic
	between a client and a server in order to impersonate the client and get the same privileges
	as the authenticated user account. This is most problematic against active directory domain controllers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5370</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-5370.html</url>
	<cvename>CVE-2016-2110</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2110.html</url>
	<cvename>CVE-2016-2111</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2111.html</url>
	<cvename>CVE-2016-2112</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2112.html</url>
	<cvename>CVE-2016-2113</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2113.html</url>
	<cvename>CVE-2016-2114</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2114.html</url>
	<cvename>CVE-2016-2115</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2115.html</url>
	<cvename>CVE-2016-2118</cvename>
	<url>https://www.samba.org/samba/security/CVE-2016-2118.html</url>
	</references>
	<dates>
	<discovery>2016-04-12</discovery>
	<entry>2016-04-12</entry>
	<modified>2016-04-12</modified>
	</dates>
	</vuln>

	<vuln vid="482d40cb-f9a3-11e5-92ce-002590263bf5">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70</name>
	<name>php70-fileinfo</name>
	<name>php70-mbstring</name>
	<name>php70-phar</name>
	<name>php70-snmp</name>
	<range><lt>7.0.5</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-fileinfo</name>
	<name>php56-mbstring</name>
	<name>php56-phar</name>
	<name>php56-snmp</name>
	<range><lt>5.6.20</lt></range>
	</package>
	<package>
	<name>php55</name>
	<name>php55-fileinfo</name>
	<name>php55-mbstring</name>
	<name>php55-phar</name>
	<name>php55-snmp</name>
	<range><lt>5.5.34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Group reports:</p>
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.5">
	<ul><li>Fileinfo:
	<ul>
	<li>Fixed bug #71527 (Buffer over-write in finfo_open with
	malformed magic file).</li>
	</ul></li>
	<li>mbstring:
	<ul>
	<li>Fixed bug #71906 (AddressSanitizer: negative-size-param (-1)
	in mbfl_strcut).</li>
	</ul></li>
	<li>Phar:
	<ul>
	<li>Fixed bug #71860 (Invalid memory write in phar on filename with
	\0 in name).</li>
	</ul></li>
	<li>SNMP:
	<ul>
	<li>Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
	</li>
	</ul></li>
	<li>Standard:
	<ul>
	<li>Fixed bug #71798 (Integer Overflow in php_raw_url_encode).</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/208465</freebsdpr>
	<url>http://php.net/ChangeLog-7.php#7.0.5</url>
	<url>http://php.net/ChangeLog-5.php#5.6.20</url>
	<url>http://php.net/ChangeLog-5.php#5.5.34</url>
	</references>
	<dates>
	<discovery>2016-03-31</discovery>
	<entry>2016-04-03</entry>
	</dates>
	</vuln>

	<vuln vid="497b82e0-f9a0-11e5-92ce-002590263bf5">
	<topic>pcre -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><lt>8.38_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283">
	<p>The pcre_compile2 function in pcre_compile.c in PCRE 8.38
	mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99\|(:(?\|(?'R')(\k'R')\|((?'R')))H'R'R)(H'R))))))/
	pattern and related patterns with named subgroups, which allows
	remote attackers to cause a denial of service (heap-based buffer
	overflow) or possibly have unspecified other impact via a crafted
	regular expression, as demonstrated by a JavaScript RegExp object
	encountered by Konqueror.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1283</cvename>
	<freebsdpr>ports/208260</freebsdpr>
	<url>https://bugs.exim.org/show_bug.cgi?id=1767</url>
	</references>
	<dates>
	<discovery>2016-02-27</discovery>
	<entry>2016-04-03</entry>
	</dates>
	</vuln>

	<vuln vid="df328fac-f942-11e5-92ce-002590263bf5">
	<topic>py-djblets -- Self-XSS vulnerability</topic>
	<affects>
	<package>
	<name>py27-djblets</name>
	<name>py32-djblets</name>
	<name>py33-djblets</name>
	<name>py34-djblets</name>
	<name>py35-djblets</name>
	<range><lt>0.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Djblets Release Notes reports:</p>
	<blockquote cite="https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/">
	<p>A recently-discovered vulnerability in the datagrid templates allows an
	attacker to generate a URL to any datagrid page containing malicious code
	in a column sorting value. If the user visits that URL and then clicks
	that column, the code will execute.</p>
	<p>The cause of the vulnerability was due to a template not escaping
	user-provided values.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/</url>
	</references>
	<dates>
	<discovery>2016-03-01</discovery>
	<entry>2016-04-03</entry>
	</dates>
	</vuln>

	<vuln vid="a430e15d-f93f-11e5-92ce-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle28</name>
	<range><lt>2.8.11</lt></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.5</lt></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-16-0003: Incorrect capability check when displaying
	users emails in Participants list</p></li>
	<li><p>MSA-16-0004: XSS from profile fields from external db</p>
	</li>
	<li><p>MSA-16-0005: Reflected XSS in mod_data advanced search</p>
	</li>
	<li><p>MSA-16-0006: Hidden courses are shown to students in Event
	Monitor</p></li>
	<li><p>MSA-16-0007: Non-Editing Instructor role can edit exclude
	checkbox in Single View</p></li>
	<li><p>MSA-16-0008: External function get_calendar_events return
	events that pertains to hidden activities</p></li>
	<li><p>MSA-16-0009: CSRF in Assignment plugin management page</p>
	</li>
	<li><p>MSA-16-0010: Enumeration of category details possible without
	authentication</p></li>
	<li><p>MSA-16-0011: Add no referrer to links with _blank target
	attribute</p></li>
	<li><p>MSA-16-0012: External function mod_assign_save_submission
	does not check due dates</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2151</cvename>
	<cvename>CVE-2016-2152</cvename>
	<cvename>CVE-2016-2153</cvename>
	<cvename>CVE-2016-2154</cvename>
	<cvename>CVE-2016-2155</cvename>
	<cvename>CVE-2016-2156</cvename>
	<cvename>CVE-2016-2157</cvename>
	<cvename>CVE-2016-2158</cvename>
	<cvename>CVE-2016-2190</cvename>
	<cvename>CVE-2016-2159</cvename>
	<url>https://moodle.org/security/</url>
	</references>
	<dates>
	<discovery>2016-03-21</discovery>
	<entry>2016-04-03</entry>
	</dates>
	</vuln>

	<vuln vid="297117ba-f92d-11e5-92ce-002590263bf5">
	<topic>squid -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>3.5.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2016:3 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_3.txt">
	<p>Due to a buffer overrun Squid pinger binary is vulnerable to
	denial of service or information leak attack when processing
	ICMPv6 packets.</p>
	<p>This bug also permits the server response to manipulate other
	ICMP and ICMPv6 queries processing to cause information leak.</p>
	<p>This bug allows any remote server to perform a denial of service
	attack on the Squid service by crashing the pinger. This may
	affect Squid HTTP routing decisions. In some configurations,
	sub-optimal routing decisions may result in serious service
	degradation or even transaction failures.</p>
	<p>If the system does not contain buffer-overrun protection leading
	to that crash this bug will instead allow attackers to leak
	arbitrary amounts of information from the heap into Squid log
	files. This is of higher importance than usual because the pinger
	process operates with root priviliges.</p>
	</blockquote>
	<p>Squid security advisory 2016:4 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_4.txt">
	<p>Due to incorrect bounds checking Squid is vulnerable to a denial
	of service attack when processing HTTP responses.</p>
	<p>This problem allows a malicious client script and remote server
	delivering certain unusual HTTP response syntax to trigger a
	denial of service for all clients accessing the Squid service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3947</cvename>
	<cvename>CVE-2016-3948</cvename>
	<freebsdpr>ports/208463</freebsdpr>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_3.txt</url>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_4.txt</url>
	</references>
	<dates>
	<discovery>2016-03-28</discovery>
	<entry>2016-04-02</entry>
	</dates>
	</vuln>

	<vuln vid="97a24d2e-f74c-11e5-8458-6cc21735f730">
	<topic>PostgreSQL -- minor security problems.</topic>
	<affects>
	<package>
	<name>postgresql95-server</name>
	<name>postgresql95-contrib</name>
	<range><ge>9.5.0</ge><lt>9.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1656/">
	<p>Security Fixes for RLS, BRIN</p>
	<p>
	This release closes security hole CVE-2016-2193
	(https://access.redhat.com/security/cve/CVE-2016-2193), where a query
	plan might get reused for more than one ROLE in the same session.
	This could cause the wrong set of Row Level Security (RLS) policies to
	be used for the query.</p>
	<p>
	The update also fixes CVE-2016-3065
	(https://access.redhat.com/security/cve/CVE-2016-3065), a server crash
	bug triggered by using `pageinspect` with BRIN index pages. Since an
	attacker might be able to expose a few bytes of server memory, this
	crash is being treated as a security issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2193</cvename>
	<cvename>CVE-2016-3065</cvename>
	</references>
	<dates>
	<discovery>2016-03-01</discovery>
	<entry>2016-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="f7b3d1eb-f738-11e5-a710-0011d823eebd">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.577</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-08.html">
	<p>These updates resolve integer overflow vulnerabilities that
	could lead to code execution (CVE-2016-0963, CVE-2016-0993,
	CVE-2016-1010).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2016-0987, CVE-2016-0988,
	CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995,
	CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,
	CVE-2016-1000).</p>
	<p>These updates resolve a heap overflow vulnerability that could
	lead to code execution (CVE-2016-1001).</p>
	<p>These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2016-0960, CVE-2016-0961,
	CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992,
	CVE-2016-1002, CVE-2016-1005).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0960</cvename>
	<cvename>CVE-2016-0961</cvename>
	<cvename>CVE-2016-0962</cvename>
	<cvename>CVE-2016-0963</cvename>
	<cvename>CVE-2016-0986</cvename>
	<cvename>CVE-2016-0987</cvename>
	<cvename>CVE-2016-0988</cvename>
	<cvename>CVE-2016-0989</cvename>
	<cvename>CVE-2016-0990</cvename>
	<cvename>CVE-2016-0991</cvename>
	<cvename>CVE-2016-0992</cvename>
	<cvename>CVE-2016-0993</cvename>
	<cvename>CVE-2016-0994</cvename>
	<cvename>CVE-2016-0995</cvename>
	<cvename>CVE-2016-0996</cvename>
	<cvename>CVE-2016-0997</cvename>
	<cvename>CVE-2016-0998</cvename>
	<cvename>CVE-2016-0999</cvename>
	<cvename>CVE-2016-1000</cvename>
	<cvename>CVE-2016-1001</cvename>
	<cvename>CVE-2016-1002</cvename>
	<cvename>CVE-2016-1005</cvename>
	<cvename>CVE-2016-1010</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-08.html</url>
	</references>
	<dates>
	<discovery>2016-03-10</discovery>
	<entry>2016-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="4cd9b19f-f66d-11e5-b94c-001999f8d30b">
	<topic>Multiple vulnerabilities in Botan</topic>
	<affects>
	<package>
	<name>botan110</name>
	<range><lt>1.10.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The botan developers reports:</p>
	<blockquote cite="http://botan.randombit.net/security.html">
	<p>Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.</p>
	<p>Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.</p>
	<p>The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.</p>
	<p>The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.</p>
	<p>On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://botan.randombit.net/security.html</url>
	<cvename>CVE-2016-2194</cvename>
	<cvename>CVE-2016-2195</cvename>
	</references>
	<dates>
	<discovery>2016-02-01</discovery>
	<entry>2016-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="2004616d-f66c-11e5-b94c-001999f8d30b">
	<topic>Botan BER Decoder vulnerabilities</topic>
	<affects>
	<package>
	<name>botan110</name>
	<range><lt>1.10.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The botan developers reports:</p>
	<blockquote cite="http://botan.randombit.net/">
	<p>Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.</p>
	<p>Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://botan.randombit.net/security.html</url>
	<cvename>CVE-2015-5726</cvename>
	<cvename>CVE-2015-5727</cvename>
	</references>
	<dates>
	<discovery>2015-08-03</discovery>
	<entry>2016-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="e1085b15-f609-11e5-a230-0014a5a57822">
	<topic>mercurial -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mercurial</name>
	<range><lt>2.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mercurial reports:</p>
	<blockquote cite="https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html">
	<p>CVE-2016-3630: Remote code execution in binary delta decoding</p>
	<p>CVE-2016-3068: Arbitrary code execution with Git subrepos</p>
	<p>CVE-2016-3069: Arbitrary code execution when converting
	Git repos</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3630</cvename>
	<cvename>CVE-2016-3068</cvename>
	<cvename>CVE-2016-3069</cvename>
	<url>https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html</url>
	</references>
	<dates>
	<discovery>2016-03-29</discovery>
	<entry>2016-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="8be8ca39-ae70-4422-bf1a-d8fae6911c5e">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>49.0.2623.108</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html">
	<p>[594574] High CVE-2016-1646: Out-of-bounds read in V8.</p>
	<p>[590284] High CVE-2016-1647: Use-after-free in Navigation.</p>
	<p>[590455] High CVE-2016-1648: Use-after-free in Extensions.</p>
	<p>[597518] CVE-2016-1650: Various fixes from internal audits,
	fuzzing and other initiatives.</p>
	<p>Multiple vulnerabilities in V8 fixed at the tip of the
	4.9 branch</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1646</cvename>
	<cvename>CVE-2016-1647</cvename>
	<cvename>CVE-2016-1648</cvename>
	<cvename>CVE-2016-1649</cvename>
	<cvename>CVE-2016-1650</cvename>
	<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html</url>
	</references>
	<dates>
	<discovery>2016-03-24</discovery>
	<entry>2016-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="5c288f68-c7ca-4c0d-b7dc-1ec6295200b3">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>49.0.2623.87</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html">
	<p>[589838] High CVE-2016-1643: Type confusion in Blink.</p>
	<p>[590620] High CVE-2016-1644: Use-after-free in Blink.</p>
	<p>[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1643</cvename>
	<cvename>CVE-2016-1644</cvename>
	<cvename>CVE-2016-1645</cvename>
	<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html</url>
	</references>
	<dates>
	<discovery>2016-03-08</discovery>
	<entry>2016-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="cd409df7-f483-11e5-92ce-002590263bf5">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind910</name>
	<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20160309</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01351">
	<p>A response containing multiple DNS cookies causes servers with
	cookie support enabled to exit with an assertion failure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2088</cvename>
	<url>https://kb.isc.org/article/AA-01351</url>
	</references>
	<dates>
	<discovery>2016-03-09</discovery>
	<entry>2016-03-28</entry>
	</dates>
	</vuln>

	<vuln vid="cba246d2-f483-11e5-92ce-002590263bf5">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind98</name>
	<range><le>9.8.8</le></range>
	</package>
	<package>
	<name>bind99</name>
	<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20160309</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_38</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01353">
	<p>A problem parsing resource record signatures for DNAME resource
	records can lead to an assertion failure in resolver.c or db.c</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1286</cvename>
	<freebsdsa>SA-16:13.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-01353</url>
	</references>
	<dates>
	<discovery>2016-03-09</discovery>
	<entry>2016-03-28</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="c9075321-f483-11e5-92ce-002590263bf5">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind98</name>
	<range><le>9.8.8</le></range>
	</package>
	<package>
	<name>bind99</name>
	<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20160309</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_38</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01352">
	<p>An error parsing input received by the rndc control channel can
	cause an assertion failure in sexpr.c or alist.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1285</cvename>
	<freebsdsa>SA-16:13.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-01352</url>
	</references>
	<dates>
	<discovery>2016-03-09</discovery>
	<entry>2016-03-28</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="6d25c306-f3bb-11e5-92ce-002590263bf5">
	<topic>salt -- Insecure configuration of PAM external authentication service</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<range><lt>2015.5.10</lt></range>
	<range><ge>2015.8.0</ge><lt>2015.8.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SaltStack reports:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html">
	<p>This issue affects all Salt versions prior to 2015.8.8/2015.5.10
	when PAM external authentication is enabled. This issue involves
	passing an alternative PAM authentication service with a command
	that is sent to LocalClient, enabling the attacker to bypass the
	configured authentication service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-3176</cvename>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html</url>
	</references>
	<dates>
	<discovery>2016-03-17</discovery>
	<entry>2016-03-27</entry>
	</dates>
	</vuln>

	<vuln vid="a258604d-f2aa-11e5-b4a9-ac220bdcec59">
	<topic>activemq -- Unsafe deserialization</topic>
	<affects>
	<package>
	<name>activemq</name>
	<range><lt>5.13.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:</p>
	<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">
	<p>JMS Object messages depends on Java Serialization for
	marshaling/unmashaling of the message payload. There are a couple of places
	inside the broker where deserialization can occur, like web console or stomp
	object message transformation. As deserialization of untrusted data can lead to
	security flaws as demonstrated in various reports, this leaves the broker
	vulnerable to this attack vector. Additionally, applications that consume
	ObjectMessage type of messages can be vulnerable as they deserialize objects on
	ObjectMessage.getObject() calls.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</url>
	<cvename>CVE-2015-5254</cvename>
	</references>
	<dates>
	<discovery>2016-01-08</discovery>
	<entry>2016-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="950b2d60-f2a9-11e5-b4a9-ac220bdcec59">
	<topic>activemq -- Web Console Clickjacking</topic>
	<affects>
	<package>
	<name>activemq</name>
	<range><lt>5.13.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Furman reports:</p>
	<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt">
	<p>The web based administration console does not set the
	X-Frame-Options header in HTTP responses. This allows the console to be embedded
	in a frame or iframe which could then be used to cause a user to perform an
	unintended action in the console.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt</url>
	<cvename>CVE-2016-0734</cvename>
	</references>
	<dates>
	<discovery>2016-03-10</discovery>
	<entry>2016-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="a6cc5753-f29e-11e5-b4a9-ac220bdcec59">
	<topic>activemq -- Web Console Cross-Site Scripting</topic>
	<affects>
	<package>
	<name>activemq</name>
	<range><lt>5.13.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vladimir Ivanov (Positive Technologies) reports:</p>
	<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt">
	<p>Several instances of cross-site scripting vulnerabilities were
	identified to be present in the web based administration console as well as the
	ability to trigger a Java memory dump into an arbitrary folder. The root cause
	of these issues are improper user data output validation and incorrect
	permissions configured on Jolokia.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt</url>
	<cvename>CVE-2016-0782</cvename>
	</references>
	<dates>
	<discovery>2016-03-10</discovery>
	<entry>2016-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="7033b42d-ef09-11e5-b766-14dae9d210b8">
	<topic>pcre -- stack buffer overflow</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><lt>8.38</lt></range>
	</package>
	<package>
	<name>pcre2</name>
	<range><lt>10.20_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Philip Hazel reports:</p>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1791">
	<p>PCRE does not validate that handling the (*ACCEPT) verb
	will occur within the bounds of the cworkspace stack buffer, leading to
	a stack buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.exim.org/show_bug.cgi?id=1791</url>
	<cvename>CVE-2016-3191</cvename>
	</references>
	<dates>
	<discovery>2016-02-09</discovery>
	<entry>2016-03-21</entry>
	<modified>2016-03-21</modified>
	</dates>
	</vuln>

	<vuln vid="c428de09-ed69-11e5-92ce-002590263bf5">
	<topic>kamailio -- SEAS Module Heap overflow</topic>
	<affects>
	<package>
	<name>kamailio</name>
	<range><lt>4.3.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stelios Tsampas reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2016/q1/338">
	<p>A (remotely exploitable) heap overflow vulnerability was found in
	Kamailio v4.3.4.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2385</cvename>
	<url>https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643</url>
	<url>https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/</url>
	<url>http://seclists.org/oss-sec/2016/q1/338</url>
	</references>
	<dates>
	<discovery>2016-02-15</discovery>
	<entry>2016-03-19</entry>
	<modified>2016-04-03</modified>
	</dates>
	</vuln>

	<vuln vid="5dd39f26-ed68-11e5-92ce-002590263bf5">
	<topic>hadoop2 -- unauthorized disclosure of data vulnerability</topic>
	<affects>
	<package>
	<name>hadoop2</name>
	<range><ge>2.6</ge><lt>2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Arun Suresh reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser">
	<p>RPC traffic from clients, potentially including authentication
	credentials, may be intercepted by a malicious user with access to
	run tasks or containers on a cluster.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1776</cvename>
	<url>http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser</url>
	</references>
	<dates>
	<discovery>2016-02-15</discovery>
	<entry>2016-03-19</entry>
	</dates>
	</vuln>

	<vuln vid="d2a84feb-ebe0-11e5-92ce-002590263bf5">
	<topic>git -- integer overflow</topic>
	<affects>
	<package>
	<name>git</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
	</package>
	<package>
	<name>git-gui</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
	</package>
	<package>
	<name>git-lite</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
	</package>
	<package>
	<name>git-subversion</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2324">
	<p>integer overflow due to a loop which adds more to "len".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2324</cvename>
	<url>https://security-tracker.debian.org/tracker/CVE-2016-2324</url>
	<url>https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d</url>
	</references>
	<dates>
	<discovery>2016-02-24</discovery>
	<entry>2016-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="93ee802e-ebde-11e5-92ce-002590263bf5">
	<topic>git -- potential code execution</topic>
	<affects>
	<package>
	<name>git</name>
	<range><lt>2.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2315">
	<p>"int" is the wrong data type for ... nlen assignment.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2315</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/03/15/6</url>
	<url>https://marc.info/?l=oss-security&m=145809217306686&w=2</url>
	<url>https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2016-2315</url>
	</references>
	<dates>
	<discovery>2015-09-24</discovery>
	<entry>2016-03-17</entry>
	</dates>
	</vuln>

	<vuln vid="6d33b3e5-ea03-11e5-85be-14dae9d210b8">
	<topic>node -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>node</name>
	<range><lt>5.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jeremiah Senkpiel reports:</p>
	<blockquote cite="https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac">
	<ul>
	<li><p>Fix a double-free defect in parsing malformed DSA keys
	that may potentially be used for DoS or memory corruption attacks.</p></li>
	<li><p>Fix a defect that can cause memory corruption in
	certain very rare cases</p></li>
	<li><p>Fix a defect that makes the CacheBleed Attack possible</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac</url>
	<cvename>CVE-2016-0702</cvename>
	<cvename>CVE-2016-0705</cvename>
	<cvename>CVE-2016-0797</cvename>
	</references>
	<dates>
	<discovery>2016-03-02</discovery>
	<entry>2016-03-14</entry>
	</dates>
	</vuln>

	<vuln vid="8eb78cdc-e9ec-11e5-85be-14dae9d210b8">
	<topic>dropbear -- authorized_keys command= bypass</topic>
	<affects>
	<package>
	<name>dropbear</name>
	<range><lt>2016.72</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matt Johnson reports:</p>
	<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
	<p>Validate X11 forwarding input. Could allow bypass of
	authorized_keys command= restrictions</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
	<cvename>CVE-2016-3116</cvename>
	</references>
	<dates>
	<discovery>2016-03-11</discovery>
	<entry>2016-03-14</entry>
	</dates>
	</vuln>

	<vuln vid="77b7ffb7-e937-11e5-8bed-5404a68ad561">
	<topic>jpgraph2 -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>jpgraph2</name>
	<range><lt>3.0.7_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin Barbella reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded">
	<p>JpGraph is an object oriented library for PHP that can be used to create
	various types of graphs which also contains support for client side
	image maps.

	The GetURLArguments function for the JpGraph's Graph class does not
	properly sanitize the names of get and post variables, leading to a
	cross site scripting vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded</url>
	</references>
	<dates>
	<discovery>2009-12-22</discovery>
	<entry>2016-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="5af511e5-e928-11e5-92ce-002590263bf5">
	<topic>php7 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php70</name>
	<name>php70-soap</name>
	<range><lt>7.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Group reports:</p>
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.4">
	<ul><li>Core:
	<ul>
	<li>Fixed bug #71637 (Multiple Heap Overflow due to integer
	overflows in xml/filter_url/addcslashes).</li>
	</ul></li>
	<li>SOAP:
	<ul>
	<li>Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
	make_http_soap_request()).</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-7.php#7.0.4</url>
	</references>
	<dates>
	<discovery>2016-03-03</discovery>
	<entry>2016-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="e991ef79-e920-11e5-92ce-002590263bf5">
	<topic>php5 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php55-phar</name>
	<name>php55-wddx</name>
	<range><lt>5.5.33</lt></range>
	</package>
	<package>
	<name>php56-phar</name>
	<name>php56-wddx</name>
	<range><lt>5.6.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Group reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.6.19">
	<ul><li>Phar:
	<ul>
	<li>Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
	</li>
	</ul></li>
	<li>WDDX:
	<ul>
	<li>Fixed bug #71587 (Use-After-Free / Double-Free in WDDX
	Deserialize).</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-5.php#5.6.19</url>
	<url>http://php.net/ChangeLog-5.php#5.5.33</url>
	</references>
	<dates>
	<discovery>2016-03-03</discovery>
	<entry>2016-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="e4644df8-e7da-11e5-829d-c80aa9043978">
	<topic>openssh -- command injection when X11Forwarding is enabled</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><lt>7.2.p2,1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_14</lt></range>
	<range><ge>10.1</ge><lt>10.1_31</lt></range>
	<range><ge>9.3</ge><lt>9.3_39</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSH project reports:</p>
	<blockquote cite="http://www.openssh.com/txt/x11fwd.adv">
	<p>Missing sanitisation of untrusted input allows an
	authenticated user who is able to request X11 forwarding
	to inject commands to xauth(1).
	</p>
	<p>Injection of xauth commands grants the ability to read
	arbitrary files under the authenticated user's privilege,
	Other xauth commands allow limited information leakage,
	file overwrite, port probing and generally expose xauth(1),
	which was not written with a hostile user in mind, as an
	attack surface.
	</p>
	<p>Mitigation:</p>
	<p>Set X11Forwarding=no in sshd_config. This is the default.</p>
	<p>For authorized_keys that specify a "command" restriction,
	also set the "restrict" (available in OpenSSH >=7.2) or
	"no-x11-forwarding" restrictions.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openssh.com/txt/x11fwd.adv</url>
	<cvename>CVE-2016-3115</cvename>
	<freebsdsa>SA-16:14.openssh</freebsdsa>
	</references>
	<dates>
	<discovery>2016-03-11</discovery>
	<entry>2016-03-11</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="70c44cd0-e717-11e5-85be-14dae9d210b8">
	<topic>quagga -- stack based buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>1.0.20160309</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Donald Sharp reports:</p>
	<blockquote cite="https://www.kb.cert.org/vuls/id/270232">
	<p>A malicious BGP peer may execute arbitrary code in
	particularly configured remote bgpd hosts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.kb.cert.org/vuls/id/270232</url>
	<url>http://savannah.nongnu.org/forum/forum.php?forum_id=8476</url>
	<cvename>CVE-2016-2342</cvename>
	</references>
	<dates>
	<discovery>2016-01-27</discovery>
	<entry>2016-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="d71831ef-e6f8-11e5-85be-14dae9d210b8">
	<topic>ricochet -- information disclosure</topic>
	<affects>
	<package>
	<name>ricochet</name>
	<range><lt>1.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>special reports:</p>
	<blockquote cite="https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2">
	<p>By sending a nickname with some HTML tags in a contact
	request, an attacker could cause Ricochet to make network requests
	without Tor after the request is accepted, which would reveal the user's
	IP address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2</url>
	</references>
	<dates>
	<discovery>2016-02-15</discovery>
	<entry>2016-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="77e0b631-e6cf-11e5-85be-14dae9d210b8">
	<topic>pidgin-otr -- use after free</topic>
	<affects>
	<package>
	<name>pidgin-otr</name>
	<range><lt>4.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanno Bock reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2016/q1/572">
	<p>The pidgin-otr plugin version 4.0.2 fixes a heap use after
	free error.
	The bug is triggered when a user tries to authenticate a buddy and
	happens in the function create_smp_dialog.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2016/q1/572</url>
	<url>https://bugs.otr.im/issues/88</url>
	<url>https://bugs.otr.im/issues/128</url>
	<cvename>CVE-2015-8833</cvename>
	</references>
	<dates>
	<discovery>2015-04-04</discovery>
	<entry>2016-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="c2b1652c-e647-11e5-85be-14dae9d210b8">
	<topic>libotr -- integer overflow</topic>
	<affects>
	<package>
	<name>libotr</name>
	<range><lt>4.1.1</lt></range>
	</package>
	<package>
	<name>libotr3</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>X41 D-Sec reports:</p>
	<blockquote cite="https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/">
	<p>A remote attacker may crash or execute arbitrary code in
	libotr by sending large OTR messages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/</url>
	<cvename>CVE-2016-2851</cvename>
	</references>
	<dates>
	<discovery>2016-02-17</discovery>
	<entry>2016-03-09</entry>
	<modified>2016-03-09</modified>
	</dates>
	</vuln>

	<vuln vid="1bcfd963-e483-41b8-ab8e-bad5c3ce49c9">
	<topic>brotli -- buffer overflow</topic>
	<affects>
	<package>
	<name>brotli</name>
	<range><ge>0.3.0</ge><lt>0.3.0_1</lt></range>
	<range><lt>0.2.0_2</lt></range>
	</package>
	<package>
	<name>libbrotli</name>
	<range><lt>0.3.0_3</lt></range>
	</package>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.109</lt></range>
	</package>
	<package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.7.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
	<p>[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.</p>
	</blockquote>
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/">
	<p>Security researcher Luke Li reported a pointer underflow
	bug in the Brotli library's decompression that leads to a
	buffer overflow. This results in a potentially exploitable
	crash when triggered.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1624</cvename>
	<cvename>CVE-2016-1968</cvename>
	<url>https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade</url>
	<url>https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-30/</url>
	<url>https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e</url>
	</references>
	<dates>
	<discovery>2016-02-08</discovery>
	<entry>2016-03-08</entry>
	<modified>2016-03-08</modified>
	</dates>
	</vuln>

	<vuln vid="2225c5b4-1e5a-44fc-9920-b3201c384a15">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.7.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45">
	<p>MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0
	/ rv:38.7)</p>
	<p>MFSA 2016-17 Local file overwriting and potential
	privilege escalation through CSP reports</p>
	<p>MFSA 2016-18 CSP reports fail to strip location
	information for embedded iframe pages</p>
	<p>MFSA 2016-19 Linux video memory DOS with Intel
	drivers</p>
	<p>MFSA 2016-20 Memory leak in libstagefright when deleting
	an array during MP4 processing</p>
	<p>MFSA 2016-21 Displayed page address can be overridden</p>
	<p>MFSA 2016-22 Service Worker Manager out-of-bounds read in
	Service Worker Manager</p>
	<p>MFSA 2016-23 Use-after-free in HTML5 string parser</p>
	<p>MFSA 2016-24 Use-after-free in SetBody</p>
	<p>MFSA 2016-25 Use-after-free when using multiple WebRTC
	data channels</p>
	<p>MFSA 2016-26 Memory corruption when modifying a file
	being read by FileReader</p>
	<p>MFSA 2016-27 Use-after-free during XML
	transformations</p>
	<p>MFSA 2016-28 Addressbar spoofing though history
	navigation and Location protocol property</p>
	<p>MFSA 2016-29 Same-origin policy violation using
	perfomance.getEntries and history navigation with session
	restore</p>
	<p>MFSA 2016-31 Memory corruption with malicious NPAPI
	plugin</p>
	<p>MFSA 2016-32 WebRTC and LibVPX vulnerabilities found
	through code inspection</p>
	<p>MFSA 2016-33 Use-after-free in GetStaticInstance in
	WebRTC</p>
	<p>MFSA 2016-34 Out-of-bounds read in HTML parser following
	a failed allocation</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1952</cvename>
	<cvename>CVE-2016-1953</cvename>
	<cvename>CVE-2016-1954</cvename>
	<cvename>CVE-2016-1955</cvename>
	<cvename>CVE-2016-1956</cvename>
	<cvename>CVE-2016-1957</cvename>
	<cvename>CVE-2016-1958</cvename>
	<cvename>CVE-2016-1959</cvename>
	<cvename>CVE-2016-1960</cvename>
	<cvename>CVE-2016-1961</cvename>
	<cvename>CVE-2016-1962</cvename>
	<cvename>CVE-2016-1963</cvename>
	<cvename>CVE-2016-1964</cvename>
	<cvename>CVE-2016-1965</cvename>
	<cvename>CVE-2016-1966</cvename>
	<cvename>CVE-2016-1967</cvename>
	<cvename>CVE-2016-1970</cvename>
	<cvename>CVE-2016-1971</cvename>
	<cvename>CVE-2016-1972</cvename>
	<cvename>CVE-2016-1973</cvename>
	<cvename>CVE-2016-1974</cvename>
	<cvename>CVE-2016-1975</cvename>
	<cvename>CVE-2016-1976</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-16/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-17/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-18/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-19/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-20/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-21/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-22/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-23/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-24/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-25/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-26/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-27/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-28/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-29/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-31/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-32/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-33/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-34/</url>
	</references>
	<dates>
	<discovery>2016-03-08</discovery>
	<entry>2016-03-08</entry>
	<modified>2016-03-08</modified>
	</dates>
	</vuln>

	<vuln vid="adffe823-e692-4921-ae9c-0b825c218372">
	<topic>graphite2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>graphite2</name>
	<range><lt>1.3.6</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/">
	<p>Security researcher Holger Fuhrmannek and Mozilla
	security engineer Tyson Smith reported a number of security
	vulnerabilities in the Graphite 2 library affecting version
	1.3.5.

	The issue reported by Holger Fuhrmannek is a mechanism to
	induce stack corruption with a malicious graphite font. This
	leads to a potentially exploitable crash when the font is
	loaded.

	Tyson Smith used the Address Sanitizer tool in concert with
	a custom software fuzzer to find a series of uninitialized
	memory, out-of-bounds read, and out-of-bounds write errors
	when working with fuzzed graphite fonts.</p>
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/">
	<p>Security researcher James Clawson used the Address
	Sanitizer tool to discover an out-of-bounds write in the
	Graphite 2 library when loading a crafted Graphite font
	file. This results in a potentially exploitable crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-37/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-38/</url>
	<cvename>CVE-2016-1969</cvename>
	<cvename>CVE-2016-1977</cvename>
	<cvename>CVE-2016-2790</cvename>
	<cvename>CVE-2016-2791</cvename>
	<cvename>CVE-2016-2792</cvename>
	<cvename>CVE-2016-2793</cvename>
	<cvename>CVE-2016-2794</cvename>
	<cvename>CVE-2016-2795</cvename>
	<cvename>CVE-2016-2796</cvename>
	<cvename>CVE-2016-2797</cvename>
	<cvename>CVE-2016-2798</cvename>
	<cvename>CVE-2016-2799</cvename>
	<cvename>CVE-2016-2800</cvename>
	<cvename>CVE-2016-2801</cvename>
	<cvename>CVE-2016-2802</cvename>
	</references>
	<dates>
	<discovery>2016-03-08</discovery>
	<entry>2016-03-08</entry>
	<modified>2016-03-14</modified>
	</dates>
	</vuln>

	<vuln vid="c4292768-5273-4f17-a267-c5fe35125ce4">
	<topic>NSS -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nss</name>
	<range><ge>3.20</ge><lt>3.21.1</lt></range>
	<range><lt>3.19.2.3</lt></range>
	</package>
	<package>
	<name>linux-c6-nss</name>
	<range><ge>3.20</ge><lt>3.21.0_1</lt></range>
	<range><lt>3.19.2.3</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-35/">
	<p>Security researcher Francis Gabriel reported a heap-based
	buffer overflow in the way the Network Security Services
	(NSS) libraries parsed certain ASN.1 structures. An attacker
	could create a specially-crafted certificate which, when
	parsed by NSS, would cause it to crash or execute arbitrary
	code with the permissions of the user.</p>
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-36/">
	<p>Mozilla developer Tim Taubert used the Address Sanitizer
	tool and software fuzzing to discover a use-after-free
	vulnerability while processing DER encoded keys in the
	Network Security Services (NSS) libraries. The vulnerability
	overwrites the freed memory with zeroes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1950</cvename>
	<cvename>CVE-2016-1979</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-35/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-36/</url>
	<url>https://hg.mozilla.org/projects/nss/rev/b9a31471759d</url>
	<url>https://hg.mozilla.org/projects/nss/rev/7033b1193c94</url>
	</references>
	<dates>
	<discovery>2016-03-08</discovery>
	<entry>2016-03-08</entry>
	<modified>2016-09-05</modified>
	</dates>
	</vuln>

	<vuln vid="75091516-6f4b-4059-9884-6727023dc366">
	<topic>NSS -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nss</name>
	<name>linux-c6-nss</name>
	<range><lt>3.21</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>44.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.41</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/">
	<p>Security researcher Hanno Böck reported that calculations
	with mp_div and mp_exptmod in Network Security Services
	(NSS) can produce wrong results in some circumstances. These
	functions are used within NSS for a variety of cryptographic
	division functions, leading to potential cryptographic
	weaknesses.</p>
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/">
	<p>Mozilla developer Eric Rescorla reported that a failed
	allocation during DHE and ECDHE handshakes would lead to a
	use-after-free vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1938</cvename>
	<cvename>CVE-2016-1978</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-07/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-15/</url>
	<url>https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a</url>
	<url>https://hg.mozilla.org/projects/nss/rev/a245a4ccd354</url>
	</references>
	<dates>
	<discovery>2016-01-26</discovery>
	<entry>2016-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<name>py32-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<name>py35-django</name>
	<range><lt>1.8.10</lt></range>
	</package>
	<package>
	<name>py27-django18</name>
	<name>py32-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<name>py35-django18</name>
	<range><lt>1.8.10</lt></range>
	</package>
	<package>
	<name>py27-django19</name>
	<name>py32-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<range><lt>1.9.3</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<name>py32-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<name>py35-django-devel</name>
	<range><le>20150709,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Graham reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
	<p>Malicious redirect and possible XSS attack via user-supplied
	redirect URLs containing basic auth</p>
	<p>User enumeration through timing difference on password hasher work
	factor upgrade</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2512</cvename>
	<cvename>CVE-2016-2513</cvename>
	<url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
	</references>
	<dates>
	<discovery>2016-03-01</discovery>
	<entry>2016-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.4.2,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samuel Sidler reports:</p>
	<blockquote cite="https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/">
	<p>WordPress 4.4.2 is now available. This is a security release for
	all previous versions and we strongly encourage you to update your
	sites immediately.</p>
	<p>WordPress versions 4.4.1 and earlier are affected by two security
	issues: a possible SSRF for certain local URIs, reported by Ronni
	Skansing; and an open redirection attack, reported by Shailesh
	Suthar.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2221</cvename>
	<cvename>CVE-2016-2222</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/02/04/6</url>
	<url>https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2016-02-02</discovery>
	<entry>2016-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
	<topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
	<affects>
	<package>
	<name>putty</name>
	<range><lt>0.67</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon G. Tatham reports:</p>
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
	<p>Many versions of PSCP prior to 0.67 have a stack corruption
	vulnerability in their treatment of the 'sink' direction (i.e.
	downloading from server to client) of the old-style SCP protocol.
	</p>
	<p>In order for this vulnerability to be exploited, the user must
	connect to a malicious server and attempt to download any file.[...]
	you can work around it in a vulnerable PSCP by using the -sftp
	option to force the use of the newer SFTP protocol, provided your
	server supports that protocol.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
	<cvename>CVE-2016-2563</cvename>
	<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
	</references>
	<dates>
	<discovery>2016-02-26</discovery>
	<entry>2016-03-07</entry>
	</dates>
	</vuln>

	<vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
	<topic>websvn -- reflected cross-site scripting</topic>
	<affects>
	<package>
	<name>websvn</name>
	<range><lt>2.3.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastien Delafond reports:</p>
	<blockquote cite="https://lists.debian.org/debian-security-announce/2016/msg00060.html">
	<p>Jakub Palaczynski discovered that websvn, a web viewer for
	Subversion repositories, does not correctly sanitize user-supplied
	input, which allows a remote user to run reflected cross-site
	scripting attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2511</cvename>
	<url>https://lists.debian.org/debian-security-announce/2016/msg00060.html</url>
	<url>http://seclists.org/fulldisclosure/2016/Feb/99</url>
	</references>
	<dates>
	<discovery>2016-02-22</discovery>
	<entry>2016-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="f69e1f09-e39b-11e5-9f77-5453ed2e2b49">
	<topic>websvn -- information disclosure</topic>
	<affects>
	<package>
	<name>websvn</name>
	<range><lt>2.3.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thijs Kinkhorst reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682">
	<p>James Clawson reported:</p>
	<p>"Arbitrary files with a known path can be accessed in websvn by
	committing a symlink to a repository and then downloading the file
	(using the download link).</p>
	<p>An attacker must have write access to the repo, and the download
	option must have been enabled in the websvn config file."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6892</cvename>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892</url>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682</url>
	</references>
	<dates>
	<discovery>2015-01-18</discovery>
	<entry>2016-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="5a016dd0-8aa8-490e-a596-55f4cc17e4ef">
	<topic>rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.22.2</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack4</name>
	<range><lt>4.2.5.2</lt></range>
	</package>
	<package>
	<name>rubygem-actionview</name>
	<range><lt>4.2.5.2</lt></range>
	</package>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.22.2</lt></range>
	</package>
	<package>
	<name>rubygem-rails4</name>
	<range><lt>4.2.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails blog:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/">
	<p>Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These
	contain the following important security fixes, and it is
	recommended that users upgrade as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2097</cvename>
	<cvename>CVE-2016-2098</cvename>
	<url>https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ</url>
	<url>http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/</url>
	</references>
	<dates>
	<discovery>2016-02-29</discovery>
	<entry>2016-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>49.0.2623.75</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
	<p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p>
	<p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p>
	<p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p>
	<p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p>
	<p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p>
	<p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p>
	<p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p>
	<p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p>
	<p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p>
	<p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p>
	<p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p>
	<p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p>
	<p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p>
	<p>Multiple vulnerabilities in V8 fixed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1630</cvename>
	<cvename>CVE-2016-1631</cvename>
	<cvename>CVE-2016-1632</cvename>
	<cvename>CVE-2016-1633</cvename>
	<cvename>CVE-2016-1634</cvename>
	<cvename>CVE-2016-1635</cvename>
	<cvename>CVE-2016-1636</cvename>
	<cvename>CVE-2016-1637</cvename>
	<cvename>CVE-2016-1638</cvename>
	<cvename>CVE-2016-1639</cvename>
	<cvename>CVE-2016-1640</cvename>
	<cvename>CVE-2016-1641</cvename>
	<cvename>CVE-2016-1642</cvename>
	<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2016-03-02</discovery>
	<entry>2016-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
	<topic>libssh -- weak Diffie-Hellman secret generation</topic>
	<affects>
	<package>
	<name>libssh</name>
	<range><lt>0.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andreas Schneider reports:</p>
	<blockquote cite="https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/">
	<p>libssh versions 0.1 and above have a bits/bytes confusion bug and
	generate an abnormally short ephemeral secret for the
	diffie-hellman-group1 and diffie-hellman-group14 key exchange
	methods. The resulting secret is 128 bits long, instead of the
	recommended sizes of 1024 and 2048 bits respectively. There are
	practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can
	solve this problem in O(2^63) operations.</p>
	<p>Both client and server are are vulnerable, pre-authentication.
	This vulnerability could be exploited by an eavesdropper with enough
	resources to decrypt or intercept SSH sessions. The bug was found
	during an internal code review by Aris Adamantiadis of the libssh
	team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0739</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739</url>
	<url>https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/</url>
	</references>
	<dates>
	<discovery>2016-02-23</discovery>
	<entry>2016-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="7d09b9ee-e0ba-11e5-abc4-6fb07af136d2">
	<topic>exim -- local privillege escalation</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><lt>4.86.2</lt></range>
	<range><lt>4.85.2</lt></range>
	<range><lt>4.84.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Exim development team reports:</p>
	<blockquote cite="https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html">
	<p>All installations having Exim set-uid root and using 'perl_startup' are
	vulnerable to a local privilege escalation. Any user who can start an
	instance of Exim (and this is normally <strong>any</strong> user) can gain root
	privileges. If you do not use 'perl_startup' you <strong>should</strong> be safe.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1531</cvename>
	<url>https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html</url>
	</references>
	<dates>
	<discovery>2016-02-26</discovery>
	<entry>2016-03-02</entry>
	</dates>
	</vuln>

	<vuln vid="db3301be-e01c-11e5-b2bd-002590263bf5">
	<topic>cacti -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.8g</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cacti Group, Inc. reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8g.php">
	<p>Changelog</p>
	<ul>
	<li>bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php</li>
	<li>bug:0002655: CVE-2015-8377: SQL injection vulnerability in the
	host_new_graphs_save function in graphs_new.php</li>
	<li>bug:0002656: Authentication using web authentication as a user
	not in the cacti database allows complete access</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8377</cvename>
	<cvename>CVE-2015-8604</cvename>
	<cvename>CVE-2016-2313</cvename>
	<url>http://www.cacti.net/release_notes_0_8_8g.php</url>
	<url>http://bugs.cacti.net/view.php?id=2652</url>
	<url>http://bugs.cacti.net/view.php?id=2655</url>
	<url>http://bugs.cacti.net/view.php?id=2656</url>
	<url>http://www.openwall.com/lists/oss-security/2016/02/09/3</url>
	</references>
	<dates>
	<discovery>2016-02-21</discovery>
	<entry>2016-03-02</entry>
	</dates>
	</vuln>

	<vuln vid="f682a506-df7c-11e5-81e4-6805ca0b3d42">
	<topic>phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-10/">
	<p>XSS vulnerability in SQL parser.</p>
	<p>Using a crafted SQL query, it is possible to trigger an XSS
	attack through the SQL query page.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-11/">
	<p>Multiple XSS vulnerabilities.</p>
	<p>By sending a specially crafted URL as part of the HOST
	header, it is possible to trigger an XSS attack.</p>
	<p>A weakness was found that allows an XSS attack with Internet
	Explorer versions older than 8 and Safari on Windows using a
	specially crafted URL.</p>
	<p>Using a crafted SQL query, it is possible to trigger an XSS
	attack through the SQL query page.</p>
	<p>Using a crafted parameter value, it is possible to trigger
	an XSS attack in user accounts page.</p>
	<p>Using a crafted parameter value, it is possible to trigger
	an XSS attack in zoom search page.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-12/">
	<p>Multiple XSS vulnerabilities.</p>
	<p>With a crafted table/column name it is possible to trigger
	an XSS attack in the database normalization page.</p>
	<p>With a crafted parameter it is possible to trigger an XSS
	attack in the database structure page.</p>
	<p>With a crafted parameter it is possible to trigger an XSS
	attack in central columns page.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-13/">
	<p>Vulnerability allowing man-in-the-middle attack on API
	call to GitHub.</p>
	<p>A vulnerability in the API call to GitHub can be exploited
	to perform a man-in-the-middle attack.</p>
	<p>We consider this vulnerability to be serious.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-10/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-11/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-12/</url>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-13/</url>
	<cvename>CVE-2016-2559</cvename>
	<cvename>CVE-2016-2560</cvename>
	<cvename>CVE-2016-2561</cvename>
	<cvename>CVE-2016-2562</cvename>
	</references>
	<dates>
	<discovery>2016-02-29</discovery>
	<entry>2016-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="45117749-df55-11e5-b2bd-002590263bf5">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html">
	<p>The following vulnerabilities have been fixed:</p>
	<ul>
	<li><p>wnpa-sec-2016-02</p>
	<p>ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522</p></li>
	<li><p>wnpa-sec-2016-03</p>
	<p>DNP dissector infinite loop. (Bug 11938) CVE-2016-2523</p></li>
	<li><p>wnpa-sec-2016-04</p>
	<p>X.509AF dissector crash. (Bug 12002) CVE-2016-2524</p></li>
	<li><p>wnpa-sec-2016-05</p>
	<p>HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525</p></li>
	<li><p>wnpa-sec-2016-06</p>
	<p>HiQnet dissector crash. (Bug 11983) CVE-2016-2526</p></li>
	<li><p>wnpa-sec-2016-07</p>
	<p>3GPP TS 32.423 Trace file parser crash. (Bug 11982)
	</p>CVE-2016-2527</li>
	<li><p>wnpa-sec-2016-08</p>
	<p>LBMC dissector crash. (Bug 11984) CVE-2016-2528</p></li>
	<li><p>wnpa-sec-2016-09</p>
	<p>iSeries file parser crash. (Bug 11985) CVE-2016-2529</p></li>
	<li><p>wnpa-sec-2016-10</p>
	<p>RSL dissector crash. (Bug 11829) CVE-2016-2530
	CVE-2016-2531</p></li>
	<li><p>wnpa-sec-2016-11</p>
	<p>LLRP dissector crash. (Bug 12048) CVE-2016-2532</p></li>
	<li><p>wnpa-sec-2016-12</p>
	<p>Ixia IxVeriWave file parser crash. (Bug 11795)</p></li>
	<li><p>wnpa-sec-2016-13</p>
	<p>IEEE 802.11 dissector crash. (Bug 11818)</p></li>
	<li><p>wnpa-sec-2016-14</p>
	<p>GSM A-bis OML dissector crash. (Bug 11825)</p></li>
	<li><p>wnpa-sec-2016-15</p>
	<p>ASN.1 BER dissector crash. (Bug 12106)</p></li>
	<li><p>wnpa-sec-2016-16</p>
	<p>SPICE dissector large loop. (Bug 12151)</p></li>
	<li><p>wnpa-sec-2016-17</p>
	<p>NFS dissector crash.</p></li>
	<li><p>wnpa-sec-2016-18</p>
	<p>ASN.1 BER dissector crash. (Bug 11822)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2522</cvename>
	<cvename>CVE-2016-2523</cvename>
	<cvename>CVE-2016-2524</cvename>
	<cvename>CVE-2016-2525</cvename>
	<cvename>CVE-2016-2526</cvename>
	<cvename>CVE-2016-2527</cvename>
	<cvename>CVE-2016-2528</cvename>
	<cvename>CVE-2016-2529</cvename>
	<cvename>CVE-2016-2530</cvename>
	<cvename>CVE-2016-2531</cvename>
	<cvename>CVE-2016-2532</cvename>
	<cvename>CVE-2016-4415</cvename>
	<cvename>CVE-2016-4416</cvename>
	<cvename>CVE-2016-4417</cvename>
	<cvename>CVE-2016-4418</cvename>
	<cvename>CVE-2016-4419</cvename>
	<cvename>CVE-2016-4420</cvename>
	<cvename>CVE-2016-4421</cvename>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/05/01/1</url>
	</references>
	<dates>
	<discovery>2016-02-26</discovery>
	<entry>2016-03-01</entry>
	<modified>2016-07-04</modified>
	</dates>
	</vuln>

	<vuln vid="42c2c422-df55-11e5-b2bd-002590263bf5">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html">
	<p>The following vulnerabilities have been fixed:</p>
	<ul>
	<li><p>wnpa-sec-2015-31</p>
	<p>NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)</p>
	</li>
	<li><p>wnpa-sec-2015-37</p>
	<p>NLM dissector crash.</p></li>
	<li><p>wnpa-sec-2015-39</p>
	<p>BER dissector crash.</p></li>
	<li><p>wnpa-sec-2015-40</p>
	<p>Zlib decompression crash. (Bug 11548)</p></li>
	<li><p>wnpa-sec-2015-41</p>
	<p>SCTP dissector crash. (Bug 11767)</p></li>
	<li><p>wnpa-sec-2015-42</p>
	<p>802.11 decryption crash. (Bug 11790, Bug 11826)</p></li>
	<li><p>wnpa-sec-2015-43</p>
	<p>DIAMETER dissector crash. (Bug 11792)</p></li>
	<li><p>wnpa-sec-2015-44</p>
	<p>VeriWave file parser crashes. (Bug 11789, Bug 11791)</p></li>
	<li><p>wnpa-sec-2015-45</p>
	<p>RSVP dissector crash. (Bug 11793)</p></li>
	<li><p>wnpa-sec-2015-46</p>
	<p>ANSI A and GSM A dissector crashes. (Bug 11797)</p></li>
	<li><p>wnpa-sec-2015-47</p>
	<p>Ascend file parser crash. (Bug 11794)</p></li>
	<li><p>wnpa-sec-2015-48</p>
	<p>NBAP dissector crash. (Bug 11815)</p></li>
	<li><p>wnpa-sec-2015-49</p>
	<p>RSL dissector crash. (Bug 11829)</p></li>
	<li><p>wnpa-sec-2015-50</p>
	<p>ZigBee ZCL dissector crash. (Bug 11830)</p></li>
	<li><p>wnpa-sec-2015-51</p>
	<p>Sniffer file parser crash. (Bug 11827)</p></li>
	<li><p>wnpa-sec-2015-52</p>
	<p>NWP dissector crash. (Bug 11726)</p></li>
	<li><p>wnpa-sec-2015-53</p>
	<p>BT ATT dissector crash. (Bug 11817)</p></li>
	<li><p>wnpa-sec-2015-54</p>
	<p>MP2T file parser crash. (Bug 11820)</p></li>
	<li><p>wnpa-sec-2015-55</p>
	<p>MP2T file parser crash. (Bug 11821)</p></li>
	<li><p>wnpa-sec-2015-56</p>
	<p>S7COMM dissector crash. (Bug 11823)</p></li>
	<li><p>wnpa-sec-2015-57</p>
	<p>IPMI dissector crash. (Bug 11831)</p></li>
	<li><p>wnpa-sec-2015-58</p>
	<p>TDS dissector crash. (Bug 11846)</p></li>
	<li><p>wnpa-sec-2015-59</p>
	<p>PPI dissector crash. (Bug 11876)</p></li>
	<li><p>wnpa-sec-2015-60</p>
	<p>MS-WSP dissector crash. (Bug 11931)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
	</references>
	<dates>
	<discovery>2015-12-29</discovery>
	<entry>2016-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="7bbc3016-de63-11e5-8fa8-14dae9d210b8">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.68</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Thomas reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
	<ul>
	<li><p>CVE-2015-5346 Apache Tomcat Session fixation</p></li>
	<li><p>CVE-2015-5351 Apache Tomcat CSRF token leak</p></li>
	<li><p>CVE-2016-0763 Apache Tomcat Security Manager Bypass</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
	<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e</url>
	<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e</url>
	<cvename>CVE-2015-5346</cvename>
	<cvename>CVE-2015-5351</cvename>
	<cvename>CVE-2016-0763</cvename>
	</references>
	<dates>
	<discovery>2016-02-22</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="1f1124fe-de5c-11e5-8fa8-14dae9d210b8">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><lt>6.0.45</lt></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.68</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Thomas reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
	<ul>
	<li><p>CVE-2015-5345 Apache Tomcat Directory disclosure</p></li>
	<li><p>CVE-2016-0706 Apache Tomcat Security Manager bypass</p></li>
	<li><p>CVE-2016-0714 Apache Tomcat Security Manager Bypass</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
	<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e</url>
	<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e</url>
	<cvename>CVE-2015-5345</cvename>
	<cvename>CVE-2015-5346</cvename>
	<cvename>CVE-2016-0706</cvename>
	<cvename>CVE-2016-0714</cvename>
	</references>
	<dates>
	<discovery>2016-02-22</discovery>
	<entry>2016-02-28</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="a7f2e9c6-de20-11e5-8458-6cc21735f730">
	<topic>xerces-c3 -- Parser Crashes on Malformed Input</topic>
	<affects>
	<package>
	<name>xerces-c3</name>
	<range><lt>3.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt">
	<p>The Xerces-C XML parser mishandles certain kinds of malformed input
	documents, resulting in buffer overflows during processing and error
	reporting. The overflows can manifest as a segmentation fault or as
	memory corruption during a parse operation. The bugs allow for a
	denial of service attack in many applications by an unauthenticated
	attacker, and could conceivably result in remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0729</cvename>
	<url>http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt</url>
	</references>
	<dates>
	<discovery>2016-02-25</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8">
	<topic>django -- regression in permissions model</topic>
	<affects>
	<package>
	<name>py27-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<range><lt>1.9.2</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<name>py35-django-devel</name>
	<range><le>20150709,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Graham reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/">
	<p>User with "change" but not "add" permission can create
	objects for ModelAdmin’s with save_as=True</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/</url>
	<cvename>CVE-2016-2048</cvename>
	</references>
	<dates>
	<discovery>2016-02-01</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="81f9d6a4-ddaf-11e5-b2bd-002590263bf5">
	<topic>xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-170.html">
	<p>VMX refuses attempts to enter a guest with an instruction pointer
	which doesn't satisfy certain requirements. In particular, the
	instruction pointer needs to be canonical when entering a guest
	currently in 64-bit mode. This is the case even if the VM entry
	information specifies an exception to be injected immediately (in
	which case the bad instruction pointer would possibly never get used
	for other than pushing onto the exception handler's stack).
	Provided the guest OS allows user mode to map the virtual memory
	space immediately below the canonical/non-canonical address
	boundary, a non-canonical instruction pointer can result even from
	normal user mode execution. VM entry failure, however, is fatal to
	the guest.</p>
	<p>Malicious HVM guest user mode code may be able to crash the
	guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2271</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-170.html</url>
	</references>
	<dates>
	<discovery>2016-02-17</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="80adc394-ddaf-11e5-b2bd-002590263bf5">
	<topic>xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>3.3</ge><lt>4.5.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-168.html">
	<p>While INVLPG does not cause a General Protection Fault when used on
	a non-canonical address, INVVPID in its "individual address"
	variant, which is used to back the intercepted INVLPG in certain
	cases, fails in such cases. Failure of INVVPID results in a
	hypervisor bug check.</p>
	<p>A malicious guest can crash the host, leading to a Denial of
	Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1571</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-168.html</url>
	</references>
	<dates>
	<discovery>2016-01-20</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="7ed7c36f-ddaf-11e5-b2bd-002590263bf5">
	<topic>xen-kernel -- PV superpage functionality missing sanity checks</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><eq>3.4.0</eq></range>
	<range><eq>3.4.1</eq></range>
	<range><ge>4.1</ge><lt>4.5.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-167.html">
	<p>The PV superpage functionality lacks certain validity checks on
	data being passed to the hypervisor by guests. This is the case
	for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and
	MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as
	well as for various forms of page table updates.</p>
	<p>Use of the feature, which is disabled by default, may have unknown
	effects, ranging from information leaks through Denial of Service to
	privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1570</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-167.html</url>
	</references>
	<dates>
	<discovery>2016-01-20</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="2d299950-ddb0-11e5-8fa8-14dae9d210b8">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle28</name>
	<range><lt>2.8.10</lt></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.4</lt></range>
	</package>
	<package>
	<name>moodle30</name>
	<range><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="https://moodle.org/security/">
	<ul>
	<li><p>MSA-16-0001: Two enrolment-related web services don't
	check course visibility</p></li>
	<li><p>MSA-16-0002: XSS Vulnerability in course management
	search</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://moodle.org/security/</url>
	<cvename>CVE-2016-0724</cvename>
	<cvename>CVE-2016-0725</cvename>
	</references>
	<dates>
	<discovery>2016-01-18</discovery>
	<entry>2016-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="6540c8f0-dca3-11e5-8fa8-14dae9d210b8">
	<topic>pitivi -- code execution</topic>
	<affects>
	<package>
	<name>pitivi</name>
	<range><lt>0.95</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Luke Farone reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/23/8">
	<p>Double-clicking a file in the user's media library with a
	specially-crafted path or filename allows for arbitrary code execution
	with the permissions of the user running Pitivi.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/12/23/8</url>
	<url>https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2</url>
	<cvename>CVE-2015-0855</cvename>
	</references>
	<dates>
	<discovery>2015-09-13</discovery>
	<entry>2016-02-26</entry>
	</dates>
	</vuln>

	<vuln vid="90c8385a-dc9f-11e5-8fa8-14dae9d210b8">
	<topic>giflib -- heap overflow</topic>
	<affects>
	<package>
	<name>giflib</name>
	<range><lt>5.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hans Jerry Illikainen reports:</p>
	<blockquote cite="http://seclists.org/bugtraq/2015/Dec/114">
	<p>A heap overflow may occur in the giffix utility included in
	giflib-5.1.1 when processing records of the type
	`IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer'
	equaling the value of the logical screen width, `GifFileIn->SWidth',
	while subsequently having `GifFileIn->Image.Width' bytes of data written
	to it.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/bugtraq/2015/Dec/114</url>
	<cvename>CVE-2015-7555</cvename>
	</references>
	<dates>
	<discovery>2015-12-21</discovery>
	<entry>2016-02-26</entry>
	</dates>
	</vuln>

	<vuln vid="59a0af97-dbd4-11e5-8fa8-14dae9d210b8">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.38</lt></range>
	</package>
	<package>
	<name>drupal7</name>
	<range><lt>7.43</lt></range>
	</package>
	<package>
	<name>drupal8</name>
	<range><lt>8.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2016-001">
	<ul>
	<li><p>File upload access bypass and denial of service (File
	module - Drupal 7 and 8 - Moderately Critical)</p></li>
	<li><p>Brute force amplification attacks via XML-RPC (XML-RPC
	server - Drupal 6 and 7 - Moderately Critical)</p></li>
	<li><p>Open redirect via path manipulation (Base system -
	Drupal 6, 7 and 8 - Moderately Critical) </p></li>
	<li><p>Form API ignores access restrictions on submit buttons
	(Form API - Drupal 6 - Critical)</p></li>
	<li><p>HTTP header injection using line breaks (Base system -
	Drupal 6 - Moderately Critical)</p></li>
	<li><p>Open redirect via double-encoded 'destination'
	parameter (Base system - Drupal 6 - Moderately Critical)</p></li>
	<li><p>Reflected file download vulnerability (System module -
	Drupal 6 and 7 - Moderately Critical)</p></li>
	<li><p>Saving user accounts can sometimes grant the user all
	roles (User module - Drupal 6 and 7 - Less Critical)</p></li>
	<li><p>Email address can be matched to an account (User module
	- Drupal 7 and 8 - Less Critical)</p></li>
	<li><p>Session data truncation can lead to unserialization of
	user provided data (Base system - Drupal 6 - Less Critical)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.drupal.org/SA-CORE-2016-001</url>
	</references>
	<dates>
	<discovery>2016-02-24</discovery>
	<entry>2016-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="7e01df39-db7e-11e5-b937-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>1.650</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>1.642.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24">
	<h1>Description</h1>
	<h5>SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)</h5>
	<p>A vulnerability in the Jenkins remoting module allowed
	unauthenticated remote attackers to open a JRMP listener on the
	server hosting the Jenkins master process, which allowed arbitrary
	code execution.</p>
	<h5>SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)</h5>
	<p>An HTTP response splitting vulnerability in the CLI command
	documentation allowed attackers to craft Jenkins URLs that serve
	malicious content.</p>
	<h5>SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)</h5>
	<p>The verification of user-provided API tokens with the expected
	value did not use a constant-time comparison algorithm, potentially
	allowing attackers to use statistical methods to determine valid
	API tokens using brute-force methods.</p>
	<h5>SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)</h5>
	<p>The verification of user-provided CSRF crumbs with the expected
	value did not use a constant-time comparison algorithm, potentially
	allowing attackers to use statistical methods to determine valid
	CSRF crumbs using brute-force methods.</p>
	<h5>SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)</h5>
	<p>Jenkins has several API endpoints that allow low-privilege users
	to POST XML files that then get deserialized by Jenkins.
	Maliciously crafted XML files sent to these API endpoints could
	result in arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24</url>
	</references>
	<dates>
	<discovery>2016-02-24</discovery>
	<entry>2016-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="660ebbf5-daeb-11e5-b2bd-002590263bf5">
	<topic>squid -- remote DoS in HTTP response processing</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>3.5.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2016:2 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_2.txt">
	<p>Due to incorrect bounds checking Squid is vulnerable to a denial
	of service attack when processing HTTP responses.</p>
	<p>These problems allow remote servers delivering certain unusual
	HTTP response syntax to trigger a denial of service for all
	clients accessing the Squid service.</p>
	<p>HTTP responses containing malformed headers that trigger this
	issue are becoming common. We are not certain at this time if
	that is a sign of malware or just broken server scripting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2569</cvename>
	<cvename>CVE-2016-2570</cvename>
	<cvename>CVE-2016-2571</cvename>
	<freebsdpr>ports/207454</freebsdpr>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_2.txt</url>
	<url>http://www.openwall.com/lists/oss-security/2016/02/24/12</url>
	</references>
	<dates>
	<discovery>2016-02-24</discovery>
	<entry>2016-02-24</entry>
	<modified>2016-02-28</modified>
	</dates>
	</vuln>

	<vuln vid="9e5bbffc-d8ac-11e5-b2bd-002590263bf5">
	<topic>bsh -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>bsh</name>
	<range><lt>2.0.b6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stian Soiland-Reyes reports:</p>
	<blockquote cite="https://github.com/beanshell/beanshell/releases/tag/2.0b6">
	<p>This release fixes a remote code execution vulnerability that was
	identified in BeanShell by Alvaro Muñoz and Christian Schneider.
	The BeanShell team would like to thank them for their help and
	contributions to this fix!</p>
	<p>An application that includes BeanShell on the classpath may be
	vulnerable if another part of the application uses Java
	serialization or XStream to deserialize data from an untrusted
	source.</p>
	<p>A vulnerable application could be exploited for remote code
	execution, including executing arbitrary shell commands.</p>
	<p>This update fixes the vulnerability in BeanShell, but it is worth
	noting that applications doing such deserialization might still be
	insecure through other libraries. It is recommended that application
	developers take further measures such as using a restricted class
	loader when deserializing. See notes on Java serialization security
	XStream security and How to secure deserialization from untrusted
	input without using encryption or sealing.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2510</cvename>
	<freebsdpr>ports/207334</freebsdpr>
	<url>https://github.com/beanshell/beanshell/releases/tag/2.0b6</url>
	</references>
	<dates>
	<discovery>2016-02-18</discovery>
	<entry>2016-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="6171eb07-d8a9-11e5-b2bd-002590263bf5">
	<topic>libsrtp -- DoS via crafted RTP header vulnerability</topic>
	<affects>
	<package>
	<name>libsrtp</name>
	<range><lt>1.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libsrtp reports:</p>
	<blockquote cite="https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2">
	<p>Prevent potential DoS attack due to lack of bounds checking on RTP
	header CSRC count and extension header length. Credit goes to
	Randell Jesup and the Firefox team for reporting this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6360</cvename>
	<freebsdpr>ports/207003</freebsdpr>
	<url>https://github.com/cisco/libsrtp/releases/tag/v1.5.3</url>
	<url>https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2</url>
	<url>https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4</url>
	<url>https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee</url>
	<url>https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f</url>
	</references>
	<dates>
	<discovery>2015-11-02</discovery>
	<entry>2016-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="006e3b7c-d7d7-11e5-b85f-0018fe623f2b">
	<topic>jasper -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jasper</name>
	<range><lt>1.900.1_16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-012.html">
	<p>The library is affected by a double-free vulnerability in function
	jas_iccattrval_destroy()
	as well as a heap-based buffer overflow in function jp2_decode().
	A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
	</blockquote>
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-001.html">
	<p>The library is affected by an off-by-one error in a buffer boundary check
	in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well
	as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to
	stack overflow.
	A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
	</blockquote>
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-009.html">
	<p>Multiple off-by-one flaws, leading to heap-based buffer overflows, were
	found in the way JasPer decoded JPEG 2000 files. A specially crafted file
	could cause an application using JasPer to crash or,
	possibly, execute arbitrary code.</p>
	</blockquote>
	<p>limingxing reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2016/q1/233">
	<p>A vulnerability was found in the way the JasPer's jas_matrix_clip()
	function parses certain JPEG 2000 image files. A specially crafted file
	could cause an application using JasPer to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.ocert.org/advisories/ocert-2014-012.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173157</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173162</url>
	<url>http://www.ocert.org/advisories/ocert-2015-001.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1179282</url>
	<url>http://www.ocert.org/advisories/ocert-2014-009.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1167537</url>
	<url>http://seclists.org/oss-sec/2016/q1/233</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1302636</url>
	<cvename>CVE-2014-8137</cvename>
	<cvename>CVE-2014-8138</cvename>
	<cvename>CVE-2014-8157</cvename>
	<cvename>CVE-2014-8158</cvename>
	<cvename>CVE-2014-9029</cvename>
	<cvename>CVE-2016-2089</cvename>
	</references>
	<dates>
	<discovery>2014-12-10</discovery>
	<entry>2016-02-20</entry>
	<modified>2016-02-24</modified>
	</dates>
	</vuln>

	<vuln vid="368993bb-d685-11e5-8858-00262d5ed8ee">
	<topic>chromium -- same origin bypass</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.116</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html">
	<p>[583431] Critical CVE-2016-1629: Same-origin bypass in Blink
	and Sandbox escape in Chrome. Credit to anonymous.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1629</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html</url>
	</references>
	<dates>
	<discovery>2016-02-18</discovery>
	<entry>2016-02-18</entry>
	</dates>
	</vuln>

	<vuln vid="2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28">
	<topic>glibc -- getaddrinfo stack-based buffer overflow</topic>
	<affects>
	<package>
	<name>linux_base-c6</name>
	<name>linux_base-c6_64</name>
	<range><lt>6.7_1</lt></range>
	</package>
	<package>
	<name>linux_base-f10</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fabio Olive Leite reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547">
	<p>A stack-based buffer overflow was found in libresolv when invoked
	from nss_dns, allowing specially crafted DNS responses to seize
	control of EIP in the DNS client. The buffer overflow occurs in the
	functions send_dg (send datagram) and send_vc (send TCP) for the
	NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
	family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or
	AF_INET6 in some cases) triggers the low-level resolver code to
	send out two parallel queries for A and AAAA. A mismanagement of
	the buffers used for those queries could result in the response of
	a query writing beyond the alloca allocated buffer created by
	__res_nquery.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7547</cvename>
	<freebsdpr>ports/207272</freebsdpr>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547</url>
	<url>https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/</url>
	<url>https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</url>
	<url>https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html</url>
	</references>
	<dates>
	<discovery>2016-02-16</discovery>
	<entry>2016-02-18</entry>
	</dates>
	</vuln>

	<vuln vid="56562efb-d5e4-11e5-b2bd-002590263bf5">
	<topic>squid -- SSL/TLS processing remote DoS</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.5.13</ge><lt>3.5.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2016:1 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_1.txt">
	<p>Due to incorrectly handling server errors Squid is vulnerable to a
	denial of service attack when connecting to TLS or SSL servers.</p>
	<p>This problem allows any trusted client to perform a denial of
	service attack on the Squid service regardless of whether TLS or
	SSL is configured for use in the proxy.</p>
	<p>Misconfigured client or server software may trigger this issue
	to perform a denial of service unintentionally.</p>
	<p>However, the bug is exploitable only if Squid is built using the
	--with-openssl option.</p>
	</blockquote>
	<p>The FreeBSD port does not use SSL by default and is not vulnerable
	in the default configuration.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2390</cvename>
	<freebsdpr>ports/207294</freebsdpr>
	<url>http://www.squid-cache.org/Advisories/SQUID-2016_1.txt</url>
	</references>
	<dates>
	<discovery>2016-02-16</discovery>
	<entry>2016-02-18</entry>
	</dates>
	</vuln>

	<vuln vid="dd563930-d59a-11e5-8fa8-14dae9d210b8">
	<topic>adminer -- remote code execution</topic>
	<affects>
	<package>
	<name>adminer</name>
	<range><lt>4.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakub Vrana reports:</p>
	<blockquote cite="https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b">
	<p>Fix remote code execution in SQLite query</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b</url>
	</references>
	<dates>
	<discovery>2016-02-06</discovery>
	<entry>2016-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="18201a1c-d59a-11e5-8fa8-14dae9d210b8">
	<topic>adminer -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>adminer</name>
	<range><lt>4.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakub Vrana reports:</p>
	<blockquote cite="https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66">
	<p>Fix XSS in indexes (non-MySQL only)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66</url>
	</references>
	<dates>
	<discovery>2015-11-08</discovery>
	<entry>2016-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="ad91ee9b-d599-11e5-8fa8-14dae9d210b8">
	<topic>adminer -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>adminer</name>
	<range><lt>4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakub Vrana reports:</p>
	<blockquote cite="https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c">
	<p>Fix XSS in alter table</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c</url>
	</references>
	<dates>
	<discovery>2015-08-05</discovery>
	<entry>2016-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="8cf54d73-d591-11e5-8fa8-14dae9d210b8">
	<topic>adminer -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>adminer</name>
	<range><lt>4.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakub Vrana reports:</p>
	<blockquote cite="https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5">
	<p>Fix XSS in login form</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5</url>
	<url>https://sourceforge.net/p/adminer/bugs-and-features/436/</url>
	</references>
	<dates>
	<discovery>2015-01-30</discovery>
	<entry>2016-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="95b92e3b-d451-11e5-9794-e8e0b747a45a">
	<topic>libgcrypt -- side-channel attack on ECDH</topic>
	<affects>
	<package>
	<name>libgcrypt</name>
	<range><lt>1.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuPG reports:</p>
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html">
	<p>Mitigate side-channel attack on ECDH with Weierstrass curves.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7511</cvename>
	<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html</url>
	</references>
	<dates>
	<discovery>2016-02-09</discovery>
	<entry>2016-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="f1bf28c5-d447-11e5-b2bd-002590263bf5">
	<topic>xdelta3 -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>xdelta3</name>
	<range><lt>3.0.9,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stepan Golosunov reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/02/08/1">
	<p>Buffer overflow was found and fixed in xdelta3 binary diff tool
	that allows arbitrary code execution from input files at least on
	some systems.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9765</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/02/08/1</url>
	<url>https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2</url>
	</references>
	<dates>
	<discovery>2014-10-08</discovery>
	<entry>2016-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="172b22cb-d3f6-11e5-ac9e-485d605f4717">
	<topic>firefox -- Same-origin-policy violation using Service Workers with plugins</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>44.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>44.0.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2">
	<p>MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept
	responses to plugin network requests made through the browser. Plugins which
	make security decisions based on the content of network requests can have these
	decisions subverted if a service worker forges responses to those requests. For
	example, a forged crossdomain.xml could allow a malicious site to violate the
	same-origin policy using the Flash plugin.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1949</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/</url>
	</references>
	<dates>
	<discovery>2016-02-11</discovery>
	<entry>2016-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
	<topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
	<affects>
	<package>
	<name>nghttp2</name>
	<range><lt>1.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nghttp2 reports:</p>
	<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
	<p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
	due to unlimited incoming HTTP header fields.</p>
	<p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
	for the incoming HTTP header field. If peer sends specially crafted HTTP/2
	HEADERS frames and CONTINUATION frames, they will crash with out of memory
	error.</p>
	<p>Note that libnghttp2 itself is not affected by this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
	<cvename>CVE-2016-1544</cvename>
	</references>
	<dates>
	<discovery>2016-02-03</discovery>
	<entry>2016-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
	<topic>horde -- XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>horde</name>
	<range><lt>5.2.9</lt></range>
	</package>
	<package>
	<name>pear-Horde_Core</name>
	<range><lt>2.22.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde Team reports:</p>
	<blockquote cite="http://lists.horde.org/archives/announce/2016/001149.html">
	<p>Fixed XSS vulnerabilities in menu bar and form renderer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8807</cvename>
	<cvename>CVE-2016-2228</cvename>
	<url>https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253</url>
	<url>https://bugs.horde.org/ticket/14213</url>
	<url>https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0</url>
	<url>https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8</url>
	<url>http://www.openwall.com/lists/oss-security/2016/02/06/4</url>
	<url>http://lists.horde.org/archives/announce/2016/001149.html</url>
	</references>
	<dates>
	<discovery>2016-02-02</discovery>
	<entry>2016-02-14</entry>
	</dates>
	</vuln>

	<vuln vid="e8b6605b-d29f-11e5-8458-6cc21735f730">
	<topic>PostgreSQL -- Security Fixes for Regular Expressions, PL/Java.</topic>
	<affects>
	<package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.20</lt></range>
	</package>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.15</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.6</lt></range>
	</package>
	<package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1644/">
	<p>
	Security Fixes for Regular Expressions, PL/Java
	</p>
	<ul>
	<li>CVE-2016-0773: This release closes security hole CVE-2016-0773,
	an issue with regular expression (regex) parsing. Prior code allowed
	users to pass in expressions which included out-of-range Unicode
	characters, triggering a backend crash. This issue is critical for
	PostgreSQL systems with untrusted users or which generate regexes
	based on user input.
	</li>
	<li>CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege
	escalation issue for users of PL/Java. Certain custom configuration
	settings (GUCS) for PL/Java will now be modifiable only by the
	database superuser
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0773</cvename>
	<cvename>CVE-2016-0766</cvename>
	</references>
	<dates>
	<discovery>2016-02-08</discovery>
	<entry>2016-02-12</entry>
	</dates>
	</vuln>

	<vuln vid="5d8e56c3-9e67-4d5b-81c9-3a409dfd705f">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.569</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">
	<p>These updates resolve a type confusion vulnerability that
	could lead to code execution (CVE-2016-0985).</p>
	<p>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2016-0973, CVE-2016-0974,
	CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).</p>
	<p>These updates resolve a heap buffer overflow vulnerability
	that could lead to code execution (CVE-2016-0971).</p>
	<p>These updates resolve memory corruption vulnerabilities
	that could lead to code execution (CVE-2016-0964,
	CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968,
	CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976,
	CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980,
	CVE-2016-0981).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0964</cvename>
	<cvename>CVE-2016-0965</cvename>
	<cvename>CVE-2016-0966</cvename>
	<cvename>CVE-2016-0967</cvename>
	<cvename>CVE-2016-0968</cvename>
	<cvename>CVE-2016-0969</cvename>
	<cvename>CVE-2016-0970</cvename>
	<cvename>CVE-2016-0971</cvename>
	<cvename>CVE-2016-0972</cvename>
	<cvename>CVE-2016-0973</cvename>
	<cvename>CVE-2016-0974</cvename>
	<cvename>CVE-2016-0975</cvename>
	<cvename>CVE-2016-0976</cvename>
	<cvename>CVE-2016-0977</cvename>
	<cvename>CVE-2016-0978</cvename>
	<cvename>CVE-2016-0979</cvename>
	<cvename>CVE-2016-0980</cvename>
	<cvename>CVE-2016-0981</cvename>
	<cvename>CVE-2016-0982</cvename>
	<cvename>CVE-2016-0983</cvename>
	<cvename>CVE-2016-0984</cvename>
	<cvename>CVE-2016-0985</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-04.html</url>
	</references>
	<dates>
	<discovery>2016-02-09</discovery>
	<entry>2016-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="515b4327-cf8a-11e5-96d6-14dae9d210b8">
	<topic>dnscrypt-proxy -- code execution</topic>
	<affects>
	<package>
	<name>dnscrypt-proxy</name>
	<range><ge>1.1.0</ge><lt>1.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Frank Denis reports:</p>
	<blockquote cite="https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8">
	<p>Malformed packets could lead to denial of service or code
	execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8</url>
	</references>
	<dates>
	<discovery>2016-02-02</discovery>
	<entry>2016-02-10</entry>
	<modified>2016-02-14</modified>
	</dates>
	</vuln>

	<vuln vid="36034227-cf81-11e5-9c2b-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.109</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
	<p>6 security fixes in this release, including:</p>
	<ul>
	<li>[546677] High CVE-2016-1622: Same-origin bypass in Extensions.
	Credit to anonymous.</li>
	<li>[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit
	to Mariusz Mlynski.</li>
	<li>[509313] Medium CVE-2016-1625: Navigation bypass in Chrome
	Instant. Credit to Jann Horn.</li>
	<li>[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium.
	Credit to anonymous, working with HP's Zero Day Initiative.</li>
	<li>[585517] CVE-2016-1627: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1622</cvename>
	<cvename>CVE-2016-1623</cvename>
	<cvename>CVE-2016-1625</cvename>
	<cvename>CVE-2016-1626</cvename>
	<cvename>CVE-2016-1627</cvename>
	<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html</url>
	</references>
	<dates>
	<discovery>2016-02-08</discovery>
	<entry>2016-02-09</entry>
	<modified>2016-03-08</modified>
	</dates>
	</vuln>

	<vuln vid="8f10fa04-cf6a-11e5-96d6-14dae9d210b8">
	<topic>graphite2 -- code execution vulnerability</topic>
	<affects>
	<package>
	<name>graphite2</name>
	<range><lt>1.3.5</lt></range>
	</package>
	<package>
	<name>silgraphite</name>
	<range><lt>2.3.1_4</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos reports:</p>
	<blockquote cite="http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html">
	<ul>
	<li><p>An exploitable denial of service vulnerability exists
	in the font handling of Libgraphite. A specially crafted font can cause
	an out-of-bounds read potentially resulting in an information leak or
	denial of service.</p></li>
	<li><p>A specially crafted font can cause a buffer overflow
	resulting in potential code execution.</p></li>
	<li><p>An exploitable NULL pointer dereference exists in the
	bidirectional font handling functionality of Libgraphite. A specially
	crafted font can cause a NULL pointer dereference resulting in a
	crash.</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html</url>
	<url>http://www.talosintel.com/reports/TALOS-2016-0061/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-14/</url>
	<cvename>CVE-2016-1521</cvename>
	<cvename>CVE-2016-1522</cvename>
	<cvename>CVE-2016-1523</cvename>
	<cvename>CVE-2016-1526</cvename>
	</references>
	<dates>
	<discovery>2016-02-05</discovery>
	<entry>2016-02-09</entry>
	<modified>2016-03-08</modified>
	</dates>
	</vuln>

	<vuln vid="1cecd5e0-c372-11e5-96d6-14dae9d210b8">
	<topic>xymon-server -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xymon-server</name>
	<range><lt>4.3.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>J.C. Cleaver reports:</p>
	<blockquote cite="http://lists.xymon.com/pipermail/xymon/2016-February/042986.html">
	<ul>
	<li><p>CVE-2016-2054: Buffer overflow in xymond handling of
	"config" command</p></li>
	<li><p> CVE-2016-2055: Access to possibly confidential files
	in the Xymon configuration directory</p></li>
	<li><p>CVE-2016-2056: Shell command injection in the
	"useradm" and "chpasswd" web applications</p></li>
	<li><p>CVE-2016-2057: Incorrect permissions on IPC queues
	used by the xymond daemon can bypass IP access filtering</p></li>
	<li><p>CVE-2016-2058: Javascript injection in "detailed status
	webpage" of monitoring items; XSS vulnerability via malformed
	acknowledgment messages</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.xymon.com/pipermail/xymon/2016-February/042986.html</url>
	<cvename>CVE-2016-2054</cvename>
	<cvename>CVE-2016-2055</cvename>
	<cvename>CVE-2016-2056</cvename>
	<cvename>CVE-2016-2057</cvename>
	<cvename>CVE-2016-2058</cvename>
	</references>
	<dates>
	<discovery>2016-01-19</discovery>
	<entry>2016-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="85eb4e46-cf16-11e5-840f-485d605f4717">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php55</name>
	<name>php55-phar</name>
	<name>php55-wddx</name>
	<range><lt>5.5.32</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-phar</name>
	<name>php56-wddx</name>
	<range><lt>5.6.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.6.18">
	<ul><li>Core:
	<ul>
	<li>Fixed bug #71039 (exec functions ignore length but look for NULL
	termination).</li>
	<li>Fixed bug #71323 (Output of stream_get_meta_data can be
	falsified by its input).</li>
	<li>Fixed bug #71459 (Integer overflow in iptcembed()).</li>
	</ul></li>
	<li>PCRE:
	<ul>
	<li>Upgraded bundled PCRE library to 8.38.(CVE-2015-8383,
	CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
	CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)</li>
	</ul></li>
	<li>Phar:
	<ul>
	<li>Fixed bug #71354 (Heap corruption in tar/zip/phar parser).</li>
	<li>Fixed bug #71391 (NULL Pointer Dereference in
	phar_tar_setupmetadata()).</li>
	<li>Fixed bug #71488 (Stack overflow when decompressing tar
	archives). (CVE-2016-2554)</li>
	</ul></li>
	<li>WDDX:
	<ul>
	<li>Fixed bug #71335 (Type Confusion in WDDX Packet
	Deserialization).</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8383</cvename>
	<cvename>CVE-2015-8386</cvename>
	<cvename>CVE-2015-8387</cvename>
	<cvename>CVE-2015-8389</cvename>
	<cvename>CVE-2015-8390</cvename>
	<cvename>CVE-2015-8391</cvename>
	<cvename>CVE-2015-8393</cvename>
	<cvename>CVE-2015-8394</cvename>
	<cvename>CVE-2016-2554</cvename>
	<url>http://php.net/ChangeLog-5.php#5.6.18</url>
	<url>http://php.net/ChangeLog-5.php#5.5.32</url>
	</references>
	<dates>
	<discovery>2016-02-04</discovery>
	<entry>2016-02-09</entry>
	<modified>2016-03-13</modified>
	</dates>
	</vuln>

	<vuln vid="a8de962a-cf15-11e5-805c-5453ed2e2b49">
	<topic>py-imaging, py-pillow -- Buffer overflow in PCD decoder</topic>
	<affects>
	<package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
	</package>
	<package>
	<name>py27-imaging</name>
	<range><lt>1.1.7_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Pillow maintainers report:</p>
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	<p>In all versions of Pillow, dating back at least to the last PIL
	1.1.7 release, PcdDecode.c has a buffer overflow error.</p>
	<p>The state.buffer for PcdDecode.c is allocated based on a 3 bytes
	per pixel sizing, where PcdDecode.c wrote into the buffer assuming
	4 bytes per pixel. This writes 768 bytes beyond the end of the
	buffer into other Python object storage. In some cases, this causes
	a segfault, in others an internal Python malloc error.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://openwall.com/lists/oss-security/2016/02/02/5</mlist>
	<url>https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4</url>
	<url>https://github.com/python-pillow/Pillow/issues/568</url>
	</references>
	<dates>
	<discovery>2016-02-02</discovery>
	<entry>2016-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="0519db18-cf15-11e5-805c-5453ed2e2b49">
	<topic>py-pillow -- Integer overflow in Resample.c</topic>
	<affects>
	<package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Pillow maintainers report:</p>
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	<p>If a large value was passed into the new size for an image, it is
	possible to overflow an int32 value passed into malloc, leading the
	malloc’d buffer to be undersized. These allocations are followed by
	a loop that writes out of bounds. This can lead to corruption on
	the heap of the Python process with attacker controlled float
	data.</p>
	<p>This issue was found by Ned Williamson.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798</url>
	<url>https://github.com/python-pillow/Pillow/issues/1710</url>
	</references>
	<dates>
	<discovery>2016-02-05</discovery>
	<entry>2016-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="6ea60e00-cf13-11e5-805c-5453ed2e2b49">
	<topic>py-imaging, py-pillow -- Buffer overflow in FLI decoding code</topic>
	<affects>
	<package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
	</package>
	<package>
	<name>py27-imaging</name>
	<range><lt>1.1.7_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Pillow maintainers report:</p>
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	<p>In all versions of Pillow, dating back at least to the last PIL
	1.1.7 release, FliDecode.c has a buffer overflow error.</p>
	<p>There is a memcpy error where x is added to a target buffer
	address. X is used in several internal temporary variable roles,
	but can take a value up to the width of the image. Im->image[y]
	is a set of row pointers to segments of memory that are the size of
	the row. At the max y, this will write the contents of the line off
	the end of the memory buffer, causing a segfault.</p>
	<p>This issue was found by Alyssa Besseling at Atlassian.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0775</cvename>
	<url>https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec</url>
	</references>
	<dates>
	<discovery>2016-02-05</discovery>
	<entry>2016-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="53252879-cf11-11e5-805c-5453ed2e2b49">
	<topic>py-pillow -- Buffer overflow in TIFF decoding code</topic>
	<affects>
	<package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Pillow maintainers report:</p>
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	<p>Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on
	x64 may overflow a buffer when reading a specially crafted tiff
	file.</p>
	<p>Specifically, libtiff >= 4.0.0 changed the return type of
	TIFFScanlineSize from int32 to machine dependent int32\|64. If the
	scanline is sized so that it overflows an int32, it may be
	interpreted as a negative number, which will then pass the size check
	in TiffDecode.c line 236. To do this, the logical scanline size has
	to be > 2gb, and for the test file, the allocated buffer size is 64k
	against a roughly 4gb scan line size. Any image data over 64k is
	written over the heap, causing a segfault.</p>
	<p>This issue was found by security researcher FourOne.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-0740</cvename>
	<url>https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e</url>
	</references>
	<dates>
	<discovery>2016-02-04</discovery>
	<entry>2016-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="6ac79ed8-ccc2-11e5-932b-5404a68ad561">
	<topic>ffmpeg -- remote denial of service in JPEG2000 decoder</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range><lt>2.8.6,1</lt></range>
	</package>
	<package>
	<name>mplayer</name>
	<name>mencoder</name>
	<range>
	<lt>1.2.r20151219_3</lt>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>FFmpeg security reports:</p>
	<blockquote cite="https://www.ffmpeg.org/security.html">
	<p>FFmpeg 2.8.6 fixes the following vulnerabilities:
	CVE-2016-2213</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-2213</cvename>
	<url>https://www.ffmpeg.org/security.html</url>
	</references>
	<dates>
	<discovery>2016-01-27</discovery>
	<entry>2016-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="448047e9-030e-4ce4-910b-f21a3ad5d9a0">
	<topic>shotwell -- not verifying certificates</topic>
	<affects>
	<package>
	<name>shotwell</name>
	<range><lt>0.22.0.99</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Catanzaro reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html">
	<p>Shotwell has a serious security issue ("Shotwell does not
	verify TLS certificates"). Upstream is no longer active and
	I do not expect any further upstream releases unless someone
	from the community steps up to maintain it.</p>

	<p>What is the impact of the issue? If you ever used any of
	the publish functionality (publish to Facebook, publish to
	Flickr, etc.), your passwords may have been stolen; changing
	them is not a bad idea.</p>

	<p>What is the risk of the update? Regressions. The easiest
	way to validate TLS certificates was to upgrade WebKit; it
	seems to work but I don't have accounts with the online
	services it supports, so I don't know if photo publishing
	still works properly on all the services.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html</url>
	</references>
	<dates>
	<discovery>2016-01-06</discovery>
	<entry>2016-02-05</entry>
	</dates>
	</vuln>

	<vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
	<topic>webkit -- UI spoof</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<name>webkit-gtk3</name>
	<range><lt>2.4.9_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>webkit reports:</p>
	<blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
	<p>The ScrollView::paint function in platform/scroll/ScrollView.cpp
	in Blink, as used in Google Chrome before 35.0.1916.114, allows
	remote attackers to spoof the UI by extending scrollbar painting
	into the parent frame.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1748</cvename>
	<url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
	</references>
	<dates>
	<discovery>2015-12-28</discovery>
	<entry>2016-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
	<topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
	<affects>
	<package>
	<name>py27-rsa</name>
	<name>py32-rsa</name>
	<name>py33-rsa</name>
	<name>py34-rsa</name>
	<name>py35-rsa</name>
	<range><lt>3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Filippo Valsorda reports:</p>
	<blockquote cite="https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/">
	<p>
	python-rsa is vulnerable to a straightforward variant of the
	Bleichenbacher'06 attack against RSA signature verification
	with low public exponent.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1494</cvename>
	<url>https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/</url>
	<url>https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by</url>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494</url>
	<url>http://www.openwall.com/lists/oss-security/2016/01/05/3</url>
	<url>http://www.openwall.com/lists/oss-security/2016/01/05/1</url>
	</references>
	<dates>
	<discovery>2016-01-05</discovery>
	<entry>2016-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="559f3d1b-cb1d-11e5-80a4-001999f8d30b">
	<topic>asterisk -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><lt>1.8.32.3_5</lt></range>
	</package>
	<package>
	<name>asterisk11</name>
	<range><lt>11.21.1</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>AST-2016-001 - BEAST vulnerability in HTTP server</p>
	<p>AST-2016-002 - File descriptor exhaustion in chan_sip</p>
	<p>AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-001.html</url>
	<cvename>CVE-2011-3389</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-002.html</url>
	<cvename>CVE-2016-2316</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2016-003.html</url>
	<cvename>CVE-2016-2232</cvename>
	</references>
	<dates>
	<discovery>2016-02-03</discovery>
	<entry>2016-02-04</entry>
	<modified>2016-03-07</modified>
	</dates>
	</vuln>

	<vuln vid="0652005e-ca96-11e5-96d6-14dae9d210b8">
	<topic>salt -- code execution</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<range><ge>2015.8.0</ge><lt>2015.8.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SaltStack reports:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html">
	<p>Improper handling of clear messages on the minion, which
	could result in executing commands not sent by the master.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html</url>
	<url>https://github.com/saltstack/salt/pull/30613/files</url>
	<cvename>CVE-2016-1866</cvename>
	</references>
	<dates>
	<discovery>2016-01-25</discovery>
	<entry>2016-02-03</entry>
	</dates>
	</vuln>

	<vuln vid="bb0ef21d-0e1b-461b-bc3d-9cba39948888">
	<topic>rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.22.1</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack4</name>
	<range><lt>4.2.5.1</lt></range>
	</package>
	<package>
	<name>rubygem-actionview</name>
	<range><lt>4.2.5.1</lt></range>
	</package>
	<package>
	<name>rubygem-activemodel4</name>
	<range><lt>4.2.5.1</lt></range>
	</package>
	<package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.22.1</lt></range>
	</package>
	<package>
	<name>rubygem-activerecord4</name>
	<range><lt>4.2.5.1</lt></range>
	</package>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.22.1</lt></range>
	</package>
	<package>
	<name>rubygem-rails-html-sanitizer</name>
	<range><lt>1.0.3</lt></range>
	</package>
	<package>
	<name>rubygem-rails4</name>
	<range><lt>4.2.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails blog:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/">
	<p>Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been
	released! These contain important security fixes, and it is
	recommended that users upgrade as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7576</cvename>
	<cvename>CVE-2015-7577</cvename>
	<cvename>CVE-2015-7581</cvename>
	<cvename>CVE-2016-0751</cvename>
	<cvename>CVE-2016-0752</cvename>
	<cvename>CVE-2016-0753</cvename>
	<url>https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ</url>
	<url>http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/</url>
	</references>
	<dates>
	<discovery>2016-01-25</discovery>
	<entry>2016-02-02</entry>
	</dates>
	</vuln>

	<vuln vid="a52a7172-c92e-11e5-96d6-14dae9d210b8">
	<topic>socat -- diffie hellman parameter was not prime</topic>
	<affects>
	<package>
	<name>socat</name>
	<range><ge>1.7.2.5</ge><lt>1.7.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>socat reports:</p>
	<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv7.html">
	<p>In the OpenSSL address implementation the hard coded 1024
	bit DH p parameter was not prime. The effective cryptographic strength
	of a key exchange using these parameters was weaker than the one one
	could get by using a prime p. Moreover, since there is no indication of
	how these parameters were chosen, the existence of a trapdoor that makes
	possible for an eavesdropper to recover the shared secret from a key
	exchange that uses them cannot be ruled out.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.dest-unreach.org/socat/contrib/socat-secadv7.html</url>
	</references>
	<dates>
	<discovery>2016-02-01</discovery>
	<entry>2016-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="4f00dac0-1e18-4481-95af-7aaad63fd303">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>44.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.41</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.6.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>38.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44">
	<p>MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0
	/ rv:38.6)</p>
	<p>MFSA 2016-02 Out of Memory crash when parsing GIF format
	images</p>
	<p>MFSA 2016-03 Buffer overflow in WebGL after out of memory
	allocation</p>
	<p>MFSA 2016-04 Firefox allows for control characters to be
	set in cookie names</p>
	<p>MFSA 2016-06 Missing delay following user click events in
	protocol handler dialog</p>
	<p>MFSA 2016-09 Addressbar spoofing attacks</p>
	<p>MFSA 2016-10 Unsafe memory manipulation found through
	code inspection</p>
	<p>MFSA 2016-11 Application Reputation service disabled in
	Firefox 43</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7208</cvename>
	<cvename>CVE-2016-1930</cvename>
	<cvename>CVE-2016-1931</cvename>
	<cvename>CVE-2016-1933</cvename>
	<cvename>CVE-2016-1935</cvename>
	<cvename>CVE-2016-1937</cvename>
	<cvename>CVE-2016-1939</cvename>
	<cvename>CVE-2016-1942</cvename>
	<cvename>CVE-2016-1943</cvename>
	<cvename>CVE-2016-1944</cvename>
	<cvename>CVE-2016-1945</cvename>
	<cvename>CVE-2016-1946</cvename>
	<cvename>CVE-2016-1947</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-01/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-02/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-03/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-04/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-06/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-09/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-10/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2016-11/</url>
	</references>
	<dates>
	<discovery>2016-01-26</discovery>
	<entry>2016-02-01</entry>
	<modified>2016-03-08</modified>
	</dates>
	</vuln>

	<vuln vid="e00d8b94-c88a-11e5-b5fe-002590263bf5">
	<topic>gdcm -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gdcm</name>
	<range><lt>2.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CENSUS S.A. reports:</p>
	<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/">
	<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
	prone to an integer overflow vulnerability which leads to a buffer
	overflow and potentially to remote code execution.</p>
	</blockquote>
	<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/">
	<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
	prone to an out-of-bounds read vulnerability due to missing checks.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8396</cvename>
	<cvename>CVE-2015-8397</cvename>
	<url>http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/</url>
	<url>http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/</url>
	</references>
	<dates>
	<discovery>2015-12-23</discovery>
	<entry>2016-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="c1c18ee1-c711-11e5-96d6-14dae9d210b8">
	<topic>nginx -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><lt>1.8.1,2</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><lt>1.9.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Maxim Dounin reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html">
	<p>Several problems in nginx resolver were identified, which
	might allow an attacker to cause worker process crash, or might have
	potential other impact if the "resolver" directive
	is used in a configuration file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html</url>
	<cvename>CVE-2016-0742</cvename>
	<cvename>CVE-2016-0746</cvename>
	<cvename>CVE-2016-0747</cvename>
	</references>
	<dates>
	<discovery>2016-01-26</discovery>
	<entry>2016-01-30</entry>
	</dates>
	</vuln>

	<vuln vid="a0d77bc8-c6a7-11e5-96d6-14dae9d210b8">
	<topic>typo3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><lt>7.6.1</lt></range>
	</package>
	<package>
	<name>typo3-lts</name>
	<range><lt>6.2.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TYPO3 Security Team reports:</p>
	<blockquote cite="http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html">
	<p>It has been discovered that TYPO3 CMS is susceptible to
	Cross-Site Scripting and Cross-Site Flashing.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/</url>
	</references>
	<dates>
	<discovery>2015-12-15</discovery>
	<entry>2016-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="93eadedb-c6a6-11e5-96d6-14dae9d210b8">
	<topic>nghttp2 -- use after free</topic>
	<affects>
	<package>
	<name>nghttp2</name>
	<range><lt>1.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>nghttp2 reports:</p>
	<blockquote cite="https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/">
	<p>This release fixes heap-use-after-free bug in idle stream
	handling code. We strongly recommend to upgrade the older installation
	to this latest version as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/</url>
	<cvename>CVE-2015-8659</cvename>
	</references>
	<dates>
	<discovery>2015-12-23</discovery>
	<entry>2016-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="3166222b-c6a4-11e5-96d6-14dae9d210b8">
	<topic>owncloud -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>owncloud</name>
	<range><lt>8.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Owncloud reports:</p>
	<blockquote cite="https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/">
	<ul>
	<li><p>Reflected XSS in OCS provider discovery
	(oC-SA-2016-001)</p></li>
	<li><p>Information Exposure Through Directory Listing in the
	file scanner (oC-SA-2016-002)</p></li>
	<li><p>Disclosure of files that begin with ".v" due to
	unchecked return value (oC-SA-2016-003)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/</url>
	<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-001</url>
	<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-002</url>
	<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-003</url>
	<cvename>CVE-2016-1498</cvename>
	<cvename>CVE-2016-1499</cvename>
	<cvename>CVE-2016-1500</cvename>
	</references>
	<dates>
	<discovery>2015-12-23</discovery>
	<entry>2016-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="ff824eea-c69c-11e5-96d6-14dae9d210b8">
	<topic>radicale -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-radicale</name>
	<name>py32-radicale</name>
	<name>py33-radicale</name>
	<name>py34-radicale</name>
	<range><lt>1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Radicale reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/06/4">
	<p>The multifilesystem backend allows access to arbitrary
	files on all platforms.</p>
	<p>Prevent regex injection in rights management.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2016/01/06/4</url>
	<cvename>CVE-2015-8747</cvename>
	<cvename>CVE-2015-8748</cvename>
	</references>
	<dates>
	<discovery>2015-12-24</discovery>
	<entry>2016-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="7a59e283-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- XSS vulnerability in SQL editor</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-9/">
	<p>With a crafted SQL query, it is possible to trigger an
	XSS attack in the SQL editor.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	<p>This vulnerability can be triggered only by someone who is
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-9/</url>
	<cvename>CVE-2016-2045</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="78b4ebfb-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Full path disclosure vulnerability in SQL parser</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-8/">
	<p>By calling a particular script that is part of phpMyAdmin
	in an unexpected way, it is possible to trigger phpMyAdmin
	to display a PHP error message which contains the full path
	of the directory where phpMyAdmin is installed.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	<p>This path disclosure is possible on servers where the
	recommended setting of the PHP configuration directive
	display_errors is set to on, which is against the
	recommendations given in the PHP manual for a production
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-8/</url>
	<cvename>CVE-2016-2044</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="7694927f-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- XSS vulnerability in normalization page</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-7/">
	<p>With a crafted table name it is possible to trigger an
	XSS attack in the database normalization page.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	<p>This vulnerability can be triggered only by someone who is
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required page.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-7/</url>
	<cvename>CVE-2016-2043</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="740badcb-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-6/">
	<p>By calling some scripts that are part of phpMyAdmin in an
	unexpected way, it is possible to trigger phpMyAdmin to
	display a PHP error message which contains the full path of
	the directory where phpMyAdmin is installed.</p>
	<p>We consider these vulnerabilities to be non-critical.</p>
	<p>This path disclosure is possible on servers where the
	recommended setting of the PHP configuration directive
	display_errors is set to on, which is against the
	recommendations given in the PHP manual for a production
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-6/</url>
	<cvename>CVE-2016-2042</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="71b24d99-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Unsafe comparison of XSRF/CSRF token</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-5/">
	<p>The comparison of the XSRF/CSRF token parameter with the
	value saved in the session is vulnerable to timing
	attacks. Moreover, the comparison could be bypassed if the
	XSRF/CSRF token matches a particular pattern.</p>
	<p>We consider this vulnerability to be serious.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-5/</url>
	<cvename>CVE-2016-2041</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Insecure password generation in JavaScript</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-4/">
	<p>Password suggestion functionality uses Math.random()
	which does not provide cryptographically secure random
	numbers.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-4/</url>
	<cvename>CVE-2016-1927</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="6cc06eec-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-3/">
	<ul>
	<li>With a crafted table name it is possible to trigger
	an XSS attack in the database search page.</li>
	<li>With a crafted SET value or a crafted search query, it
	is possible to trigger an XSS attacks in the zoom search
	page.</li>
	<li>With a crafted hostname header, it is possible to
	trigger an XSS attacks in the home page.</li>
	</ul>
	<p>We consider these vulnerabilities to be non-critical.</p>
	<p>These vulnerabilities can be triggered only by someone
	who is logged in to phpMyAdmin, as the usual token
	protection prevents non-logged-in users from accessing the
	required pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-3/</url>
	<cvename>CVE-2016-2040</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="60ab0e93-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Unsafe generation of XSRF/CSRF token</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-2/">
	<p>The XSRF/CSRF token is generated with a weak algorithm
	using functions that do not return cryptographically secure
	values.</p>
	<p>We consider this vulnerability to be non-critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-2/</url>
	<cvename>CVE-2016-2039</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="5d6a204f-c60b-11e5-bf36-6805ca0b3d42">
	<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-1/">
	<p>By calling some scripts that are part of phpMyAdmin in an
	unexpected way, it is possible to trigger phpMyAdmin to
	display a PHP error message which contains the full path of
	the directory where phpMyAdmin is installed.</p>
	<p>We consider these vulnerabilities to be non-critical.</p>
	<p>This path disclosure is possible on servers where the
	recommended setting of the PHP configuration directive
	display_errors is set to on, which is against the
	recommendations given in the PHP manual for a production
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2016-1/</url>
	<cvename>CVE-2016-2038</cvename>
	</references>
	<dates>
	<discovery>2016-01-28</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="50394bc9-c5fa-11e5-96a5-d93b343d1ff7">
	<topic>prosody -- user impersonation vulnerability</topic>
	<affects>
	<package>
	<name>prosody</name>
	<range><lt>0.9.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Prosody team reports:</p>
	<blockquote cite="https://prosody.im/security/advisory_20160127/">
	<p>Adopt key generation algorithm from XEP-0185, to
	prevent impersonation attacks (CVE-2016-0756)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/206707</freebsdpr>
	<cvename>CVE-2016-0756</cvename>
	<url>https://prosody.im/security/advisory_20160127/</url>
	</references>
	<dates>
	<discovery>2016-01-27</discovery>
	<entry>2016-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="3679fd10-c5d1-11e5-b85f-0018fe623f2b">
	<topic>openssl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2_7</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.2f</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_12</lt></range>
	<range><ge>10.1</ge><lt>10.1_29</lt></range>
	<range><ge>9.3</ge><lt>9.3_36</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20160128.txt">
	<ol>
	<li>Historically OpenSSL only ever generated DH parameters based on "safe"
	primes. More recently (in version 1.0.2) support was provided for
	generating X9.42 style parameter files such as those required for RFC 5114
	support. The primes used in such files may not be "safe". Where an
	application is using DH configured with parameters based on primes that are
	not "safe" then an attacker could use this fact to find a peer's private
	DH exponent. This attack requires that the attacker complete multiple
	handshakes in which the peer uses the same private DH exponent. For example
	this could be used to discover a TLS server's private DH exponent if it's
	reusing the private DH exponent or it's using a static DH ciphersuite.
	OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
	TLS. It is not on by default. If the option is not set then the server
	reuses the same private DH exponent for the life of the server process and
	would be vulnerable to this attack. It is believed that many popular
	applications do set this option and would therefore not be at risk.
	(CVE-2016-0701)</li>
	<li>A malicious client can negotiate SSLv2 ciphers that have been disabled on
	the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
	been disabled, provided that the SSLv2 protocol was not also disabled via
	SSL_OP_NO_SSLv2.
	(CVE-2015-3197)</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:11.openssl</freebsdsa>
	<cvename>CVE-2016-0701</cvename>
	<cvename>CVE-2015-3197</cvename>
	<url>https://www.openssl.org/news/secadv/20160128.txt</url>
	</references>
	<dates>
	<discovery>2016-01-22</discovery>
	<entry>2016-01-28</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="8b27f1bc-c509-11e5-a95f-b499baebfeaf">
	<topic>curl -- Credentials not checked</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.10.0</ge><lt>7.47.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20160127A.html">
	<p>libcurl will reuse NTLM-authenticated proxy connections
	without properly making sure that the connection was
	authenticated with the same credentials as set for this
	transfer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://curl.haxx.se/docs/adv_20160127A.html</url>
	<cvename>CVE-2016-0755</cvename>
	</references>
	<dates>
	<discovery>2016-01-27</discovery>
	<entry>2016-01-27</entry>
	<modified>2017-02-06</modified>
	</dates>
	</vuln>

	<vuln vid="fb754341-c3e2-11e5-b5fe-002590263bf5">
	<topic>wordpress -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.4.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aaron Jorbin reports:</p>
	<blockquote cite="https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/">
	<p>WordPress 4.4.1 is now available. This is a security release for
	all previous versions and we strongly encourage you to update your
	sites immediately.</p>
	<p>WordPress versions 4.4 and earlier are affected by a cross-site
	scripting vulnerability that could allow a site to be compromised.
	This was reported by Crtc4L.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1564</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/01/08/3</url>
	<url>https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/</url>
	</references>
	<dates>
	<discovery>2016-01-06</discovery>
	<entry>2016-01-26</entry>
	<modified>2016-03-08</modified>
	</dates>
	</vuln>

	<vuln vid="a763a0e7-c3d9-11e5-b5fe-002590263bf5">
	<topic>privoxy -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>privoxy</name>
	<range><lt>3.0.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Privoxy Developers reports:</p>
	<blockquote cite="http://www.privoxy.org/3.0.24/user-manual/whatsnew.html">
	<p>Prevent invalid reads in case of corrupt chunk-encoded content.
	CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
	</p>
	<p>Remove empty Host headers in client requests. Previously they
	would result in invalid reads. CVE-2016-1983. Bug discovered with
	afl-fuzz and AddressSanitizer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1982</cvename>
	<cvename>CVE-2016-1983</cvename>
	<freebsdpr>ports/206504</freebsdpr>
	<url>http://www.privoxy.org/3.0.24/user-manual/whatsnew.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/01/21/4</url>
	</references>
	<dates>
	<discovery>2016-01-22</discovery>
	<entry>2016-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="d9e1b569-c3d8-11e5-b5fe-002590263bf5">
	<topic>privoxy -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>privoxy</name>
	<range><lt>3.0.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Privoxy Developers reports:</p>
	<blockquote cite="http://www.privoxy.org/3.0.23/user-manual/whatsnew.html">
	<p>Fixed a DoS issue in case of client requests with incorrect
	chunk-encoded body. When compiled with assertions enabled (the
	default) they could previously cause Privoxy to abort(). Reported
	by Matthew Daley. CVE-2015-1380.</p>
	<p>Fixed multiple segmentation faults and memory leaks in the pcrs
	code. This fix also increases the chances that an invalid pcrs
	command is rejected as such. Previously some invalid commands would
	be loaded without error. Note that Privoxy's pcrs sources (action
	and filter files) are considered trustworthy input and should not be
	writable by untrusted third-parties. CVE-2015-1381.</p>
	<p>Fixed an 'invalid read' bug which could at least theoretically
	cause Privoxy to crash. So far, no crashes have been observed.
	CVE-2015-1382.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1380</cvename>
	<cvename>CVE-2015-1381</cvename>
	<cvename>CVE-2015-1382</cvename>
	<freebsdpr>ports/197089</freebsdpr>
	<url>http://www.privoxy.org/3.0.23/user-manual/whatsnew.html</url>
	<url>http://www.openwall.com/lists/oss-security/2015/01/26/4</url>
	</references>
	<dates>
	<discovery>2015-01-26</discovery>
	<entry>2016-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="89d4ed09-c3d7-11e5-b5fe-002590263bf5">
	<topic>privoxy -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>privoxy</name>
	<range><lt>3.0.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Privoxy Developers reports:</p>
	<blockquote cite="http://www.privoxy.org/3.0.22/user-manual/whatsnew.html">
	<p>Fixed a memory leak when rejecting client connections due to the
	socket limit being reached (CID 66382). This affected Privoxy 3.0.21
	when compiled with IPv6 support (on most platforms this is the
	default).</p>
	<p>Fixed an immediate-use-after-free bug (CID 66394) and two
	additional unconfirmed use-after-free complaints made by Coverity
	scan (CID 66391, CID 66376).</p>
	</blockquote>
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1201">
	<p>Privoxy before 3.0.22 allows remote attackers to cause a denial
	of service (file descriptor consumption) via unspecified vectors.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1030</cvename>
	<cvename>CVE-2015-1031</cvename>
	<cvename>CVE-2015-1201</cvename>
	<freebsdpr>ports/195468</freebsdpr>
	<url>http://www.privoxy.org/3.0.22/user-manual/whatsnew.html</url>
	<url>http://www.openwall.com/lists/oss-security/2015/01/11/1</url>
	</references>
	<dates>
	<discovery>2015-01-10</discovery>
	<entry>2016-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="ad82b0e9-c3d6-11e5-b5fe-002590263bf5">
	<topic>privoxy -- malicious server spoofing as proxy vulnerability</topic>
	<affects>
	<package>
	<name>privoxy</name>
	<range><lt>3.0.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Privoxy Developers reports:</p>
	<blockquote cite="http://www.privoxy.org/3.0.21/user-manual/whatsnew.html">
	<p>Proxy authentication headers are removed unless the new directive
	enable-proxy-authentication-forwarding is used. Forwarding the
	headers potentially allows malicious sites to trick the user into
	providing them with login information. Reported by Chris John Riley.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2503</cvename>
	<freebsdpr>ports/176813</freebsdpr>
	<url>http://www.privoxy.org/3.0.21/user-manual/whatsnew.html</url>
	</references>
	<dates>
	<discovery>2013-03-07</discovery>
	<entry>2016-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="2e8cdd36-c3cc-11e5-b5fe-002590263bf5">
	<topic>sudo -- potential privilege escalation via symlink misconfiguration</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><lt>1.8.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602">
	<p>sudoedit in Sudo before 1.8.15 allows local users to gain
	privileges via a symlink attack on a file whose full path is defined
	using multiple wildcards in /etc/sudoers, as demonstrated by
	"/home///file.txt."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5602</cvename>
	<freebsdpr>ports/206590</freebsdpr>
	<url>https://www.exploit-db.com/exploits/37710/</url>
	<url>https://bugzilla.sudo.ws/show_bug.cgi?id=707</url>
	<url>http://www.sudo.ws/stable.html#1.8.15</url>
	</references>
	<dates>
	<discovery>2015-11-17</discovery>
	<entry>2016-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="99d3a8a5-c13c-11e5-96d6-14dae9d210b8">
	<topic>imlib2 -- denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>imlib2</name>
	<range><lt>1.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Enlightenment reports:</p>
	<blockquote cite="https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog">
	<p>GIF loader: Fix segv on images without colormap</p>
	<p>Prevent division-by-zero crashes.</p>
	<p>Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog</url>
	<url>http://seclists.org/oss-sec/2016/q1/162</url>
	<cvename>CVE-2014-9762</cvename>
	<cvename>CVE-2014-9763</cvename>
	<cvename>CVE-2014-9764</cvename>
	</references>
	<dates>
	<discovery>2013-12-21</discovery>
	<entry>2016-01-22</entry>
	</dates>
	</vuln>

	<vuln vid="b4578647-c12b-11e5-96d6-14dae9d210b8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.8P3</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.3P3</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01335">
	<p>Specific APL data could trigger an INSIST in apl_42.c</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://kb.isc.org/article/AA-01335</url>
	<cvename>CVE-2015-8704</cvename>
	<freebsdsa>SA-16:08.bind</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-19</discovery>
	<entry>2016-01-22</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="371bbea9-3836-4832-9e70-e8e928727f8c">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.82</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html">
	<p>This update includes 37 security fixes, including:</p>
	<ul>
	<li>[497632] High CVE-2016-1612: Bad cast in V8.</li>
	<li>[572871] High CVE-2016-1613: Use-after-free in PDFium.</li>
	<li>[544691] Medium CVE-2016-1614: Information leak in Blink.</li>
	<li>[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.</li>
	<li>[541415] Medium CVE-2016-1616: URL Spoofing.</li>
	<li>[544765] Medium CVE-2016-1617: History sniffing with HSTS and
	CSP.</li>
	<li>[552749] Medium CVE-2016-1618: Weak random number generator in
	Blink.</li>
	<li>[557223] Medium CVE-2016-1619: Out-of-bounds read in
	PDFium.</li>
	<li>[579625] CVE-2016-1620: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.8
	branch.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1612</cvename>
	<cvename>CVE-2016-1613</cvename>
	<cvename>CVE-2016-1614</cvename>
	<cvename>CVE-2016-1615</cvename>
	<cvename>CVE-2016-1616</cvename>
	<cvename>CVE-2016-1617</cvename>
	<cvename>CVE-2016-1618</cvename>
	<cvename>CVE-2016-1619</cvename>
	<cvename>CVE-2016-1620</cvename>
	<url>http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html</url>
	</references>
	<dates>
	<discovery>2016-01-20</discovery>
	<entry>2016-01-21</entry>
	</dates>
	</vuln>

	<vuln vid="5237f5d7-c020-11e5-b397-d050996490d0">
	<topic>ntp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p6</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><lt>4.3.90</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_11</lt></range>
	<range><ge>10.1</ge><lt>10.1_28</lt></range>
	<range><ge>9.3</ge><lt>9.3_35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Network Time Foundation reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit">
	<p>NTF's NTP Project has been notified of the following low-
	and medium-severity vulnerabilities that are fixed in
	ntp-4.2.8p6, released on Tuesday, 19 January 2016:</p>
	<ul>
	<li>Bug 2948 / CVE-2015-8158: Potential Infinite Loop
	in ntpq. Reported by Cisco ASIG.</li>
	<li>Bug 2945 / CVE-2015-8138: origin: Zero Origin
	Timestamp Bypass. Reported by Cisco ASIG.</li>
	<li>Bug 2942 / CVE-2015-7979: Off-path Denial of
	Service (DoS) attack on authenticated broadcast
	mode. Reported by Cisco ASIG.</li>
	<li>Bug 2940 / CVE-2015-7978: Stack exhaustion in
	recursive traversal of restriction list.
	Reported by Cisco ASIG.</li>
	<li>Bug 2939 / CVE-2015-7977: reslist NULL pointer
	dereference. Reported by Cisco ASIG.</li>
	<li>Bug 2938 / CVE-2015-7976: ntpq saveconfig command
	allows dangerous characters in filenames.
	Reported by Cisco ASIG.</li>
	<li>Bug 2937 / CVE-2015-7975: nextvar() missing length
	check. Reported by Cisco ASIG.</li>
	<li>Bug 2936 / CVE-2015-7974: Skeleton Key: Missing
	key check allows impersonation between authenticated
	peers. Reported by Cisco ASIG.</li>
	<li>Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on
	authenticated broadcast mode. Reported by Cisco ASIG.</li>
	</ul>
	<p>Additionally, mitigations are published for the following
	two issues:</p>
	<ul>
	<li>Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay
	attacks. Reported by Cisco ASIG.</li>
	<li>Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc,
	disclose origin. Reported by Cisco ASIG.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:09.ntp</freebsdsa>
	<cvename>CVE-2015-7973</cvename>
	<cvename>CVE-2015-7974</cvename>
	<cvename>CVE-2015-7975</cvename>
	<cvename>CVE-2015-7976</cvename>
	<cvename>CVE-2015-7977</cvename>
	<cvename>CVE-2015-7978</cvename>
	<cvename>CVE-2015-7979</cvename>
	<cvename>CVE-2015-8138</cvename>
	<cvename>CVE-2015-8139</cvename>
	<cvename>CVE-2015-8140</cvename>
	<cvename>CVE-2015-8158</cvename>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit</url>
	</references>
	<dates>
	<discovery>2016-01-20</discovery>
	<entry>2016-01-21</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="62c0dbbd-bfce-11e5-b5fe-002590263bf5">
	<topic>cgit -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cgit</name>
	<range><lt>0.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason A. Donenfeld reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/14/6">
	<p>Reflected Cross Site Scripting and Header Injection in Mimetype
	Query String.</p>
	<p>Stored Cross Site Scripting and Header Injection in Filename
	Parameter.</p>
	<p>Integer Overflow resulting in Buffer Overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1899</cvename>
	<cvename>CVE-2016-1900</cvename>
	<cvename>CVE-2016-1901</cvename>
	<freebsdpr>ports/206417</freebsdpr>
	<url>http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html</url>
	<url>http://www.openwall.com/lists/oss-security/2016/01/14/6</url>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-01-20</entry>
	</dates>
	</vuln>

	<vuln vid="314830d8-bf91-11e5-96d6-14dae9d210b8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind910</name>
	<range><lt>9.10.3P3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01336">
	<p>Problems converting OPT resource records and ECS options to
	text format can cause BIND to terminate</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://kb.isc.org/article/AA-01336</url>
	<cvename>CVE-2015-8705</cvename>
	</references>
	<dates>
	<discovery>2016-01-19</discovery>
	<entry>2016-01-20</entry>
	<modified>2016-01-22</modified>
	</dates>
	</vuln>

	<vuln vid="51358314-bec8-11e5-82cd-bcaec524bf84">
	<topic>claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc</topic>
	<affects>
	<package>
	<name>claws-mail</name>
	<range><lt>3.13.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>DrWhax reports:</p>
	<blockquote cite="http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557">
	<p>So in codeconv.c there is a function for Japanese character set
	conversion called conv_jistoeuc(). There is no bounds checking on
	the output buffer, which is created on the stack with alloca()
	Bug can be triggered by sending an email to TAILS_luser@riseup.net
	or whatever.

	Since my C is completely rusty, you might be able to make a better
	judgment on the severity of this issue. Marking critical for now.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8614</cvename>
	<url>https://security-tracker.debian.org/tracker/CVE-2015-8614</url>
	</references>
	<dates>
	<discovery>2015-11-04</discovery>
	<entry>2016-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="7c63775e-be31-11e5-b5fe-002590263bf5">
	<topic>libarchive -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libarchive</name>
	<range><lt>3.1.2_5,1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_4</lt></range>
	<range><ge>10.2</ge><lt>10.2_18</lt></range>
	<range><ge>10.1</ge><lt>10.1_35</lt></range>
	<range><ge>9.3</ge><lt>9.3_43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0211">
	<p>Integer signedness error in the archive_write_zip_data function in
	archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when
	running on 64-bit machines, allows context-dependent attackers to
	cause a denial of service (crash) via unspecified vectors, which
	triggers an improper conversion between unsigned and signed types,
	leading to a buffer overflow.</p>
	</blockquote>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2304">
	<p>Absolute path traversal vulnerability in bsdcpio in libarchive
	3.1.2 and earlier allows remote attackers to write to arbitrary
	files via a full pathname in an archive.</p>
	</blockquote>
	<p>Libarchive issue tracker reports:</p>
	<blockquote cite="https://github.com/libarchive/libarchive/issues/502">
	<p>Using a crafted tar file bsdtar can perform an out-of-bounds memory
	read which will lead to a SEGFAULT. The issue exists when the
	executable skips data in the archive. The amount of data to skip is
	defined in byte offset [16-19] If ASLR is disabled, the issue can
	lead to an infinite loop.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0211</cvename>
	<cvename>CVE-2015-2304</cvename>
	<freebsdpr>ports/200176</freebsdpr>
	<freebsdsa>SA-16:22.libarchive</freebsdsa>
	<freebsdsa>SA-16:23.libarchive</freebsdsa>
	<url>https://github.com/libarchive/libarchive/pull/110</url>
	<url>https://github.com/libarchive/libarchive/commit/5935715</url>
	<url>https://github.com/libarchive/libarchive/commit/2253154</url>
	<url>https://github.com/libarchive/libarchive/issues/502</url>
	<url>https://github.com/libarchive/libarchive/commit/3865cf2</url>
	<url>https://github.com/libarchive/libarchive/commit/e6c9668</url>
	<url>https://github.com/libarchive/libarchive/commit/24f5de6</url>
	</references>
	<dates>
	<discovery>2012-12-06</discovery>
	<entry>2016-01-18</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="6809c6db-bdeb-11e5-b5fe-002590263bf5">
	<topic>go -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>go</name>
	<range><ge>1.5,1</ge><lt>1.5.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason Buberel reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/13/7">
	<p>A security-related issue has been reported in Go's math/big
	package. The issue was introduced in Go 1.5. We recommend that all
	users upgrade to Go 1.5.3, which fixes the issue. Go programs must
	be recompiled with Go 1.5.3 in order to receive the fix.</p>
	<p>The Go team would like to thank Nick Craig-Wood for identifying the
	issue.</p>
	<p>This issue can affect RSA computations in crypto/rsa, which is used
	by crypto/tls. TLS servers on 32-bit systems could plausibly leak
	their RSA private key due to this issue. Other protocol
	implementations that create many RSA signatures could also be
	impacted in the same way.</p>
	<p>Specifically, incorrect results in one part of the RSA Chinese
	Remainder computation can cause the result to be incorrect in such a
	way that it leaks one of the primes. While RSA blinding should
	prevent an attacker from crafting specific inputs that trigger the
	bug, on 32-bit systems the bug can be expected to occur at random
	around one in 2^26 times. Thus collecting around 64 million
	signatures (of known data) from an affected server should be enough
	to extract the private key used.</p>
	<p>On 64-bit systems, the frequency of the bug is so low (less than
	one in 2^50) that it would be very difficult to exploit.
	Nonetheless, everyone is strongly encouraged to upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8618</cvename>
	<url>http://www.openwall.com/lists/oss-security/2016/01/13/7</url>
	<url>https://go-review.googlesource.com/#/c/17672/</url>
	<url>https://go-review.googlesource.com/#/c/18491/</url>
	</references>
	<dates>
	<discovery>2016-01-13</discovery>
	<entry>2016-01-18</entry>
	</dates>
	</vuln>

	<vuln vid="05eeb7e9-b987-11e5-83ef-14dae9d210b8">
	<topic>isc-dhcpd -- Denial of Service</topic>
	<affects>
	<package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_10,2</lt></range>
	</package>
	<package>
	<name>isc-dhcp41-client</name>
	<range><lt>4.1.e_3,2</lt></range>
	</package>
	<package>
	<name>isc-dhcp41-relay</name>
	<range><lt>4.1.e_6,2</lt></range>
	</package>
	<package>
	<name>isc-dhcp42-client</name>
	<name>isc-dhcp42-server</name>
	<name>isc-dhcp42-relay</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>isc-dhcp43-client</name>
	<name>isc-dhcp43-server</name>
	<name>isc-dhcp43-relay</name>
	<range><lt>4.3.3.p1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01334">
	<p>A badly formed packet with an invalid IPv4 UDP length field
	can cause a DHCP server, client, or relay program to terminate
	abnormally.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://kb.isc.org/article/AA-01334</url>
	<cvename>CVE-2015-8605</cvename>
	</references>
	<dates>
	<discovery>2016-01-05</discovery>
	<entry>2016-01-12</entry>
	</dates>
	</vuln>

	<vuln vid="3b5c2362-bd07-11e5-b7ef-5453ed2e2b49">
	<topic>libproxy -- stack-based buffer overflow</topic>
	<affects>
	<!-- libproxy-python is not affected. It only installs a .py file that
	dlopen()s libproxy.so. -->
	<package>
	<name>libproxy</name>
	<range><ge>0.4.0</ge><lt>0.4.6_1</lt></range>
	</package>
	<package>
	<name>libproxy-gnome</name>
	<range><ge>0.4.0</ge><lt>0.4.6_2</lt></range>
	</package>
	<package>
	<name>libproxy-kde</name>
	<range><ge>0.4.0</ge><lt>0.4.6_6</lt></range>
	</package>
	<package>
	<name>libproxy-perl</name>
	<range><ge>0.4.0</ge><lt>0.4.6_3</lt></range>
	</package>
	<package>
	<name>libproxy-webkit</name>
	<range><ge>0.4.0</ge><lt>0.4.6_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tomas Hoger reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=864417#c0">
	<p>A buffer overflow flaw was discovered in the libproxy's
	url::get_pac() used to download proxy.pac proxy auto-configuration
	file. A malicious host hosting proxy.pac, or a man in the middle
	attacker, could use this flaw to trigger a stack-based buffer
	overflow in an application using libproxy, if proxy configuration
	instructed it to download proxy.pac file from a remote HTTP
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4504</cvename>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504</url>
	<mlist>http://www.openwall.com/lists/oss-security/2012/10/12/1</mlist>
	<url>https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=864417</url>
	<mlist>https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E</mlist>
	</references>
	<dates>
	<discovery>2012-10-10</discovery>
	<entry>2016-01-17</entry>
	<modified>2016-01-18</modified>
	</dates>
	</vuln>

	<vuln vid="046fedd1-bd01-11e5-bbf4-5404a68ad561">
	<topic>ffmpeg -- remote attacker can access local files</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range>
	<gt>2.0,1</gt>
	<lt>2.8.5,1</lt>
	</range>
	</package>
	<package>
	<name>mplayer</name>
	<name>mencoder</name>
	<range>
	<lt>1.2.r20151219_2</lt>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Arch Linux reports:</p>
	<blockquote cite="https://bugs.archlinux.org/task/47738">
	<p>ffmpeg has a vulnerability in the current version that allows the
	attacker to create a specially crafted video file, downloading which
	will send files from a user PC to a remote attacker server. The
	attack does not even require the user to open that file — for
	example, KDE Dolphin thumbnail generation is enough.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1897</cvename>
	<cvename>CVE-2016-1898</cvename>
	<freebsdpr>ports/206282</freebsdpr>
	<url>https://www.ffmpeg.org/security.html</url>
	</references>
	<dates>
	<discovery>2016-01-13</discovery>
	<entry>2016-01-17</entry>
	</dates>
	</vuln>

	<vuln vid="6c808811-bb9a-11e5-a65c-485d605f4717">
	<topic>h2o -- directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range><lt>1.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yakuzo OKU reports:</p>
	<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
	<p>When redirect directive is used, this flaw allows a remote
	attacker to inject response headers into an HTTP redirect response.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1133</cvename>
	<url>https://h2o.examp1e.net/vulnerabilities.html</url>
	</references>
	<dates>
	<discovery>2016-01-13</discovery>
	<entry>2016-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf">
	<topic>openssh -- information disclosure</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range>
	<gt>5.4.p0,1</gt>
	<lt>7.1.p2,1</lt>
	</range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_10</lt></range>
	<range><ge>10.1</ge><lt>10.1_27</lt></range>
	<range><ge>9.3</ge><lt>9.3_34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSH reports:</p>
	<blockquote cite="http://www.openssh.com/security.html">
	<p>OpenSSH clients between versions 5.4 and 7.1 are vulnerable to
	information disclosure that may allow a malicious server to retrieve
	information including under some circumstances, user's private keys.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openssh.com/security.html</url>
	<cvename>CVE-2016-0777</cvename>
	<cvename>CVE-2016-0778</cvename>
	<freebsdsa>SA-16:07</freebsdsa>
	</references>
	<dates>
	<discovery>2016-01-14</discovery>
	<entry>2016-01-14</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="842cd117-ba54-11e5-9728-002590263bf5">
	<topic>prosody -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>prosody</name>
	<range><lt>0.9.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Prosody Team reports:</p>
	<blockquote cite="http://blog.prosody.im/prosody-0-9-9-security-release/">
	<p>Fix path traversal vulnerability in mod_http_files
	(CVE-2016-1231)</p>
	<p>Fix use of weak PRNG in generation of dialback secrets
	(CVE-2016-1232)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1231</cvename>
	<cvename>CVE-2016-1232</cvename>
	<freebsdpr>ports/206150</freebsdpr>
	<url>http://blog.prosody.im/prosody-0-9-9-security-release/</url>
	</references>
	<dates>
	<discovery>2016-01-08</discovery>
	<entry>2016-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="a7a4e96c-ba50-11e5-9728-002590263bf5">
	<topic>kibana4 -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>kibana4</name>
	<name>kibana41</name>
	<range><lt>4.1.4</lt></range>
	</package>
	<package>
	<name>kibana42</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>kibana43</name>
	<range><lt>4.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4">
	<p>Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov
	for responsibly reporting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/205961</freebsdpr>
	<freebsdpr>ports/205962</freebsdpr>
	<freebsdpr>ports/205963</freebsdpr>
	<url>https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4</url>
	</references>
	<dates>
	<discovery>2015-12-17</discovery>
	<entry>2016-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="333f655a-b93a-11e5-9efa-5453ed2e2b49">
	<topic>p5-PathTools -- File::Spec::canonpath loses taint</topic>
	<affects>
	<package>
	<name>p5-PathTools</name>
	<range>
	<gt>3.4000</gt>
	<lt>3.6200</lt>
	</range>
	</package>
	<package>
	<name>perl5</name>
	<name>perl5.20</name>
	<name>perl5.22</name>
	<name>perl5-devel</name>
	<range><ge>5.19.9</ge><lt>5.20.2</lt></range>
	<range><ge>5.21.0</ge><lt>5.22.2</lt></range>
	<range><ge>5.23.0</ge><lt>5.23.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ricardo Signes reports:</p>
	<blockquote>
	<p>Beginning in PathTools 3.47 and/or perl 5.20.0, the
	File::Spec::canonpath() routine returned untained strings even if
	passed tainted input. This defect undermines the guarantee of taint
	propagation, which is sometimes used to ensure that unvalidated
	user input does not reach sensitive code.</p>
	<p>This defect was found and reported by David Golden of MongoDB.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8607</cvename>
	<url>https://rt.perl.org/Public/Bug/Display.html?id=126862</url>
	</references>
	<dates>
	<discovery>2016-01-11</discovery>
	<entry>2016-01-12</entry>
	<modified>2016-08-22</modified>
	</dates>
	</vuln>

	<vuln vid="6b771fe2-b84e-11e5-92f9-485d605f4717">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php55</name>
	<name>php55-gd</name>
	<name>php55-wddx</name>
	<name>php55-xmlrpc</name>
	<range><lt>5.5.31</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-gd</name>
	<name>php56-soap</name>
	<name>php56-wddx</name>
	<name>php56-xmlrpc</name>
	<range><lt>5.6.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.31">
	<ul><li>Core:
	<ul>
	<li>Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).</li>
	</ul></li>
	<li>GD:
	<ul>
	<li>Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array
	Index Out of Bounds).</li>
	</ul></li>
	<li>SOAP:
	<ul>
	<li>Fixed bug #70900 (SoapClient systematic out of memory error).</li>
	</ul></li>
	<li>Wddx
	<ul>
	<li>Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
	Deserialization).</li>
	<li>Fixed bug #70741 (Session WDDX Packet Deserialization Type
	Confusion Vulnerability).</li>
	</ul></li>
	<li>XMLRPC:
	<ul>
	<li>Fixed bug #70728 (Type Confusion Vulnerability in
	PHP_to_XMLRPC_worker()).</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.php.net/ChangeLog-5.php#5.5.31</url>
	<url>http://www.php.net/ChangeLog-5.php#5.6.17</url>
	</references>
	<dates>
	<discovery>2016-01-07</discovery>
	<entry>2016-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="5f276780-b6ce-11e5-9731-5453ed2e2b49">
	<topic>pygments -- shell injection vulnerability</topic>
	<affects>
	<package>
	<name>py27-pygments</name>
	<name>py32-pygments</name>
	<name>py33-pygments</name>
	<name>py34-pygments</name>
	<name>py35-pygments</name>
	<range><lt>2.0.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8557">
	<p>The FontManager._get_nix_font_path function in formatters/img.py
	in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
	arbitrary commands via shell metacharacters in a font name.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8557</cvename>
	<mlist>http://seclists.org/fulldisclosure/2015/Oct/4</mlist>
	<url>https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8</url>
	</references>
	<dates>
	<discovery>2015-09-28</discovery>
	<entry>2016-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="631fc042-b636-11e5-83ef-14dae9d210b8">
	<topic>polkit -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>polkit</name>
	<range><lt>0.113</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Colin Walters reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html">
	<ul>
	<li><p>Integer overflow in the
	authentication_agent_new_cookie function in PolicyKit (aka polkit)
	before 0.113 allows local users to gain privileges by creating a large
	number of connections, which triggers the issuance of a duplicate cookie
	value.</p></li>
	<li><p>The authentication_agent_new function in
	polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka
	polkit) before 0.113 allows local users to cause a denial of service
	(NULL pointer dereference and polkitd daemon crash) by calling
	RegisterAuthenticationAgent with an invalid object path.</p></li>
	<li><p>The polkit_backend_action_pool_init function in
	polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
	0.113 might allow local users to gain privileges via duplicate action
	IDs in action descriptions.</p></li>
	<li><p>PolicyKit (aka polkit) before 0.113 allows local
	users to cause a denial of service (memory corruption and polkitd daemon
	crash) and possibly gain privileges via unspecified vectors, related to
	"javascript rule evaluation."</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html</url>
	<cvename>CVE-2015-4625</cvename>
	<cvename>CVE-2015-3218</cvename>
	<cvename>CVE-2015-3255</cvename>
	<cvename>CVE-2015-3256</cvename>
	</references>
	<dates>
	<discovery>2015-06-03</discovery>
	<entry>2016-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="b22b016b-b633-11e5-83ef-14dae9d210b8">
	<topic>librsync -- collision vulnerability</topic>
	<affects>
	<package>
	<name>librsync</name>
	<range><lt>1.0.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Samuel reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/07/28/1">
	<p>librsync before 1.0.0 uses a truncated MD4 checksum to
	match blocks, which makes it easier for remote attackers to modify
	transmitted data via a birthday attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2014/07/28/1</url>
	<cvename>CVE-2014-8242</cvename>
	</references>
	<dates>
	<discovery>2014-07-28</discovery>
	<entry>2016-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="4eae4f46-b5ce-11e5-8a2b-d050996490d0">
	<topic>ntp -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p5</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><lt>4.3.78</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Network Time Foundation reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit">
	<p>NTF's NTP Project has been notified of the following
	1 medium-severity vulnerability that is fixed in
	ntp-4.2.8p5, released on Thursday, 7 January 2016:</p>
	<p>NtpBug2956: Small-step/Big-step CVE-2015-5300</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-16:02.ntp</freebsdsa>
	<cvename>CVE-2015-5300</cvename>
	<url>https://www.cs.bu.edu/~goldbe/NTPattack.html</url>
	<url>http://support.ntp.org/bin/view/Main/NtpBug2956</url>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit</url>
	</references>
	<dates>
	<discovery>2015-10-21</discovery>
	<entry>2016-01-08</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="df587aa2-b5a5-11e5-9728-002590263bf5">
	<topic>dhcpcd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dhcpcd</name>
	<range><lt>6.10.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nico Golde reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/07/3">
	<p>heap overflow via malformed dhcp responses later in print_option
	(via dhcp_envoption1) due to incorrect option length values.
	Exploitation is non-trivial, but I'd love to be proven wrong.</p>
	<p>invalid read/crash via malformed dhcp responses. not exploitable
	beyond DoS as far as I can judge.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2016-1503</cvename>
	<cvename>CVE-2016-1504</cvename>
	<freebsdpr>ports/206015</freebsdpr>
	<url>http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30</url>
	<url>http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403</url>
	<url>http://www.openwall.com/lists/oss-security/2016/01/07/3</url>
	</references>
	<dates>
	<discovery>2016-01-04</discovery>
	<entry>2016-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="4084168e-b531-11e5-a98c-0011d823eebd">
	<topic>mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication</topic>
	<affects>
	<package>
	<name>polarssl13</name>
	<range><lt>1.3.16</lt></range>
	</package>
	<package>
	<name>mbedtls</name>
	<range><lt>2.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ARM Limited reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released">
	<p>MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack
	on TLS 1.2 server authentication. They have been disabled by default.
	Other attacks from the SLOTH paper do not apply to any version of mbed
	TLS or PolarSSL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released</url>
	</references>
	<dates>
	<discovery>2016-01-04</discovery>
	<entry>2016-01-07</entry>
	</dates>
	</vuln>

	<vuln vid="6aa2d135-b40e-11e5-9728-002590263bf5">
	<topic>xen-kernel -- ioreq handling possibly susceptible to multiple read issue</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-166.html">
	<p>Single memory accesses in source code can be translated to multiple
	ones in machine code by the compiler, requiring special caution when
	accessing shared memory. Such precaution was missing from the
	hypervisor code inspecting the state of I/O requests sent to the
	device model for assistance.</p>
	<p>Due to the offending field being a bitfield, it is however believed
	that there is no issue in practice, since compilers, at least when
	optimizing (which is always the case for non-debug builds), should find
	it more expensive to extract the bit field value twice than to keep the
	calculated value in a register.</p>
	<p>This vulnerability is exposed to malicious device models. In
	conventional Xen systems this means the qemu which service an HVM
	domain. On such systems this vulnerability can only be exploited if
	the attacker has gained control of the device model qemu via another
	vulnerability.</p>
	<p>Privilege escalation, host crash (Denial of Service), and leaked
	information all cannot be excluded.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/205841</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-166.html</url>
	</references>
	<dates>
	<discovery>2015-12-17</discovery>
	<entry>2016-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="e839ca04-b40d-11e5-9728-002590263bf5">
	<topic>xen-kernel -- information leak in legacy x86 FPU/XMM initialization</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-165.html">
	<p>When XSAVE/XRSTOR are not in use by Xen to manage guest extended
	register state, the initial values in the FPU stack and XMM
	registers seen by the guest upon first use are those left there by
	the previous user of those registers.</p>
	<p>A malicious domain may be able to leverage this to obtain sensitive
	information such as cryptographic keys from another domain.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8555</cvename>
	<freebsdpr>ports/205841</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-165.html</url>
	</references>
	<dates>
	<discovery>2015-12-17</discovery>
	<entry>2016-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="5d1d4473-b40d-11e5-9728-002590263bf5">
	<topic>xen-tools -- libxl leak of pv kernel and initrd on error</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>4.1</ge><lt>4.5.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-160.html">
	<p>When constructing a guest which is configured to use a PV
	bootloader which runs as a userspace process in the toolstack domain
	(e.g. pygrub) libxl creates a mapping of the files to be used as
	kernel and initial ramdisk when building the guest domain.</p>
	<p>However if building the domain subsequently fails these mappings
	would not be released leading to a leak of virtual address space in
	the calling process, as well as preventing the recovery of the
	temporary disk files containing the kernel and initial ramdisk.</p>
	<p>For toolstacks which manage multiple domains within the same
	process, an attacker who is able to repeatedly start a suitable
	domain (or many such domains) can cause an out-of-memory condition in the
	toolstack process, leading to a denial of service.</p>
	<p>Under the same circumstances an attacker can also cause files to
	accumulate on the toolstack domain filesystem (usually under /var in
	dom0) used to temporarily store the kernel and initial ramdisk,
	perhaps leading to a denial of service against arbitrary other
	services using that filesystem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8341</cvename>
	<freebsdpr>ports/205841</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-160.html</url>
	</references>
	<dates>
	<discovery>2015-12-08</discovery>
	<entry>2016-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="bcad3faa-b40c-11e5-9728-002590263bf5">
	<topic>xen-kernel -- XENMEM_exchange error handling issues</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-159.html">
	<p>Error handling in the operation may involve handing back pages to
	the domain. This operation may fail when in parallel the domain gets
	torn down. So far this failure unconditionally resulted in the host
	being brought down due to an internal error being assumed. This is
	CVE-2015-8339.</p>
	<p>Furthermore error handling so far wrongly included the release of a
	lock. That lock, however, was either not acquired or already released
	on all paths leading to the error handling sequence. This is
	CVE-2015-8340.</p>
	<p>A malicious guest administrator may be able to deny service by
	crashing the host or causing a deadlock.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8339</cvename>
	<cvename>CVE-2015-8340</cvename>
	<freebsdpr>ports/205841</freebsdpr>
	<url>http://xenbits.xen.org/xsa/advisory-159.html</url>
	</references>
	<dates>
	<discovery>2015-12-08</discovery>
	<entry>2016-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="b65e4914-b3bc-11e5-8255-5453ed2e2b49">
	<topic>tiff -- out-of-bounds read in CIE Lab image format</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><lt>4.0.6_1</lt></range>
	</package>
	<package>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_2</lt></range>
	</package>
	<package>
	<name>linux-f10-tiff</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>zzf of Alibaba discovered an out-of-bounds vulnerability in the code
	processing the LogLUV and CIE Lab image format files. An attacker
	could create a specially-crafted TIFF file that could cause libtiff
	to crash.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8683</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2015/12/25/2</mlist>
	</references>
	<dates>
	<discovery>2015-12-25</discovery>
	<entry>2016-01-05</entry>
	<modified>2016-09-06</modified>
	</dates>
	</vuln>

	<vuln vid="bd349f7a-b3b9-11e5-8255-5453ed2e2b49">
	<topic>tiff -- out-of-bounds read in tif_getimage.c</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><lt>4.0.6_1</lt></range>
	</package>
	<package>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_2</lt></range>
	</package>
	<package>
	<name>linux-f10-tiff</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in
	tif_getimage.c. An attacker could create a specially-crafted TIFF
	file that could cause libtiff to crash.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8665</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2015/12/24/2</mlist>
	</references>
	<dates>
	<discovery>2015-12-24</discovery>
	<entry>2016-01-05</entry>
	<modified>2016-09-06</modified>
	</dates>
	</vuln>

	<vuln vid="86c3c66e-b2f5-11e5-863a-b499baebfeaf">
	<topic>unzip -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>unzip</name>
	<range><lt>6.0_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Grieco reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/07/4">
	<p>Two issues were found in unzip 6.0:</p>
	<p> * A heap overflow triggered by unzipping a file with password
	(e.g unzip -p -P x sigsegv.zip).</p>
	<p> * A denegation of service with a file that never finishes unzipping
	(e.g. unzip sigxcpu.zip).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/09/07/4</url>
	<freebsdpr>ports/204413</freebsdpr>
	<cvename>CVE-2015-7696</cvename>
	<cvename>CVE-2015-7697</cvename>
	</references>
	<dates>
	<discovery>2015-09-26</discovery>
	<entry>2016-01-04</entry>
	</dates>
	</vuln>

	<vuln vid="bb961ff3-b3a4-11e5-8255-5453ed2e2b49">
	<topic>cacti -- SQL injection vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><le>0.8.8f_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8369">
	<p>SQL injection vulnerability in include/top_graph_header.php in
	Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary
	SQL commands via the rra_id parameter in a properties action to
	graph.php.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8369</cvename>
	<url>http://bugs.cacti.net/view.php?id=2646</url>
	<url>http://svn.cacti.net/viewvc?view=rev&revision=7767</url>
	<mlist>http://seclists.org/fulldisclosure/2015/Dec/8</mlist>
	</references>
	<dates>
	<discovery>2015-12-05</discovery>
	<entry>2016-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="59e7eb28-b309-11e5-af83-80ee73b5dcf5">
	<topic>kea -- unexpected termination while handling a malformed packet</topic>
	<affects>
	<package>
	<name>kea</name>
	<range><ge>0.9.2</ge><lt>1.0.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC Support reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html">
	<p>ISC Kea may terminate unexpectedly (crash) while handling
	a malformed client packet. Related defects in the kea-dhcp4
	and kea-dhcp6 servers can cause the server to crash during
	option processing if a client sends a malformed packet.
	An attacker sending a crafted malformed packet can cause
	an ISC Kea server providing DHCP services to IPv4 or IPv6
	clients to exit unexpectedly.</p>
	<ul>
	<li><p>The kea-dhcp4 server is vulnerable only in versions
	0.9.2 and 1.0.0-beta, and furthermore only when logging
	at debug level 40 or higher. Servers running kea-dhcp4
	versions 0.9.1 or lower, and servers which are not
	logging or are logging at debug level 39 or below are
	not vulnerable.</p></li>
	<li><p>The kea-dhcp6 server is vulnerable only in versions
	0.9.2 and 1.0.0-beta, and furthermore only when
	logging at debug level 45 or higher. Servers running
	kea-dhcp6 versions 0.9.1 or lower, and servers
	which are not logging or are logging at debug level 44
	or below are not vulnerable.</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8373</cvename>
	<url>https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html</url>
	</references>
	<dates>
	<discovery>2015-12-15</discovery>
	<entry>2016-01-04</entry>
	<modified>2016-01-05</modified>
	</dates>
	</vuln>

	<vuln vid="84dc49b0-b267-11e5-8a5b-00262d5ed8ee">
	<topic>mini_httpd -- buffer overflow via snprintf</topic>
	<affects>
	<package>
	<name>mini_httpd</name>
	<range><lt>1.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ACME Updates reports:</p>
	<blockquote cite="https://cxsecurity.com/acveshow/CVE-2015-1548">
	<p>mini_httpd 1.21 and earlier allows remote attackers to obtain
	sensitive information from process memory via an HTTP request with
	a long protocol string, which triggers an incorrect response size
	calculation and an out-of-bounds read.</p>
	<p>(rene) ACME, the author, claims that the vulnerability is fixed
	after version 1.22, released on 2015-12-28</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1548</cvename>
	<url>https://cxsecurity.com/cveshow/CVE-2015-1548</url>
	<url>http://acme.com/updates/archive/192.html</url>
	</references>
	<dates>
	<discovery>2015-02-10</discovery>
	<entry>2016-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="1384f2fd-b1be-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in Rocker switch emulation</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.50</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/28/6">
	<p>Qemu emulator built with the Rocker switch emulation support is
	vulnerable to an off-by-one error. It happens while processing
	transmit(tx) descriptors in 'tx_consume' routine, if a descriptor
	was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.
	</p>
	<p>A privileged user inside guest could use this flaw to cause memory
	leakage on the host or crash the Qemu process instance resulting in
	DoS issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8701</cvename>
	<freebsdpr>ports/205813</freebsdpr>
	<freebsdpr>ports/205814</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/12/28/6</url>
	<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
	</references>
	<dates>
	<discovery>2015-12-28</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-07-06</modified>
	</dates>
	</vuln>

	<vuln vid="152acff3-b1bd-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in Q35 chipset emulation</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.50</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/24/1">
	<p>Qemu emulator built with the Q35 chipset based pc system emulator
	is vulnerable to a heap based buffer overflow. It occurs during VM
	guest migration, as more(16 bytes) data is moved into allocated
	(8 bytes) memory area.</p>
	<p>A privileged guest user could use this issue to corrupt the VM
	guest image, potentially leading to a DoS. This issue affects q35
	machine types.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8666</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/12/24/1</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
	</references>
	<dates>
	<discovery>2015-11-19</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-07-06</modified>
	</dates>
	</vuln>

	<vuln vid="62ab8707-b1bc-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in Human Monitor Interface support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/22/8">
	<p>Qemu emulator built with the Human Monitor Interface(HMP) support
	is vulnerable to an OOB write issue. It occurs while processing
	'sendkey' command in hmp_sendkey routine, if the command argument is
	longer than the 'keyname_buf' buffer size.</p>
	<p>A user/process could use this flaw to crash the Qemu process
	instance resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8619</cvename>
	<freebsdpr>ports/205813</freebsdpr>
	<freebsdpr>ports/205814</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/12/22/8</url>
	<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196</url>
	</references>
	<dates>
	<discovery>2015-12-23</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-07-06</modified>
	</dates>
	</vuln>

	<vuln vid="b3f9f8ef-b1bb-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/7">
	<p>Qemu emulator built with the SCSI MegaRAID SAS HBA emulation
	support is vulnerable to a stack buffer overflow issue. It occurs
	while processing the SCSI controller's CTRL_GET_INFO command. A
	privileged guest user could use this flaw to crash the Qemu process
	instance resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8613</cvename>
	<freebsdpr>ports/205813</freebsdpr>
	<freebsdpr>ports/205814</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/12/21/7</url>
	<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811</url>
	</references>
	<dates>
	<discovery>2015-12-21</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-07-06</modified>
	</dates>
	</vuln>

	<vuln vid="9ad8993e-b1ba-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/15/4">
	<p>Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator
	support is vulnerable to a memory leakage flaw. It occurs when a
	guest repeatedly tries to activate the vmxnet3 device.</p>
	<p>A privileged guest user could use this flaw to leak host memory,
	resulting in DoS on the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8567</cvename>
	<cvename>CVE-2015-8568</cvename>
	<freebsdpr>ports/205813</freebsdpr>
	<freebsdpr>ports/205814</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/12/15/4</url>
	<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
	</references>
	<dates>
	<discovery>2015-12-15</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-07-06</modified>
	</dates>
	</vuln>

	<vuln vid="60cb2055-b1b8-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in USB EHCI emulation support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/9">
	<p>Qemu emulator built with the USB EHCI emulation support is
	vulnerable to an infinite loop issue. It occurs during communication
	between host controller interface(EHCI) and a respective device
	driver. These two communicate via a isochronous transfer descriptor
	list(iTD) and an infinite loop unfolds if there is a closed loop in
	this list.</p>
	<p>A privileges user inside guest could use this flaw to consume
	excessive CPU cycles & resources on the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8558</cvename>
	<freebsdpr>ports/205814</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/12/14/9</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
	</references>
	<dates>
	<discovery>2015-12-14</discovery>
	<entry>2016-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="3fb06284-b1b7-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in MSI-X support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/2">
	<p>Qemu emulator built with the PCI MSI-X support is vulnerable to
	null pointer dereference issue. It occurs when the controller
	attempts to write to the pending bit array(PBA) memory region.
	Because the MSI-X MMIO support did not define the .write method.</p>
	<p>A privileges used inside guest could use this flaw to crash the
	Qemu process resulting in DoS issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7549</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/12/14/2</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b</url>
	</references>
	<dates>
	<discovery>2015-06-26</discovery>
	<entry>2016-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="67feba97-b1b5-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in VNC</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/08/4">
	<p>Qemu emulator built with the VNC display driver support is
	vulnerable to an arithmetic exception flaw. It occurs on the VNC
	server side while processing the 'SetPixelFormat' messages from a
	client.</p>
	<p>A privileged remote client could use this flaw to crash the guest
	resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8504</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/12/08/4</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
	</references>
	<dates>
	<discovery>2015-12-08</discovery>
	<entry>2016-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="405446f4-b1b3-11e5-9728-002590263bf5">
	<topic>qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/2">
	<p>Qemu emulator built with the AMD PC-Net II Ethernet Controller
	support is vulnerable to a heap buffer overflow flaw. While
	receiving packets in the loopback mode, it appends CRC code to the
	receive buffer. If the data size given is same as the receive buffer
	size, the appended CRC code overwrites 4 bytes beyond this
	's->buffer' array.</p>
	<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
	to crash the Qemu instance resulting in DoS or potentially execute
	arbitrary code with privileges of the Qemu process on the host.</p>
	</blockquote>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/3">
	<p>The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets
	from a remote host(non-loopback mode), fails to validate the
	received data size, thus resulting in a buffer overflow issue. It
	could potentially lead to arbitrary code execution on the host, with
	privileges of the Qemu process. It requires the guest NIC to have
	larger MTU limit.</p>
	<p>A remote user could use this flaw to crash the guest instance
	resulting in DoS or potentially execute arbitrary code on a remote
	host with privileges of the Qemu process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7504</cvename>
	<cvename>CVE-2015-7512</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/11/30/2</url>
	<url>http://www.openwall.com/lists/oss-security/2015/11/30/3</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
	<url>http://xenbits.xen.org/xsa/advisory-162.html</url>
	</references>
	<dates>
	<discovery>2015-11-30</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-01-06</modified>
	</dates>
	</vuln>

	<vuln vid="b56fe6bb-b1b1-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerabilities in eepro100 NIC support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.50</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/25/3">
	<p>Qemu emulator built with the i8255x (PRO100) emulation support is
	vulnerable to an infinite loop issue. It could occur while
	processing a chain of commands located in the Command Block List
	(CBL). Each Command Block(CB) points to the next command in the
	list. An infinite loop unfolds if the link to the next CB points
	to the same block or there is a closed loop in the chain.</p>
	<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
	to crash the Qemu instance resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8345</cvename>
	<freebsdpr>ports/205813</freebsdpr>
	<freebsdpr>ports/205814</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/11/25/3</url>
	<url>https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24</url>
	</references>
	<dates>
	<discovery>2015-10-16</discovery>
	<entry>2016-01-03</entry>
	<modified>2016-07-06</modified>
	</dates>
	</vuln>

	<vuln vid="42cbd1e8-b152-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in virtio-net support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.1</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/5">
	<p>Qemu emulator built with the Virtual Network Device(virtio-net)
	support is vulnerable to a DoS issue. It could occur while receiving
	large packets over the tuntap/macvtap interfaces and when guest's
	virtio-net driver did not support big/mergeable receive buffers.</p>
	<p>An attacker on the local network could use this flaw to disable
	guest's networking by sending a large number of jumbo frames to the
	guest, exhausting all receive buffers and thus leading to a DoS
	situation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7295</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/18/5</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3</url>
	</references>
	<dates>
	<discovery>2015-09-18</discovery>
	<entry>2016-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="6aa3322f-b150-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerabilities in NE2000 NIC support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0.1</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/2">
	<p>Qemu emulator built with the NE2000 NIC emulation support is
	vulnerable to an infinite loop issue. It could occur when receiving
	packets over the network.</p>
	<p>A privileged user inside guest could use this flaw to crash the
	Qemu instance resulting in DoS.</p>
	</blockquote>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/3">
	<p>Qemu emulator built with the NE2000 NIC emulation support is
	vulnerable to a heap buffer overflow issue. It could occur when
	receiving packets over the network.</p>
	<p>A privileged user inside guest could use this flaw to crash the
	Qemu instance or potentially execute arbitrary code on the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5278</cvename>
	<cvename>CVE-2015-5279</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/15/2</url>
	<url>http://www.openwall.com/lists/oss-security/2015/09/15/3</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4</url>
	</references>
	<dates>
	<discovery>2015-09-15</discovery>
	<entry>2016-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="bbc97005-b14e-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.1</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/10/1">
	<p>Qemu emulator built with the IDE disk and CD/DVD-ROM emulation
	support is vulnerable to a divide by zero issue. It could occur
	while executing an IDE command WIN_READ_NATIVE_MAX to determine
	the maximum size of a drive.</p>
	<p>A privileged user inside guest could use this flaw to crash the
	Qemu instance resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6855</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/10/1</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a</url>
	</references>
	<dates>
	<discovery>2015-09-09</discovery>
	<entry>2016-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="10bf8eed-b14d-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in e1000 NIC support</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0.1</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/04/4">
	<p>Qemu emulator built with the e1000 NIC emulation support is
	vulnerable to an infinite loop issue. It could occur while
	processing transmit descriptor data when sending a network packet.
	</p>
	<p>A privileged user inside guest could use this flaw to crash the
	Qemu instance resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6815</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/04/4</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7</url>
	</references>
	<dates>
	<discovery>2015-09-04</discovery>
	<entry>2016-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="8a560bcf-b14b-11e5-9728-002590263bf5">
	<topic>qemu -- denial of service vulnerability in VNC</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.1.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.2.50.g20141230</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/7">
	<p>Qemu emulator built with the VNC display driver is vulnerable to an
	infinite loop issue. It could occur while processing a
	CLIENT_CUT_TEXT message with specially crafted payload message.</p>
	<p>A privileged guest user could use this flaw to crash the Qemu
	process on the host, resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5239</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/02/7</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
	</references>
	<dates>
	<discovery>2014-06-30</discovery>
	<entry>2016-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="2b3b4c27-b0c7-11e5-8d13-bc5ff45d0f28">
	<topic>qemu -- buffer overflow vulnerability in VNC</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0.1</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20151011</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/21/6">
	<p>Qemu emulator built with the VNC display driver support is
	vulnerable to a buffer overflow flaw leading to a heap memory
	corruption issue. It could occur while refreshing the server
	display surface via routine vnc_refresh_server_surface().</p>
	<p>A privileged guest user could use this flaw to corrupt the heap
	memory and crash the Qemu process instance OR potentially use it
	to execute arbitrary code on the host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5225</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/08/21/6</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b</url>
	</references>
	<dates>
	<discovery>2015-08-17</discovery>
	<entry>2016-01-01</entry>
	</dates>
	</vuln>

	<vuln vid="21e5abe3-b0c6-11e5-8d13-bc5ff45d0f28">
	<topic>qemu -- buffer overflow vulnerability in virtio-serial message exchanges</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/06/3">
	<p>Qemu emulator built with the virtio-serial vmchannel support is
	vulnerable to a buffer overflow issue. It could occur while
	exchanging virtio control messages between guest and the host.</p>
	<p>A malicious guest could use this flaw to corrupt few bytes of Qemu
	memory area, potentially crashing the Qemu process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5745</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/08/06/5</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295</url>
	</references>
	<dates>
	<discovery>2015-08-06</discovery>
	<entry>2016-01-01</entry>
	</dates>
	</vuln>

	<vuln vid="a267cd6c-b0c4-11e5-8d13-bc5ff45d0f28">
	<topic>qemu -- stack buffer overflow while parsing SCSI commands</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
	<blockquote cite="http://openwall.com/lists/oss-security/2015/07/23/6">
	<p>Qemu emulator built with the SCSI device emulation support is
	vulnerable to a stack buffer overflow issue. It could occur while
	parsing SCSI command descriptor block with an invalid operation
	code.</p>
	<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
	to crash the Qemu instance resulting in DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5158</cvename>
	<url>http://openwall.com/lists/oss-security/2015/07/23/6</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
	</references>
	<dates>
	<discovery>2015-07-23</discovery>
	<entry>2016-01-01</entry>
	</dates>
	</vuln>

	<vuln vid="aea8d90e-b0c1-11e5-8d13-bc5ff45d0f28">
	<topic>qemu -- code execution on host machine</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Petr Matousek of Red Hat Inc. reports:</p>
	<blockquote cite="http://openwall.com/lists/oss-security/2015/06/17/5">
	<p>Due converting PIO to the new memory read/write api we no longer
	provide separate I/O region lenghts for read and write operations.
	As a result, reading from PIT Mode/Command register will end with
	accessing pit->channels with invalid index and potentially cause
	memory corruption and/or minor information leak.</p>
	<p>A privileged guest user in a guest with QEMU PIT emulation enabled
	could potentially (tough unlikely) use this flaw to execute
	arbitrary code on the host with the privileges of the hosting QEMU
	process.</p>
	<p>Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT
	emulation and are thus not vulnerable to this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3214</cvename>
	<url>http://openwall.com/lists/oss-security/2015/06/17/5</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
	<url>https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
	</references>
	<dates>
	<discovery>2015-06-17</discovery>
	<entry>2016-01-01</entry>
	</dates>
	</vuln>

	<vuln vid="4b3a7e70-afce-11e5-b864-14dae9d210b8">
	<topic>mono -- DoS and code execution</topic>
	<affects>
	<package>
	<name>mono</name>
	<range><lt>4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NCC Group reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q4/543">
	<p>An attacker who can cause a carefully-chosen string to be
	converted to a floating-point number can cause a crash and potentially
	induce arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q4/543</url>
	<cvename>CVE-2009-0689</cvename>
	</references>
	<dates>
	<discovery>2015-12-19</discovery>
	<entry>2015-12-31</entry>
	</dates>
	</vuln>

	<vuln vid="84c7ea88-bf04-4bdc-973b-36744bf540ab">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.559</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html">
	<p>These updates resolve a type confusion vulnerability that
	could lead to code execution (CVE-2015-8644).</p>

	<p>These updates resolve an integer overflow vulnerability
	that could lead to code execution (CVE-2015-8651).</p>

	<p>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2015-8634, CVE-2015-8635,
	CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641,
	CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647,
	CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).</p>

	<p>These updates resolve memory corruption vulnerabilities
	that could lead to code execution (CVE-2015-8459,
	CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8459</cvename>
	<cvename>CVE-2015-8460</cvename>
	<cvename>CVE-2015-8634</cvename>
	<cvename>CVE-2015-8636</cvename>
	<cvename>CVE-2015-8638</cvename>
	<cvename>CVE-2015-8639</cvename>
	<cvename>CVE-2015-8640</cvename>
	<cvename>CVE-2015-8641</cvename>
	<cvename>CVE-2015-8642</cvename>
	<cvename>CVE-2015-8643</cvename>
	<cvename>CVE-2015-8644</cvename>
	<cvename>CVE-2015-8645</cvename>
	<cvename>CVE-2015-8646</cvename>
	<cvename>CVE-2015-8647</cvename>
	<cvename>CVE-2015-8648</cvename>
	<cvename>CVE-2015-8649</cvename>
	<cvename>CVE-2015-8650</cvename>
	<cvename>CVE-2015-8651</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb16-01.html</url>
	</references>
	<dates>
	<discovery>2015-12-28</discovery>
	<entry>2015-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="b808c3a8-ae30-11e5-b864-14dae9d210b8">
	<topic>inspircd -- DoS</topic>
	<affects>
	<package>
	<name>inspircd</name>
	<range><lt>2.0.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Inspircd reports:</p>
	<blockquote cite="http://www.inspircd.org/2015/04/16/v2019-released.html">
	<p>This release fixes the issues discovered since 2.0.18,
	containing multiple important stability and correctness related
	improvements, including a fix for a bug which allowed malformed DNS
	records to cause netsplits on a network.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.inspircd.org/2015/04/16/v2019-released.html</url>
	<url>https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559</url>
	<url>http://comments.gmane.org/gmane.comp.security.oss.general/18464</url>
	<cvename>CVE-2015-8702</cvename>
	</references>
	<dates>
	<discovery>2015-04-16</discovery>
	<entry>2015-12-29</entry>
	<modified>2015-12-29</modified>
	</dates>
	</vuln>

	<vuln vid="4bae544d-06a3-4352-938c-b3bcbca89298">
	<topic>ffmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libav</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>gstreamer-ffmpeg</name>
	<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>handbrake</name>
	- <!-- handbrake-0.10.2 has libav-10.1 -->
	- <!-- no known fixed version -->
	- <range><ge>0</ge></range>
	+ <!-- handbrake prior to 1.2.0 has libav-10.1 -->
	+ <!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
	+ <range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>ffmpeg</name>
	<range><ge>2.8,1</ge><lt>2.8.4,1</lt></range>
	<range><lt>2.7.4,1</lt></range>
	</package>
	<package>
	<name>ffmpeg26</name>
	<range><lt>2.6.6</lt></range>
	</package>
	<package>
	<name>ffmpeg25</name>
	<range><lt>2.5.9</lt></range>
	</package>
	<package>
	<name>ffmpeg24</name>
	<range><lt>2.4.12</lt></range>
	</package>
	<package>
	<name>ffmpeg-devel</name>
	<name>ffmpeg23</name>
	<name>ffmpeg2</name>
	<name>ffmpeg1</name>
	<name>ffmpeg-011</name>
	<name>ffmpeg0</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>avidemux</name>
	<name>avidemux2</name>
	<name>avidemux26</name>
	<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>kodi</name>
	<!-- kodi-15.2 has ffmpeg-2.6.4 -->
	<range><lt>16.0</lt></range>
	</package>
	<package>
	<name>mplayer</name>
	<name>mencoder</name>
	<!-- mplayer-1.2.r20151219 has ffmpeg-2.8.3 -->
	<range><lt>1.2.r20151219_1</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
	<range><le>0.27.5,1</le></range>
	</package>
	<package>
	<name>plexhometheater</name>
	<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8662">
	<p>The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in
	FFmpeg before 2.8.4 does not validate the number of
	decomposition levels before proceeding with Discrete Wavelet
	Transform decoding, which allows remote attackers to cause a
	denial of service (out-of-bounds array access) or possibly
	have unspecified other impact via crafted JPEG 2000
	data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8663">
	<p>The ff_get_buffer function in libavcodec/utils.c in
	FFmpeg before 2.8.4 preserves width and height values after
	a failure, which allows remote attackers to cause a denial
	of service (out-of-bounds array access) or possibly have
	unspecified other impact via a crafted .mov file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8662</cvename>
	<cvename>CVE-2015-8663</cvename>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf</url>
	<url>https://ffmpeg.org/security.html</url>
	</references>
	<dates>
	<discovery>2015-12-20</discovery>
	<entry>2015-12-28</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="10f7bc76-0335-4a88-b391-0b05b3a8ce1c">
	<topic>NSS -- MD5 downgrade in TLS 1.2 signatures</topic>
	<affects>
	<package>
	<name>nss</name>
	<name>linux-c6-nss</name>
	<range><ge>3.20</ge><lt>3.20.2</lt></range>
	<range><lt>3.19.2.2</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>43.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.5.1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.40</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/">
	<p>Security researcher Karthikeyan Bhargavan reported an
	issue in Network Security Services (NSS) where MD5
	signatures in the server signature within the TLS 1.2
	ServerKeyExchange message are still accepted. This is an
	issue since NSS has officially disallowed the accepting MD5
	as a hash algorithm in signatures since 2011. This issues
	exposes NSS based clients such as Firefox to theoretical
	collision-based forgery attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7575</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-150/</url>
	<url>https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb</url>
	</references>
	<dates>
	<discovery>2015-12-22</discovery>
	<entry>2015-12-28</entry>
	</dates>
	</vuln>

	<vuln vid="88f75070-abcf-11e5-83d3-6805ca0b3d42">
	<topic>phpMyAdmin -- path disclosure vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.5.0</ge><lt>4.5.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-6/">
	<p>By calling some scripts that are part of phpMyAdmin in an
	unexpected way, it is possible to trigger phpMyAdmin to
	display a PHP error message which contains the full path of
	the directory where phpMyAdmin is installed.</p>
	<p>We consider these vulnerabilities to be non-critical.</p>
	<p>This path disclosure is possible on servers where the
	recommended setting of the PHP configuration directive
	display_errors is set to on, which is against the
	recommendations given in the PHP manual for a production
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2015-6/</url>
	<cvename>CVE-2015-8669</cvename>
	</references>
	<dates>
	<discovery>2015-12-25</discovery>
	<entry>2015-12-26</entry>
	</dates>
	</vuln>

	<vuln vid="876768aa-ab1e-11e5-8a30-5453ed2e2b49">
	<topic>dpkg -- stack-based buffer overflow</topic>
	<affects>
	<package>
	<name>dpkg</name>
	<range><lt>1.16.17</lt></range>
	<range><lt>1.17.26</lt></range>
	<range><lt>1.18.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Salvatore Bonaccorso reports:</p>
	<blockquote cite="https://lists.debian.org/debian-security-announce/2015/msg00312.html">
	<p>Hanno Boeck discovered a stack-based buffer overflow in the
	dpkg-deb component of dpkg, the Debian package management system.
	This flaw could potentially lead to arbitrary code execution if a
	user or an automated system were tricked into processing a specially
	crafted Debian binary package (.deb) in the old style Debian binary
	package format.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0860</cvename>
	<url>http://openwall.com/lists/oss-security/2015/11/26/3</url>
	<url>https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0</url>
	</references>
	<dates>
	<discovery>2015-11-26</discovery>
	<entry>2015-12-25</entry>
	</dates>
	</vuln>

	<vuln vid="e1b5318c-aa4d-11e5-8f5c-002590263bf5">
	<topic>mantis -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>1.2.19_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mantis reports:</p>
	<blockquote cite="https://mantisbt.org/bugs/view.php?id=19873">
	<p>CVE-2015-5059: documentation in private projects can be seen by
	every user</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5059</cvename>
	<freebsdpr>ports/201106</freebsdpr>
	<url>https://mantisbt.org/bugs/view.php?id=19873</url>
	<url>http://openwall.com/lists/oss-security/2015/06/25/3</url>
	</references>
	<dates>
	<discovery>2015-06-23</discovery>
	<entry>2015-12-24</entry>
	</dates>
	</vuln>

	<vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki123</name>
	<range><lt>1.23.12</lt></range>
	</package>
	<package>
	<name>mediawiki124</name>
	<range><lt>1.24.5</lt></range>
	</package>
	<package>
	<name>mediawiki125</name>
	<range><lt>1.25.4</lt></range>
	</package>
	<package>
	<name>mediawiki126</name>
	<range><lt>1.26.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MediaWiki reports:</p>
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">
	<p>(T117899) SECURITY: $wgArticlePath can no longer be set to relative
	paths that do not begin with a slash. This enabled trivial XSS
	attacks. Configuration values such as "http://my.wiki.com/wiki/$1"
	are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is
	not and will now throw an error.</p>
	<p>(T119309) SECURITY: Use hash_compare() for edit token comparison.
	</p>
	<p>(T118032) SECURITY: Don't allow cURL to interpret POST parameters
	starting with '@' as file uploads.</p>
	<p>(T115522) SECURITY: Passwords generated by User::randomPassword()
	can no longer be shorter than $wgMinimalPasswordLength.</p>
	<p>(T97897) SECURITY: Improve IP parsing and trimming. Previous
	behavior could result in improper blocks being issued.</p>
	<p>(T109724) SECURITY: Special:MyPage, Special:MyTalk,
	Special:MyContributions and related pages no longer use HTTP
	redirects and are now redirected by MediaWiki.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8622</cvename>
	<cvename>CVE-2015-8623</cvename>
	<cvename>CVE-2015-8624</cvename>
	<cvename>CVE-2015-8625</cvename>
	<cvename>CVE-2015-8626</cvename>
	<cvename>CVE-2015-8627</cvename>
	<cvename>CVE-2015-8628</cvename>
	<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>
	<url>https://phabricator.wikimedia.org/T117899</url>
	<url>https://phabricator.wikimedia.org/T119309</url>
	<url>https://phabricator.wikimedia.org/T118032</url>
	<url>https://phabricator.wikimedia.org/T115522</url>
	<url>https://phabricator.wikimedia.org/T97897</url>
	<url>https://phabricator.wikimedia.org/T109724</url>
	<url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>
	</references>
	<dates>
	<discovery>2015-12-18</discovery>
	<entry>2015-12-24</entry>
	</dates>
	</vuln>

	<vuln vid="3b50881d-1860-4721-aab1-503290e23f6c">
	<topic>Ruby -- unsafe tainted string vulnerability</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>2.0.0,1</ge><lt>2.0.0.648,1</lt></range>
	<range><ge>2.1.0,1</ge><lt>2.1.8,1</lt></range>
	<range><ge>2.2.0,1</ge><lt>2.2.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby developer reports:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/">
	<p>There is an unsafe tainted string vulnerability in Fiddle and DL.
	This issue was originally reported and fixed with CVE-2009-5147 in
	DL, but reappeared after DL was reimplemented using Fiddle and
	libffi.</p>
	<p>And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not
	fixed at other branches, then rubies which bundled DL except Ruby
	1.9.1 are still vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/</url>
	<cvename>CVE-2015-7551</cvename>
	</references>
	<dates>
	<discovery>2015-12-16</discovery>
	<entry>2015-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="54075861-a95a-11e5-8b40-20cf30e32f6d">
	<topic>Bugzilla security issues</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.11</lt></range>
	</package>
	<package>
	<name>bugzilla50</name>
	<range><lt>5.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bugzilla Security Advisory</p>
	<blockquote cite="https://www.bugzilla.org/security/4.2.15/">
	<p>During the generation of a dependency graph, the code for
	the HTML image map is generated locally if a local dot
	installation is used. With escaped HTML characters in a bug
	summary, it is possible to inject unfiltered HTML code in
	the map file which the CreateImagemap function generates.
	This could be used for a cross-site scripting attack.</p>
	<p>If an external HTML page contains a <script> element with
	its src attribute pointing to a buglist in CSV format, some
	web browsers incorrectly try to parse the CSV file as valid
	JavaScript code. As the buglist is generated based on the
	privileges of the user logged into Bugzilla, the external
	page could collect confidential data contained in the CSV
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8508</cvename>
	<cvename>CVE-2015-8509</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1221518</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1232785</url>
	</references>
	<dates>
	<discovery>2015-12-22</discovery>
	<entry>2015-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="d6c51737-a84b-11e5-8f5c-002590263bf5">
	<topic>librsvg2 -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>librsvg2</name>
	<range><lt>2.40.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam Maris, Red Hat Product Security, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
	<p>CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to
	crash an application was found in librsvg2 while parsing SVG file.
	It has been fixed in 2.40.12 by many commits that has rewritten the
	checks for cyclic references.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7558</cvename>
	<freebsdpr>ports/205502</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
	<url>https://bugzilla.redhat.com/1268243</url>
	</references>
	<dates>
	<discovery>2015-10-02</discovery>
	<entry>2015-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="da634091-a84a-11e5-8f5c-002590263bf5">
	<topic>librsvg2 -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>librsvg2</name>
	<range><lt>2.40.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam Maris, Red Hat Product Security, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
	<p>CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when
	parsing SVG file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7557</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
	<url>https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df</url>
	</references>
	<dates>
	<discovery>2015-02-06</discovery>
	<entry>2015-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="9e7306b9-a5c3-11e5-b864-14dae9d210b8">
	<topic>quassel -- remote denial of service</topic>
	<affects>
	<package>
	<name>quassel</name>
	<range><lt>0.12.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pierre Schweitzer reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/12/1">
	<p>Any client sending the command "/op *" in a query will
	cause the Quassel core to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/12/12/1</url>
	<cvename>CVE-2015-8547</cvename>
	</references>
	<dates>
	<discovery>2015-11-22</discovery>
	<entry>2015-12-18</entry>
	</dates>
	</vuln>

	<vuln vid="f714b4c9-a6c1-11e5-88d7-047d7b492d07">
	<topic>libvirt -- ACL bypass using ../ to access beyond storage pool</topic>
	<affects>
	<package>
	<name>libvirt</name>
	<range><ge>1.1.0</ge><lt>1.2.19_2</lt></range>
	<range><ge>1.2.20</ge><lt>1.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Libvit development team reports:</p>
	<blockquote cite="http://security.libvirt.org/2015/0004.html">
	<p>Various virStorageVol* API operate on user-supplied volume names by
	concatenating the volume name to the pool location. Note that the
	virStoragePoolListVolumes API, when used on a storage pool backed by
	a directory in a file system, will only list volumes immediately in
	that directory (there is no traversal into subdirectories). However,
	other APIs such as virStorageVolCreateXML were not checking if a
	potential volume name represented one of the volumes that could be
	returned by virStoragePoolListVolumes; because they were not rejecting
	the use of '/' in a volume name.</p>
	<p>Because no checking was done on volume names, a user could supply
	a potential volume name of something like '../../../etc/passwd' to
	attempt to access a file not belonging to the storage pool. When
	fine-grained Access Control Lists (ACL) are in effect, a user with
	storage_vol:create ACL permission but lacking domain:write permission
	could thus abuse virStorageVolCreateXML and similar APIs to gain
	access to files not normally permitted to that user. Fortunately, it
	appears that the only APIs that could leak information or corrupt
	files require read-write connection to libvirtd; and when ACLs are not
	in use (the default without any further configuration), a user with
	read-write access can already be considered to have full access to the
	machine, and without an escalation of privilege there is no security
	problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5313</cvename>
	<url>http://security.libvirt.org/2015/0004.html</url>
	</references>
	<dates>
	<discovery>2015-10-30</discovery>
	<entry>2015-12-20</entry>
	</dates>
	</vuln>

	<vuln vid="ef434839-a6a4-11e5-8275-000c292e4fd8">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><lt>3.6.25_2</lt></range>
	</package>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.22</lt></range>
	</package>
	<package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
	</package>
	<package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.3</lt></range>
	</package>
	<package>
	<name>ldb</name>
	<range><ge>1.0.0</ge><lt>1.1.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba team reports:</p>
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.3.3">
	<p>[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.</p>
	<p>[CVE-2015-5330] Malicious request can cause Samba LDAP server
	to return uninitialized memory that should not be part of the reply.</p>
	<p>[CVE-2015-5296] Requesting encryption should also request
	signing when setting up the connection to protect against man-in-the-middle attacks.</p>
	<p>[CVE-2015-5299] A missing access control check in the VFS
	shadow_copy2 module could allow unauthorized users to access snapshots.</p>
	<p>[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.</p>
	<p>[CVE-2015-8467] Samba can expose Windows DCs to MS15-096
	Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).</p>
	<p>[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3223</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-3223.html</url>
	<cvename>CVE-2015-5252</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-5252.html</url>
	<cvename>CVE-2015-5296</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-5296.html</url>
	<cvename>CVE-2015-5299</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-5299.html</url>
	<cvename>CVE-2015-5330</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-5330.html</url>
	<cvename>CVE-2015-7540</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-7540.html</url>
	<cvename>CVE-2015-8467</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-8467.html</url>
	</references>
	<dates>
	<discovery>2015-12-16</discovery>
	<entry>2015-12-19</entry>
	<modified>2016-02-05</modified>
	</dates>
	</vuln>

	<vuln vid="bb7d4791-a5bf-11e5-a0e5-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>47.0.2526.106</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html">
	<p>2 security fixes in this release, including:</p>
	<ul>
	<li>[569486] CVE-2015-6792: Fixes from internal audits and
	fuzzing.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6792</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html</url>
	</references>
	<dates>
	<discovery>2015-12-16</discovery>
	<entry>2015-12-18</entry>
	</dates>
	</vuln>

	<vuln vid="7329938b-a4e6-11e5-b864-14dae9d210b8">
	<topic>cups-filters -- code execution</topic>
	<affects>
	<package>
	<name>cups-filters</name>
	<range><lt>1.4.0</lt></range>
	</package>
	<package>
	<name>foomatic-filters</name>
	<range><lt>4.0.17_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Till Kamppeter reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/13">
	<p>Cups Filters/Foomatic Filters does not consider semicolon
	as an illegal escape character.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/12/14/13</url>
	<cvename>CVE-2015-8560</cvename>
	</references>
	<dates>
	<discovery>2015-12-12</discovery>
	<entry>2015-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="6dbae1a8-a4e6-11e5-b864-14dae9d210b8">
	<topic>cups-filters -- code execution</topic>
	<affects>
	<package>
	<name>cups-filters</name>
	<range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>foomatic-filters</name>
	<range><lt>4.0.17_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Salvatore Bonaccorso reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/13/2">
	<p>Cups Filters/Foomatic Filters does not consider backtick
	as an illegal escape character.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/12/13/2</url>
	<cvename>CVE-2015-8327</cvename>
	</references>
	<dates>
	<discovery>2015-10-30</discovery>
	<entry>2015-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="1fbd6db1-a4e4-11e5-b864-14dae9d210b8">
	<topic>py-amf -- input sanitization errors</topic>
	<affects>
	<package>
	<name>py27-amf</name>
	<name>py32-amf</name>
	<name>py33-amf</name>
	<name>py34-amf</name>
	<range><lt>0.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-011.html">
	<p>A specially crafted AMF payload, containing malicious
	references to XML external entities, can be used to trigger Denial of
	Service (DoS) conditions or arbitrarily return the contents of files
	that are accessible with the running application privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.ocert.org/advisories/ocert-2015-011.html</url>
	<cvename>CVE-2015-8549</cvename>
	</references>
	<dates>
	<discovery>2015-12-01</discovery>
	<entry>2015-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="a9f60ce8-a4e0-11e5-b864-14dae9d210b8">
	<topic>joomla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><lt>3.4.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html">
	<h2>[20151201] - Core - Remote Code Execution Vulnerability</h2>
	<p>Browser information is not filtered properly while saving the
	session values into the database which leads to a Remote Code
	Execution vulnerability.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html">
	<h2>[20151202] - Core - CSRF Hardening</h2>
	<p>Add additional CSRF hardening in com_templates.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html">
	<h2>[20151203] - Core - Directory Traversal</h2>
	<p>Failure to properly sanitize input data from the XML install file
	located within an extension's package archive allows for directory
	traversal.</p>
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html">
	<h2>[20151204] - Core - Directory Traversal</h2>
	<p>Inadequate filtering of request data leads to a Directory Traversal
	vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html</url>
	<cvename>CVE-2015-8562</cvename>
	<cvename>CVE-2015-8563</cvename>
	<cvename>CVE-2015-8564</cvename>
	<cvename>CVE-2015-8565</cvename>
	<url>https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html</url>
	<url>https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html</url>
	<url>https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html</url>
	<url>https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html</url>
	</references>
	<dates>
	<discovery>2015-12-14</discovery>
	<entry>2015-12-17</entry>
	<modified>2016-12-22</modified>
	</dates>
	</vuln>

	<vuln vid="a8ec4db7-a398-11e5-85e9-14dae9d210b8">
	<topic>bind -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.8P2</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.3P2</lt></range>
	</package>
	<package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20151215</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_32</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html">
	<p>Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.</p>
	<p>Incorrect reference counting could result in an INSIST
	failure if a socket error occurred while performing a lookup. This flaw
	is disclosed in CVE-2015-8461. [RT#40945]</p>
	<p>Insufficient testing when parsing a message allowed records
	with an incorrect class to be be accepted, triggering a REQUIRE failure
	when those records were subsequently cached. This flaw is disclosed in
	CVE-2015-8000. [RT #40987]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html</url>
	<url>https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html</url>
	<url>https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html</url>
	<cvename>CVE-2015-3193</cvename>
	<cvename>CVE-2015-8000</cvename>
	<cvename>CVE-2015-8461</cvename>
	<freebsdsa>SA-15:27.bind</freebsdsa>
	</references>
	<dates>
	<discovery>2015-11-24</discovery>
	<entry>2015-12-16</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="2c2d1c39-1396-459a-91f5-ca03ee7c64c6">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>43.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>43.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.40</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.40</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.5.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>38.5.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>38.5.0</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-134 Miscellaneous memory safety hazards
	(rv:43.0 / rv:38.5)</p>
	<p>MFSA 2015-135 Crash with JavaScript variable assignment
	with unboxed objects</p>
	<p>MFSA 2015-136 Same-origin policy violation using
	perfomance.getEntries and history navigation</p>
	<p>MFSA 2015-137 Firefox allows for control characters to be
	set in cookies</p>
	<p>MFSA 2015-138 Use-after-free in WebRTC when datachannel
	is used after being destroyed</p>
	<p>MFSA 2015-139 Integer overflow allocating extremely large
	textures</p>
	<p>MFSA 2015-140 Cross-origin information leak through web
	workers error events</p>
	<p>MFSA 2015-141 Hash in data URI is incorrectly parsed</p>
	<p>MFSA 2015-142 DOS due to malformed frames in HTTP/2</p>
	<p>MFSA 2015-143 Linux file chooser crashes on malformed
	images due to flaws in Jasper library</p>
	<p>MFSA 2015-144 Buffer overflows found through code
	inspection</p>
	<p>MFSA 2015-145 Underflow through code inspection</p>
	<p>MFSA 2015-146 Integer overflow in MP4 playback in 64-bit
	versions</p>
	<p>MFSA 2015-147 Integer underflow and buffer overflow
	processing MP4 metadata in libstagefright</p>
	<p>MFSA 2015-148 Privilege escalation vulnerabilities in
	WebExtension APIs</p>
	<p>MFSA 2015-149 Cross-site reading attack through data and
	view-source URIs</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7201</cvename>
	<cvename>CVE-2015-7202</cvename>
	<cvename>CVE-2015-7203</cvename>
	<cvename>CVE-2015-7204</cvename>
	<cvename>CVE-2015-7205</cvename>
	<cvename>CVE-2015-7207</cvename>
	<cvename>CVE-2015-7208</cvename>
	<cvename>CVE-2015-7210</cvename>
	<cvename>CVE-2015-7211</cvename>
	<cvename>CVE-2015-7212</cvename>
	<cvename>CVE-2015-7213</cvename>
	<cvename>CVE-2015-7214</cvename>
	<cvename>CVE-2015-7215</cvename>
	<cvename>CVE-2015-7216</cvename>
	<cvename>CVE-2015-7217</cvename>
	<cvename>CVE-2015-7218</cvename>
	<cvename>CVE-2015-7219</cvename>
	<cvename>CVE-2015-7220</cvename>
	<cvename>CVE-2015-7221</cvename>
	<cvename>CVE-2015-7222</cvename>
	<cvename>CVE-2015-7223</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-134/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-135/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-136/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-137/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-138/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-139/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-140/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-141/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-142/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-143/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-144/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-145/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-146/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-147/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-148/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-149/</url>
	</references>
	<dates>
	<discovery>2015-12-15</discovery>
	<entry>2015-12-15</entry>
	</dates>
	</vuln>

	<vuln vid="a5934ba8-a376-11e5-85e9-14dae9d210b8">
	<topic>java -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openjdk8</name>
	<name>openjdk8-jre</name>
	<range><lt>8.66.17</lt></range>
	</package>
	<package>
	<name>openjdk7</name>
	<name>openjdk7-jre</name>
	<range><lt>7.91.02,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA">
	<p>This Critical Patch Update contains 25 new security fixes
	for Oracle Java SE. 24 of these vulnerabilities may be remotely
	exploitable without authentication, i.e., may be exploited over a
	network without the need for a username and password.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA</url>
	<cvename>CVE-2015-4835</cvename>
	<cvename>CVE-2015-4881</cvename>
	<cvename>CVE-2015-4843</cvename>
	<cvename>CVE-2015-4883</cvename>
	<cvename>CVE-2015-4860</cvename>
	<cvename>CVE-2015-4805</cvename>
	<cvename>CVE-2015-4844</cvename>
	<cvename>CVE-2015-4901</cvename>
	<cvename>CVE-2015-4868</cvename>
	<cvename>CVE-2015-4810</cvename>
	<cvename>CVE-2015-4806</cvename>
	<cvename>CVE-2015-4871</cvename>
	<cvename>CVE-2015-4902</cvename>
	<cvename>CVE-2015-4840</cvename>
	<cvename>CVE-2015-4882</cvename>
	<cvename>CVE-2015-4842</cvename>
	<cvename>CVE-2015-4734</cvename>
	<cvename>CVE-2015-4903</cvename>
	<cvename>CVE-2015-4803</cvename>
	<cvename>CVE-2015-4893</cvename>
	<cvename>CVE-2015-4911</cvename>
	<cvename>CVE-2015-4872</cvename>
	<cvename>CVE-2015-4906</cvename>
	<cvename>CVE-2015-4916</cvename>
	<cvename>CVE-2015-4908</cvename>
	</references>
	<dates>
	<discovery>2015-10-20</discovery>
	<entry>2015-12-15</entry>
	<modified>2016-01-08</modified>
	</dates>
	</vuln>

	<vuln vid="daadef86-a366-11e5-8b40-20cf30e32f6d">
	<topic>subversion -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion17</name>
	<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
	</package>
	<package>
	<name>subversion18</name>
	<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
	</package>
	<package>
	<name>subversion</name>
	<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
	</package>
	<package>
	<name>mod_dav_svn</name>
	<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
	<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/">
	<p>Remotely triggerable heap overflow and out-of-bounds read caused
	by integer overflow in the svn:// protocol parser.</p>
	<p>Remotely triggerable heap overflow and out-of-bounds read in
	mod_dav_svn caused by integer overflow when parsing skel-encoded
	request bodies.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5343</cvename>
	<url>http://subversion.apache.org/security/CVE-2015-5343-advisory.txt</url>
	<cvename>CVE-2015-5259</cvename>
	<url>http://subversion.apache.org/security/CVE-2015-5259-advisory.txt</url>
	</references>
	<dates>
	<discovery>2015-11-14</discovery>
	<entry>2015-12-15</entry>
	</dates>
	</vuln>

	<vuln vid="72c145df-a1e0-11e5-8ad0-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<!--pcbsd-->
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>47.0.2526.80</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html">
	<p>7 security fixes in this release, including:</p>
	<ul>
	<li>[548273] High CVE-2015-6788: Type confusion in extensions.
	Credit to anonymous.</li>
	<li>[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to
	cloudfuzzer.</li>
	<li>[542054] Medium CVE-2015-6790: Escaping issue in saved pages.
	Credit to Inti De Ceukelaire.</li>
	<li>[567513] CVE-2015-6791: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.7
	branch (currently 4.7.80.23).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6788</cvename>
	<cvename>CVE-2015-6789</cvename>
	<cvename>CVE-2015-6790</cvename>
	<cvename>CVE-2015-6791</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html</url>
	</references>
	<dates>
	<discovery>2015-12-08</discovery>
	<entry>2015-12-13</entry>
	</dates>
	</vuln>

	<vuln vid="33459061-a1d6-11e5-8794-bcaec565249c">
	<topic>freeimage -- multiple integer overflows</topic>
	<affects>
	<package>
	<name>freeimage</name>
	<range><lt>3.16.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pcheng pcheng reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/28/1">
	<p>An integer overflow issue in the FreeImage project was
	reported and fixed recently.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0852</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/08/28/1</url>
	</references>
	<dates>
	<discovery>2015-08-28</discovery>
	<entry>2015-12-13</entry>
	</dates>
	</vuln>

	<vuln vid="21bc4d71-9ed8-11e5-8f5c-002590263bf5">
	<topic>redmine -- information leak vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>2.6.9</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
	<range><ge>3.1.0</ge><lt>3.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Data disclosure in atom feed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8537</cvename>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	</references>
	<dates>
	<discovery>2015-12-05</discovery>
	<entry>2015-12-10</entry>
	<modified>2015-12-11</modified>
	</dates>
	</vuln>

	<vuln vid="be63533c-9ed7-11e5-8f5c-002590263bf5">
	<topic>redmine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>2.6.8</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.6</lt></range>
	<range><ge>3.1.0</ge><lt>3.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Potential changeset message disclosure in issues API.</p>
	<p>Data disclosure on the time logging form</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8346</cvename>
	<cvename>CVE-2015-8473</cvename>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	<url>http://www.openwall.com/lists/oss-security/2015/11/25/12</url>
	<url>http://www.openwall.com/lists/oss-security/2015/12/03/7</url>
	</references>
	<dates>
	<discovery>2015-11-14</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="3ec2e0bc-9ed7-11e5-8f5c-002590263bf5">
	<topic>redmine -- open redirect vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><ge>2.5.1</ge><lt>2.6.7</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.5</lt></range>
	<range><eq>3.1.0</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Open Redirect vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8474</cvename>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	<url>http://www.openwall.com/lists/oss-security/2015/12/04/1</url>
	</references>
	<dates>
	<discovery>2015-09-20</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="939a7086-9ed6-11e5-8f5c-002590263bf5">
	<topic>redmine -- potential XSS vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>2.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Potential XSS vulnerability when rendering some flash messages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8477</cvename>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	<url>http://www.openwall.com/lists/oss-security/2015/12/05/6</url>
	</references>
	<dates>
	<discovery>2015-02-19</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="49def4b7-9ed6-11e5-8f5c-002590263bf5">
	<topic>redmine -- information leak vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>2.4.6</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Potential data leak (project names) in the invalid form
	authenticity token error screen.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	</references>
	<dates>
	<discovery>2014-07-06</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="c2efcd46-9ed5-11e5-8f5c-002590263bf5">
	<topic>redmine -- open redirect vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>2.4.5</lt></range>
	<range><eq>2.5.0</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Open Redirect vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1985</cvename>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	<url>https://jvn.jp/en/jp/JVN93004610/index.html</url>
	</references>
	<dates>
	<discovery>2014-03-29</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="66ba5931-9ed5-11e5-8f5c-002590263bf5">
	<topic>redmine -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><ge>2.1.0</ge><lt>2.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>XSS vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	</references>
	<dates>
	<discovery>2012-09-30</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="0e0385d1-9ed5-11e5-8f5c-002590263bf5">
	<topic>redmine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>1.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Mass-assignment vulnerability that would allow an attacker to
	bypass part of the security checks.</p>
	<p>Persistent XSS vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0327</cvename>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	<url>http://jvn.jp/en/jp/JVN93406632/</url>
	</references>
	<dates>
	<discovery>2012-03-11</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="ae377aeb-9ed4-11e5-8f5c-002590263bf5">
	<topic>redmine -- CSRF protection bypass</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>1.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Redmine reports:</p>
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	<p>Vulnerability that would allow an attacker to bypass the CSRF
	protection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
	</references>
	<dates>
	<discovery>2011-12-10</discovery>
	<entry>2015-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="23af0425-9eac-11e5-b937-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>1.641</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>1.625.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09">
	<h1>Description</h1>
	<h5>SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)</h5>
	<p>In certain configurations, low privilege users were able to
	create e.g. HTML files in workspaces and archived artifacts that
	could result in XSS when accessed by other users. Jenkins now sends
	Content-Security-Policy headers that enables sandboxing and
	prohibits script execution by default.</p>
	<h5>SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)</h5>
	<p>Several administration/configuration related URLs could be
	accessed using GET, which allowed attackers to circumvent CSRF
	protection.</p>
	<h5>SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)</h5>
	<p>Malicious users were able to circumvent CSRF protection on any
	URL by sending specially crafted POST requests.</p>
	<h5>SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)</h5>
	<p>While the Jenkins update site data is digitally signed, and the
	signature verified by Jenkins, Jenkins did not verify the provided
	SHA-1 checksums for the plugin files referenced in the update site
	data. This enabled MITM attacks on the plugin manager, resulting
	in installation of attacker-provided plugins.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09</url>
	</references>
	<dates>
	<discovery>2015-12-09</discovery>
	<entry>2015-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="c8842a84-9ddd-11e5-8c2f-c485083ca99c">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.554</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html">
	<p>
	These updates resolve heap buffer overflow vulnerabilities that
	could lead to code execution (CVE-2015-8438, CVE-2015-8446).</p>

	<p>
	These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2015-8444, CVE-2015-8443,
	CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047,
	CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,
	CVE-2015-8419, CVE-2015-8408).</p>

	<p>
	These updates resolve security bypass vulnerabilities
	(CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).</p>

	<p>
	These updates resolve a stack overflow vulnerability that
	could lead to code execution (CVE-2015-8407).</p>

	<p>
	These updates resolve a type confusion vulnerability that
	could lead to code execution (CVE-2015-8439).</p>

	<p>
	These updates resolve an integer overflow vulnerability
	that could lead to code execution (CVE-2015-8445).</p>

	<p>
	These updates resolve a buffer overflow vulnerability that
	could lead to code execution (CVE-2015-8415).</p>

	<p>
	These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2015-8050, CVE-2015-8049,
	CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448,
	CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,
	CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424,
	CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423,
	CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431,
	CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428,
	CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,
	CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055,
	CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067,
	CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064,
	CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404,
	CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,
	CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441,
	CVE-2015-8442, CVE-2015-8447).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-32.html</url>
	<cvename>CVE-2015-8045</cvename>
	<cvename>CVE-2015-8047</cvename>
	<cvename>CVE-2015-8048</cvename>
	<cvename>CVE-2015-8049</cvename>
	<cvename>CVE-2015-8050</cvename>
	<cvename>CVE-2015-8051</cvename>
	<cvename>CVE-2015-8052</cvename>
	<cvename>CVE-2015-8053</cvename>
	<cvename>CVE-2015-8054</cvename>
	<cvename>CVE-2015-8055</cvename>
	<cvename>CVE-2015-8056</cvename>
	<cvename>CVE-2015-8057</cvename>
	<cvename>CVE-2015-8058</cvename>
	<cvename>CVE-2015-8059</cvename>
	<cvename>CVE-2015-8060</cvename>
	<cvename>CVE-2015-8061</cvename>
	<cvename>CVE-2015-8062</cvename>
	<cvename>CVE-2015-8063</cvename>
	<cvename>CVE-2015-8064</cvename>
	<cvename>CVE-2015-8065</cvename>
	<cvename>CVE-2015-8066</cvename>
	<cvename>CVE-2015-8067</cvename>
	<cvename>CVE-2015-8068</cvename>
	<cvename>CVE-2015-8069</cvename>
	<cvename>CVE-2015-8070</cvename>
	<cvename>CVE-2015-8071</cvename>
	<cvename>CVE-2015-8401</cvename>
	<cvename>CVE-2015-8402</cvename>
	<cvename>CVE-2015-8403</cvename>
	<cvename>CVE-2015-8404</cvename>
	<cvename>CVE-2015-8405</cvename>
	<cvename>CVE-2015-8406</cvename>
	<cvename>CVE-2015-8407</cvename>
	<cvename>CVE-2015-8408</cvename>
	<cvename>CVE-2015-8409</cvename>
	<cvename>CVE-2015-8410</cvename>
	<cvename>CVE-2015-8411</cvename>
	<cvename>CVE-2015-8412</cvename>
	<cvename>CVE-2015-8413</cvename>
	<cvename>CVE-2015-8414</cvename>
	<cvename>CVE-2015-8415</cvename>
	<cvename>CVE-2015-8416</cvename>
	<cvename>CVE-2015-8417</cvename>
	<cvename>CVE-2015-8419</cvename>
	<cvename>CVE-2015-8420</cvename>
	<cvename>CVE-2015-8421</cvename>
	<cvename>CVE-2015-8422</cvename>
	<cvename>CVE-2015-8423</cvename>
	<cvename>CVE-2015-8424</cvename>
	<cvename>CVE-2015-8425</cvename>
	<cvename>CVE-2015-8426</cvename>
	<cvename>CVE-2015-8427</cvename>
	<cvename>CVE-2015-8428</cvename>
	<cvename>CVE-2015-8429</cvename>
	<cvename>CVE-2015-8430</cvename>
	<cvename>CVE-2015-8431</cvename>
	<cvename>CVE-2015-8432</cvename>
	<cvename>CVE-2015-8433</cvename>
	<cvename>CVE-2015-8434</cvename>
	<cvename>CVE-2015-8435</cvename>
	<cvename>CVE-2015-8436</cvename>
	<cvename>CVE-2015-8437</cvename>
	<cvename>CVE-2015-8438</cvename>
	<cvename>CVE-2015-8439</cvename>
	<cvename>CVE-2015-8440</cvename>
	<cvename>CVE-2015-8441</cvename>
	<cvename>CVE-2015-8442</cvename>
	<cvename>CVE-2015-8443</cvename>
	<cvename>CVE-2015-8444</cvename>
	<cvename>CVE-2015-8445</cvename>
	<cvename>CVE-2015-8446</cvename>
	<cvename>CVE-2015-8447</cvename>
	<cvename>CVE-2015-8448</cvename>
	<cvename>CVE-2015-8449</cvename>
	<cvename>CVE-2015-8450</cvename>
	<cvename>CVE-2015-8451</cvename>
	<cvename>CVE-2015-8452</cvename>
	<cvename>CVE-2015-8453</cvename>
	</references>
	<dates>
	<discovery>2015-12-08</discovery>
	<entry>2015-12-08</entry>
	</dates>
	</vuln>

	<vuln vid="215e740e-9c56-11e5-90e7-b499baebfeaf">
	<topic>libressl -- NULL pointer dereference</topic>
	<affects>
	<package>
	<name>libressl</name>
	<range><lt>2.2.5</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenBSD project reports:</p>
	<blockquote cite="https://marc.info/?l=openbsd-announce&t=144920914600002">
	<p>A NULL pointer deference could be triggered by a crafted
	certificate sent to services configured to verify client
	certificates on TLS/SSL connections.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://marc.info/?l=openbsd-announce&t=144920914600002</url>
	<cvename>CVE-2015-3194</cvename>
	</references>
	<dates>
	<discovery>2015-12-03</discovery>
	<entry>2015-12-08</entry>
	</dates>
	</vuln>

	<vuln vid="918a5d1f-9d40-11e5-8f5c-002590263bf5">
	<topic>KeePassX -- information disclosure</topic>
	<affects>
	<package>
	<name>KeePassX</name>
	<range><lt>0.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yves-Alexis Perez reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/4">
	<p>Starting an export (using File / Export to / KeepassX XML file) and
	cancelling it leads to KeepassX saving a cleartext XML file in
	~/.xml without any warning.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8378</cvename>
	<freebsdpr>ports/205105</freebsdpr>
	<url>http://www.openwall.com/lists/oss-security/2015/11/30/4</url>
	</references>
	<dates>
	<discovery>2015-07-08</discovery>
	<entry>2015-12-08</entry>
	</dates>
	</vuln>

	<vuln vid="84fdd1bb-9d37-11e5-8f5c-002590263bf5">
	<topic>passenger -- client controlled header overwriting</topic>
	<affects>
	<package>
	<name>rubygem-passenger</name>
	<range><ge>5.0.0</ge><lt>5.0.22</lt></range>
	<range><lt>4.0.60</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel Knoppel reports:</p>
	<blockquote cite="https://blog.phusion.nl/2015/12/07/cve-2015-7519/">
	<p>It was discovered by the SUSE security team that it was possible,
	in some cases, for clients to overwrite headers set by the server,
	resulting in a medium level security issue. CVE-2015-7519 has been
	assigned to this issue.</p>
	<p>Affected use-cases:</p>
	<p>Header overwriting may occur if all of the following conditions are met:</p>
	<ul>
	<li>Apache integration mode, or standalone+builtin engine without
	a filtering proxy</li>
	<li>Ruby or Python applications only (Passenger 5); or any
	application (Passenger 4)</li>
	<li>The app depends on a request header containing a dash (-)</li>
	<li>The header is supposed to be trusted (set by the server)</li>
	<li>The client correctly guesses the header name</li>
	</ul>
	<p>This vulnerability has been fixed by filtering out client headers
	that do not consist of alphanumeric/dash characters (Nginx already
	did this, so Passenger+Nginx was not affected). If your application
	depends on headers that don't conform to this, you can add a
	workaround in Apache specifically for those to convert them to a
	dash-based format.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7519</cvename>
	<url>https://blog.phusion.nl/2015/12/07/cve-2015-7519/</url>
	</references>
	<dates>
	<discovery>2015-12-07</discovery>
	<entry>2015-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="e6b974ab-9d35-11e5-8f5c-002590263bf5">
	<topic>Salt -- information disclosure</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<range><lt>2015.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Salt release notes report:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html">
	<p>CVE-2015-8034: Saving state.sls cache data to disk with insecure
	permissions</p>
	<p>This affects users of the state.sls function. The state run cache
	on the minion was being created with incorrect permissions. This
	file could potentially contain sensitive data that was inserted via
	jinja into the state SLS files. The permissions for this file are
	now being set correctly. Thanks to @zmalone for bringing this issue
	to our attention.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8034</cvename>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html</url>
	</references>
	<dates>
	<discovery>2015-11-25</discovery>
	<entry>2015-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="6bc6eed2-9cca-11e5-8c2b-c335fa8985d7">
	<topic>libraw -- memory objects not properly initialized</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><lt>0.17.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ChenQin reports:</p>
	<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
	<p>The LibRaw raw image decoder has multiple vulnerabilities that can
	cause memory errors which may lead to code execution or other
	problems.</p>
	<p>In CVE-2015-8367, LibRaw's phase_one_correct function does not
	handle memory initialization correctly, which may cause other
	problems.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.libraw.org/news/libraw-0-17-1</url>
	<url>https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780</url>
	<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
	<cvename>CVE-2015-8367</cvename>
	</references>
	<dates>
	<discovery>2015-11-30</discovery>
	<entry>2015-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="db04bf07-9cc8-11e5-8c2b-c335fa8985d7">
	<topic>libraw -- index overflow in smal_decode_segment</topic>
	<affects>
	<package>
	<name>libraw</name>
	<range><lt>0.17.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ChenQin reports:</p>
	<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
	<p>The LibRaw raw image decoder has multiple vulnerabilities that can
	cause memory errors which may lead to code execution or other
	problems.</p>
	<p>In CVE-2015-8366, LibRaw's smal_decode_segment function does not
	handle indexes carefully, which can cause an index overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.libraw.org/news/libraw-0-17-1</url>
	<url>https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2</url>
	<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
	<cvename>CVE-2015-8366</cvename>
	</references>
	<dates>
	<discovery>2015-11-30</discovery>
	<entry>2015-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="4c8d1d72-9b38-11e5-aece-d050996490d0">
	<topic>openssl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2_5</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.2e</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_7</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_8</lt></range>
	<range><ge>10.1</ge><lt>10.1_25</lt></range>
	<range><ge>9.3</ge><lt>9.3_31</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv/20151203.txt">
	<ol>
	<li>BN_mod_exp may produce incorrect results on x86_64
	(CVE-2015-3193)</li>
	<li>Certificate verify crash with missing PSS parameter
	(CVE-2015-3194)</li>
	<li>X509_ATTRIBUTE memory leak (CVE-2015-3195)</li>
	<li>Race condition handling PSK identify hint
	(CVE-2015-3196)</li>
	<li>Anon DH ServerKeyExchange with 0 p parameter
	(CVE-2015-1794)</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:26.openssl</freebsdsa>
	<cvename>CVE-2015-1794</cvename>
	<cvename>CVE-2015-3193</cvename>
	<cvename>CVE-2015-3194</cvename>
	<cvename>CVE-2015-3195</cvename>
	<cvename>CVE-2015-3196</cvename>
	<url>https://www.openssl.org/news/secadv/20151203.txt</url>
	</references>
	<dates>
	<discovery>2015-12-03</discovery>
	<entry>2015-12-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="8a90dc87-89f9-11e5-a408-00248c0c745d">
	<topic>PHPmailer -- SMTP injection vulnerability</topic>
	<affects>
	<package>
	<name>phpmailer</name>
	<range><lt>5.2.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHPMailer changelog reports:</p>
	<blockquote cite="https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md">
	<p>Fix vulnerability that allowed email addresses with
	line breaks (valid in RFC5322) to pass to SMTP, permitting
	message injection at the SMTP level. Mitigated in both
	the address validator and in the lower-level SMTP class.
	Thanks to Takeshi Terada.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md</url>
	</references>
	<dates>
	<discovery>2015-11-05</discovery>
	<entry>2015-12-03</entry>
	</dates>
	</vuln>

	<vuln vid="b0da85af-21a3-4c15-a137-fe9e4bc86002">
	<topic>ffmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libav</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>gstreamer-ffmpeg</name>
	<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>handbrake</name>
	- <!-- handbrake-0.10.2 has libav-10.1 -->
	- <!-- no known fixed version -->
	- <range><ge>0</ge></range>
	+ <!-- handbrake prior to 1.2.0 has libav-10.1 -->
	+ <!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
	+ <range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>ffmpeg</name>
	<range><ge>2.8,1</ge><lt>2.8.3,1</lt></range>
	<range><lt>2.7.3,1</lt></range>
	</package>
	<package>
	<name>ffmpeg26</name>
	<range><lt>2.6.5</lt></range>
	</package>
	<package>
	<name>ffmpeg25</name>
	<range><lt>2.5.9</lt></range>
	</package>
	<package>
	<name>ffmpeg24</name>
	<range><lt>2.4.12</lt></range>
	</package>
	<package>
	<name>ffmpeg-devel</name>
	<name>ffmpeg23</name>
	<name>ffmpeg2</name>
	<name>ffmpeg1</name>
	<name>ffmpeg-011</name>
	<name>ffmpeg0</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>avidemux</name>
	<name>avidemux2</name>
	<name>avidemux26</name>
	<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>kodi</name>
	<!-- kodi-15.2 has ffmpeg-2.6.4 -->
	<range><lt>16.0</lt></range>
	</package>
	<package>
	<name>mplayer</name>
	<name>mencoder</name>
	<!-- mplayer-1.1.r20150822_6 has ffmpeg-2.8.2 -->
	<range><lt>1.1.r20150822_7</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
	<range><le>0.27.5,1</le></range>
	</package>
	<package>
	<name>plexhometheater</name>
	<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6761">
	<p>The update_dimensions function in libavcodec/vp8.c in
	FFmpeg through 2.8.1, as used in Google Chrome before
	46.0.2490.71 and other products, relies on a
	coefficient-partition count during multi-threaded operation,
	which allows remote attackers to cause a denial of service
	(race condition and memory corruption) or possibly have
	unspecified other impact via a crafted WebM file.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8216">
	<p>The ljpeg_decode_yuv_scan function in
	libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain
	width and height checks, which allows remote attackers to
	cause a denial of service (out-of-bounds array access) or
	possibly have unspecified other impact via crafted MJPEG
	data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8217">
	<p>The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in
	FFmpeg before 2.8.2 does not validate the Chroma Format
	Indicator, which allows remote attackers to cause a denial
	of service (out-of-bounds array access) or possibly have
	unspecified other impact via crafted High Efficiency Video
	Coding (HEVC) data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8218">
	<p>The decode_uncompressed function in libavcodec/faxcompr.c
	in FFmpeg before 2.8.2 does not validate uncompressed runs,
	which allows remote attackers to cause a denial of service
	(out-of-bounds array access) or possibly have unspecified
	other impact via crafted CCITT FAX data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8219">
	<p>The init_tile function in libavcodec/jpeg2000dec.c in
	FFmpeg before 2.8.2 does not enforce minimum-value and
	maximum-value constraints on tile coordinates, which allows
	remote attackers to cause a denial of service (out-of-bounds
	array access) or possibly have unspecified other impact via
	crafted JPEG 2000 data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8363">
	<p>The jpeg2000_read_main_headers function in
	libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x
	before 2.7.3, and 2.8.x through 2.8.2 does not enforce
	uniqueness of the SIZ marker in a JPEG 2000 image, which
	allows remote attackers to cause a denial of service
	(out-of-bounds heap-memory access) or possibly have
	unspecified other impact via a crafted image with two or
	more of these markers.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8364">
	<p>Integer overflow in the ff_ivi_init_planes function in
	libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3,
	and 2.8.x through 2.8.2 allows remote attackers to cause a
	denial of service (out-of-bounds heap-memory access) or
	possibly have unspecified other impact via crafted image
	dimensions in Indeo Video Interactive data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8365">
	<p>The smka_decode_frame function in libavcodec/smacker.c in
	FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through
	2.8.2 does not verify that the data size is consistent with
	the number of channels, which allows remote attackers to
	cause a denial of service (out-of-bounds array access) or
	possibly have unspecified other impact via crafted Smacker
	data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6761</cvename>
	<cvename>CVE-2015-8216</cvename>
	<cvename>CVE-2015-8217</cvename>
	<cvename>CVE-2015-8218</cvename>
	<cvename>CVE-2015-8219</cvename>
	<cvename>CVE-2015-8363</cvename>
	<cvename>CVE-2015-8364</cvename>
	<cvename>CVE-2015-8365</cvename>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892</url>
	<url>https://ffmpeg.org/security.html</url>
	</references>
	<dates>
	<discovery>2015-11-27</discovery>
	<entry>2015-12-02</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="548f74bd-993c-11e5-956b-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<!--pcbsd-->
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>47.0.2526.73</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html">
	<p>41 security fixes in this release, including:</p>
	<ul>
	<li>[558589] Critical CVE-2015-6765: Use-after-free in AppCache.
	Credit to anonymous.</li>
	<li>[551044] High CVE-2015-6766: Use-after-free in AppCache.
	Credit to anonymous.</li>
	<li>[554908] High CVE-2015-6767: Use-after-free in AppCache.
	Credit to anonymous.</li>
	<li>[556724] High CVE-2015-6768: Cross-origin bypass in DOM.
	Credit to Mariusz Mlynski.</li>
	<li>[534923] High CVE-2015-6769: Cross-origin bypass in core.
	Credit to Mariusz Mlynski.</li>
	<li>[541206] High CVE-2015-6770: Cross-origin bypass in DOM.
	Credit to Mariusz Mlynski.</li>
	<li>[544991] High CVE-2015-6771: Out of bounds access in v8.
	Credit to anonymous.</li>
	<li>[546545] High CVE-2015-6772: Cross-origin bypass in DOM.
	Credit to Mariusz Mlynski.</li>
	<li>[554946] High CVE-2015-6764: Out of bounds access in v8.
	Credit to Guang Gong of Qihoo 360 via pwn2own.</li>
	<li>[491660] High CVE-2015-6773: Out of bounds access in Skia.
	Credit to cloudfuzzer.</li>
	<li>[549251] High CVE-2015-6774: Use-after-free in Extensions.
	Credit to anonymous.</li>
	<li>[529012] High CVE-2015-6775: Type confusion in PDFium.
	Credit to Atte Kettunen of OUSPG.</li>
	<li>[457480] High CVE-2015-6776: Out of bounds access in PDFium.
	Credit to Hanno Böck.</li>
	<li>[544020] High CVE-2015-6777: Use-after-free in DOM.
	Credit to Long Liu of Qihoo 360Vulcan Team.</li>
	<li>[514891] Medium CVE-2015-6778: Out of bounds access in PDFium.
	Credit to Karl Skomski.</li>
	<li>[528505] Medium CVE-2015-6779: Scheme bypass in PDFium.
	Credit to Til Jasper Ullrich.</li>
	<li>[490492] Medium CVE-2015-6780: Use-after-free in Infobars.
	Credit to Khalil Zhani.</li>
	<li>[497302] Medium CVE-2015-6781: Integer overflow in Sfntly.
	Credit to miaubiz.</li>
	<li>[536652] Medium CVE-2015-6782: Content spoofing in Omnibox.
	Credit to Luan Herrera.</li>
	<li>[537205] Medium CVE-2015-6783: Signature validation issue in
	Android Crazy Linker. Credit to Michal Bednarski.</li>
	<li>[503217] Low CVE-2015-6784: Escaping issue in saved pages.
	Credit to Inti De Ceukelaire.</li>
	<li>[534542] Low CVE-2015-6785: Wildcard matching issue in CSP.
	Credit to Michael Ficarra / Shape Security.</li>
	<li>[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to
	Michael Ficarra / Shape Security.</li>
	<li>[563930] CVE-2015-6787: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	<li> Multiple vulnerabilities in V8 fixed at the tip of the 4.7
	branch (currently 4.7.80.23).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6765</cvename>
	<cvename>CVE-2015-6766</cvename>
	<cvename>CVE-2015-6767</cvename>
	<cvename>CVE-2015-6768</cvename>
	<cvename>CVE-2015-6769</cvename>
	<cvename>CVE-2015-6770</cvename>
	<cvename>CVE-2015-6771</cvename>
	<cvename>CVE-2015-6772</cvename>
	<cvename>CVE-2015-6773</cvename>
	<cvename>CVE-2015-6774</cvename>
	<cvename>CVE-2015-6775</cvename>
	<cvename>CVE-2015-6776</cvename>
	<cvename>CVE-2015-6777</cvename>
	<cvename>CVE-2015-6778</cvename>
	<cvename>CVE-2015-6779</cvename>
	<cvename>CVE-2015-6780</cvename>
	<cvename>CVE-2015-6781</cvename>
	<cvename>CVE-2015-6782</cvename>
	<cvename>CVE-2015-6783</cvename>
	<cvename>CVE-2015-6784</cvename>
	<cvename>CVE-2015-6785</cvename>
	<cvename>CVE-2015-6786</cvename>
	<cvename>CVE-2015-6787</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2015-12-01</discovery>
	<entry>2015-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="11351c82-9909-11e5-a9c8-14dae9d5a9d2">
	<topic>piwik -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><lt>2.15.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Piwik changelog reports:</p>
	<blockquote cite="http://piwik.org/changelog/piwik-2-15-0/">
	<p>This release is rated critical.

	We are grateful for Security researchers who disclosed
	security issues privately to the Piwik Security Response
	team: Elamaran Venkatraman, Egidio Romano and Dmitriy
	Shcherbatov. The following vulnerabilities were fixed:
	XSS, CSRF, possible file inclusion in older PHP versions
	(low impact), possible Object Injection Vulnerability
	(low impact).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7815</cvename>
	<cvename>CVE-2015-7816</cvename>
	<url>http://piwik.org/changelog/piwik-2-15-0/</url>
	</references>
	<dates>
	<discovery>2015-11-17</discovery>
	<entry>2015-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="d62ec98e-97d8-11e5-8c0e-080027b00c2e">
	<topic>cyrus-imapd -- integer overflow in the start_octet addition</topic>
	<affects>
	<package>
	<name>cyrus-imapd25</name>
	<range><ge>2.5.0</ge><lt>2.5.7</lt></range>
	</package>
	<package>
	<name>cyrus-imapd24</name>
	<range><ge>2.4.0</ge><lt>2.4.18_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cyrus IMAP 2.5.7 Release Note states:</p>
	<blockquote cite="https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html">
	<p>CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8078</cvename>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078</url>
	<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2015-8078</url>
	<cvename>CVE-2015-8077</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077</url>
	<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2015-8077</url>
	</references>
	<dates>
	<discovery>2015-11-04</discovery>
	<entry>2015-12-01</entry>
	</dates>
	</vuln>

	<vuln vid="11c52bc6-97aa-11e5-b8df-14dae9d210b8">
	<topic>django -- information leak vulnerability</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<name>py32-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<range><lt>1.8.7</lt></range>
	</package>
	<package>
	<name>py27-django18</name>
	<name>py32-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<range><lt>1.8.7</lt></range>
	</package>
	<package>
	<name>py27-django17</name>
	<name>py32-django17</name>
	<name>py33-django17</name>
	<name>py34-django17</name>
	<range><lt>1.7.11</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<name>py32-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<range><le>20150709,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Graham reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
	<p>If an application allows users to specify an unvalidated
	format for dates and passes this format to the date filter, e.g. {{
	last_updated\|date:user_date_format }}, then a malicious user could
	obtain any secret in the application's settings by specifying a settings
	key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/</url>
	<cvename>CVE-2015-8213</cvename>
	</references>
	<dates>
	<discovery>2015-11-24</discovery>
	<entry>2015-11-30</entry>
	<modified>2015-12-24</modified>
	</dates>
	</vuln>

	<vuln vid="fb2475c2-9125-11e5-bd18-002590263bf5">
	<topic>kibana4 -- CSRF vulnerability</topic>
	<affects>
	<package>
	<name>kibana4</name>
	<name>kibana41</name>
	<range><ge>4.0.0</ge><lt>4.1.3</lt></range>
	</package>
	<package>
	<name>kibana42</name>
	<range><ge>4.2.0</ge><lt>4.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security/">
	<p>Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1
	are vulnerable to a CSRF attack.</p>
	<p>Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8131</cvename>
	<url>https://www.elastic.co/community/security/</url>
	</references>
	<dates>
	<discovery>2015-11-17</discovery>
	<entry>2015-11-22</entry>
	</dates>
	</vuln>

	<vuln vid="e359051d-90bd-11e5-bd18-002590263bf5">
	<topic>a2ps -- format string vulnerability</topic>
	<affects>
	<package>
	<name>a2ps</name>
	<range><lt>4.13b_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jong-Gwon Kim reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/16/4">
	<p>When user runs a2ps with malicious crafted pro(a2ps prologue) file,
	an attacker can execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8107</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/11/16/4</url>
	</references>
	<dates>
	<discovery>2015-11-16</discovery>
	<entry>2015-11-22</entry>
	</dates>
	</vuln>

	<vuln vid="ecc268f2-8fc2-11e5-918c-bcaec565249c">
	<topic>libxslt -- DoS vulnerability due to type confusing error</topic>
	<affects>
	<package>
	<name>libsxlt</name>
	<range><lt>1.1.28_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libxslt maintainer reports:</p>
	<blockquote cite="https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617">
	<p>CVE-2015-7995:
	http://www.openwall.com/lists/oss-security/2015/10/27/10
	We need to check that the parent node is an element before
	dereferencing its namespace.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7995</cvename>
	<url>https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="e5423caf-8fb8-11e5-918c-bcaec565249c">
	<topic>libxml2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>reports:</p>
	<blockquote cite="http://xmlsoft.org/news.html">
	<p>CVE-2015-5312 Another entity expansion issue (David Drysdale).</p>
	<p>CVE-2015-7497 Avoid an heap buffer overflow in
	xmlDictComputeFastQKey (David Drysdale).</p>
	<p>CVE-2015-7498 Avoid processing entities after encoding
	conversion failures (Daniel Veillard).</p>
	<p>CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser
	(Daniel Veillard).</p>
	<p>CVE-2015-7499 (2) Detect incoherency on GROW (Daniel
	Veillard).</p>
	<p>CVE-2015-7500 Fix memory access error due to incorrect
	entities boundaries (Daniel Veillard).</p>
	<p>CVE-2015-7941 (1) Stop parsing on entities boundaries
	errors (Daniel Veillard).</p>
	<p>CVE-2015-7941 (2) Cleanup conditional section error
	handling (Daniel Veillard).</p>
	<p>CVE-2015-7942 Another variation of overflow in
	Conditional sections (Daniel Veillard).</p>
	<p>CVE-2015-7942 (2) Fix an error in previous Conditional
	section patch (Daniel Veillard).</p>
	<p>CVE-2015-8035 Fix XZ compression support loop
	(Daniel Veillard).</p>
	<p>CVE-2015-8242 Buffer overead with HTML parser in push
	mode (Hugh Davenport)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5312</cvename>
	<cvename>CVE-2015-7497</cvename>
	<cvename>CVE-2015-7498</cvename>
	<cvename>CVE-2015-7499</cvename>
	<cvename>CVE-2015-7500</cvename>
	<cvename>CVE-2015-7941</cvename>
	<cvename>CVE-2015-7942</cvename>
	<cvename>CVE-2015-8035</cvename>
	<cvename>CVE-2015-8241</cvename>
	<cvename>CVE-2015-8242</cvename>
	<url>http://xmlsoft.org/news.html</url>
	<url>http://www.openwall.com/lists/oss-security/2015/11/18/23</url>
	</references>
	<dates>
	<discovery>2015-11-20</discovery>
	<entry>2015-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="9d04936c-75f1-4a2c-9ade-4c1708be5df9">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nspr</name>
	<range><lt>4.10.10</lt></range>
	</package>
	<package>
	<name>linux-c6-nspr</name>
	<range><lt>4.10.10</lt></range>
	</package>
	<package>
	<name>nss</name>
	<range><ge>3.20</ge><lt>3.20.1</lt></range>
	<range><ge>3.19.3</ge><lt>3.19.4</lt></range>
	<range><lt>3.19.2.1</lt></range>
	</package>
	<package>
	<name>firefox</name>
	<range><lt>42.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>42.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.39</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.39</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.4.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>38.4.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>38.4.0</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-133 NSS and NSPR memory corruption issues</p>
	<p>MFSA 2015-132 Mixed content WebSocket policy bypass
	through workers</p>
	<p>MFSA 2015-131 Vulnerabilities found through code
	inspection</p>
	<p>MFSA 2015-130 JavaScript garbage collection crash with
	Java applet</p>
	<p>MFSA 2015-129 Certain escaped characters in host of
	Location-header are being treated as non-escaped</p>
	<p>MFSA 2015-128 Memory corruption in libjar through zip
	files</p>
	<p>MFSA 2015-127 CORS preflight is bypassed when
	non-standard Content-Type headers are received</p>
	<p>MFSA 2015-126 Crash when accessing HTML tables with
	accessibility tools on OS X</p>
	<p>MFSA 2015-125 XSS attack through intents on Firefox for
	Android</p>
	<p>MFSA 2015-124 Android intents can be used on Firefox for
	Android to open privileged files</p>
	<p>MFSA 2015-123 Buffer overflow during image interactions
	in canvas</p>
	<p>MFSA 2015-122 Trailing whitespace in IP address hostnames
	can bypass same-origin policy</p>
	<p>MFSA 2015-121 Disabling scripts in Add-on SDK panels has
	no effect</p>
	<p>MFSA 2015-120 Reading sensitive profile files through
	local HTML file on Android</p>
	<p>MFSA 2015-119 Firefox for Android addressbar can be
	removed after fullscreen mode</p>
	<p>MFSA 2015-118 CSP bypass due to permissive Reader mode
	whitelist</p>
	<p>MFSA 2015-117 Information disclosure through NTLM
	authentication</p>
	<p>MFSA 2015-116 Miscellaneous memory safety hazards
	(rv:42.0 / rv:38.4)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4513</cvename>
	<cvename>CVE-2015-4514</cvename>
	<cvename>CVE-2015-4515</cvename>
	<cvename>CVE-2015-4518</cvename>
	<cvename>CVE-2015-7181</cvename>
	<cvename>CVE-2015-7182</cvename>
	<cvename>CVE-2015-7183</cvename>
	<cvename>CVE-2015-7185</cvename>
	<cvename>CVE-2015-7186</cvename>
	<cvename>CVE-2015-7187</cvename>
	<cvename>CVE-2015-7188</cvename>
	<cvename>CVE-2015-7189</cvename>
	<cvename>CVE-2015-7190</cvename>
	<cvename>CVE-2015-7191</cvename>
	<cvename>CVE-2015-7192</cvename>
	<cvename>CVE-2015-7193</cvename>
	<cvename>CVE-2015-7194</cvename>
	<cvename>CVE-2015-7195</cvename>
	<cvename>CVE-2015-7196</cvename>
	<cvename>CVE-2015-7197</cvename>
	<cvename>CVE-2015-7198</cvename>
	<cvename>CVE-2015-7199</cvename>
	<cvename>CVE-2015-7200</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-116/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-117/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-118/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-119/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-120/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-121/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-122/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-123/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-124/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-125/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-126/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-127/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-128/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-129/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-130/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-131/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-132/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-133/</url>
	</references>
	<dates>
	<discovery>2015-11-03</discovery>
	<entry>2015-11-19</entry>
	<modified>2016-04-13</modified>
	</dates>
	</vuln>

	<vuln vid="68847b20-8ddc-11e5-b69c-c86000169601">
	<topic>gdm -- lock screen bypass when holding escape key</topic>
	<affects>
	<package>
	<name>gdm</name>
	<range><lt>3.16.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ray Strode reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html">
	<p>CVE-2015-7496 - lock screen bypass when holding escape key.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7496</cvename>
	<url>https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=758032</url>
	</references>
	<dates>
	<discovery>2015-11-12</discovery>
	<entry>2015-11-18</entry>
	</dates>
	</vuln>

	<vuln vid="3eb0ccc2-8c6a-11e5-8519-005056ac623e">
	<topic>strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><lt>5.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Strongswan Release Notes reports:</p>
	<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
	<p>Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that
	was caused by insufficient verification of the internal state when handling
	MSCHAPv2 Success messages received by the client.
	This vulnerability has been registered as CVE-2015-8023.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8023</cvename>
	<url>https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2</url>
	</references>
	<dates>
	<discovery>2015-11-16</discovery>
	<entry>2015-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="82b3ca2a-8c07-11e5-bd18-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle27</name>
	<range><lt>2.7.11</lt></range>
	</package>
	<package>
	<name>moodle28</name>
	<range><lt>2.8.9</lt></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Moodle Release Notes report:</p>
	<blockquote cite="https://docs.moodle.org/dev/Moodle_2.9.3_release_notes">
	<p>MSA-15-0037 Possible to send a message to a user who blocked
	messages from non contacts</p>
	<p>MSA-15-0038 DDoS possibility in Atto</p>
	<p>MSA-15-0039 CSRF in site registration form</p>
	<p>MSA-15-0040 Student XSS in survey</p>
	<p>MSA-15-0041 XSS in flash video player</p>
	<p>MSA-15-0042 CSRF in lesson login form</p>
	<p>MSA-15-0043 Web service core_enrol_get_enrolled_users does not
	respect course group mode</p>
	<p>MSA-15-0044 Capability to view available badges is not
	respected</p>
	<p>MSA-15-0045 SCORM module allows to bypass access restrictions based
	on date</p>
	<p>MSA-15-0046 Choice module closing date can be bypassed</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://docs.moodle.org/dev/Moodle_2.7.11_release_notes</url>
	<url>https://docs.moodle.org/dev/Moodle_2.8.9_release_notes</url>
	<url>https://docs.moodle.org/dev/Moodle_2.9.3_release_notes</url>
	</references>
	<dates>
	<discovery>2015-11-09</discovery>
	<entry>2015-11-16</entry>
	<modified>2015-12-21</modified>
	</dates>
	</vuln>

	<vuln vid="2cabfbab-8bfb-11e5-bd18-002590263bf5">
	<topic>xen-kernel -- CPU lockup during exception delivery</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-156.html">
	<p>A malicious HVM guest administrator can cause a denial of service.
	Specifically, prevent use of a physical CPU for a significant,
	perhaps indefinite period. If a host watchdog (Xen or dom0) is in
	use, this can lead to a watchdog timeout and consequently a reboot
	of the host. If another, innocent, guest, is configured with a
	watchdog, this issue can lead to a reboot of such a guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5307</cvename>
	<cvename>CVE-2015-8104</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-156.html</url>
	</references>
	<dates>
	<discovery>2015-11-10</discovery>
	<entry>2015-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="1886e195-8b87-11e5-90e7-b499baebfeaf">
	<topic>libpng buffer overflow in png_set_PLTE</topic>
	<affects>
	<package>
	<name>png</name>
	<range><lt>1.6.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libpng reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/12/2">
	<p>CVE for a vulnerability in libpng, all versions, in the
	png_set_PLTE/png_get_PLTE functions. These functions failed to check for
	an out-of-range palette when reading or writing PNG files with a bit_depth
	less than 8. Some applications might read the bit depth from the IHDR
	chunk and allocate memory for a 2^N entry palette, while libpng can return
	a palette with up to 256 entries even when the bit depth is less than 8.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/11/12/2</url>
	<url>http://www.openwall.com/lists/oss-security/2015/12/03/6</url>
	<cvename>CVE-2015-8126</cvename>
	<cvename>CVE-2015-8472</cvename>
	</references>
	<dates>
	<discovery>2015-11-15</discovery>
	<entry>2015-11-15</entry>
	<modified>2015-12-08</modified>
	</dates>
	</vuln>

	<vuln vid="547fbd98-8b1f-11e5-b48b-bcaec565249c">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.548</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-28.html">
	<p>These updates resolve a type confusion vulnerability that
	could lead to code execution (CVE-2015-7659).</p>

	<p>These updates resolve a security bypass vulnerability that
	could be exploited to write arbitrary data to the file
	system under user permissions (CVE-2015-7662).</p>

	<p>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2015-7651, CVE-2015-7652,
	CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656,
	CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,
	CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044,
	CVE-2015-8046).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-28.html</url>
	<cvename>CVE-2015-7651</cvename>
	<cvename>CVE-2015-7652</cvename>
	<cvename>CVE-2015-7653</cvename>
	<cvename>CVE-2015-7654</cvename>
	<cvename>CVE-2015-7655</cvename>
	<cvename>CVE-2015-7656</cvename>
	<cvename>CVE-2015-7657</cvename>
	<cvename>CVE-2015-7658</cvename>
	<cvename>CVE-2015-7659</cvename>
	<cvename>CVE-2015-7660</cvename>
	<cvename>CVE-2015-7661</cvename>
	<cvename>CVE-2015-7662</cvename>
	<cvename>CVE-2015-7663</cvename>
	<cvename>CVE-2015-8043</cvename>
	<cvename>CVE-2015-8044</cvename>
	<cvename>CVE-2015-8046</cvename>
	</references>
	<dates>
	<discovery>2015-11-10</discovery>
	<entry>2015-11-14</entry>
	</dates>
	</vuln>

	<vuln vid="f0b9049f-88c4-11e5-aed7-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<!--pcbsd-->
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>46.0.2490.86</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html">
	<p>[520422] High CVE-2015-1302: Information leak in PDF viewer.
	Credit to Rob Wu.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1302</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2015-11-10</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="851a0eea-88aa-11e5-90e7-b499baebfeaf">
	<topic>MySQL - Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mariadb-client</name>
	<range><lt>5.3.13</lt></range>
	</package>
	<package>
	<name>mariadb-server</name>
	<range><lt>5.3.13</lt></range>
	</package>
	<package>
	<name>mariadb55-client</name>
	<range><lt>5.5.46</lt></range>
	</package>
	<package>
	<name>mariadb55-server</name>
	<range><lt>5.5.46</lt></range>
	</package>
	<package>
	<name>mariadb100-client</name>
	<range><lt>10.0.22</lt></range>
	</package>
	<package>
	<name>mariadb100-server</name>
	<range><lt>10.0.22</lt></range>
	</package>
	<package>
	<name>mysql55-client</name>
	<range><lt>5.5.46</lt></range>
	</package>
	<package>
	<name>mysql55-server</name>
	<range><lt>5.5.46</lt></range>
	</package>
	<package>
	<name>mysql56-client</name>
	<range><lt>5.6.27</lt></range>
	</package>
	<package>
	<name>mysql56-server</name>
	<range><lt>5.6.27</lt></range>
	</package>
	<package>
	<name>percona55-client</name>
	<range><lt>5.5.46</lt></range>
	</package>
	<package>
	<name>percona55-server</name>
	<range><lt>5.5.46</lt></range>
	</package>
	<package>
	<name>percona56-client</name>
	<range><lt>5.6.27</lt></range>
	</package>
	<package>
	<name>percona56-server</name>
	<range><lt>5.6.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
	<p>Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
	<cvename>CVE-2015-4802</cvename>
	<cvename>CVE-2015-4807</cvename>
	<cvename>CVE-2015-4815</cvename>
	<cvename>CVE-2015-4826</cvename>
	<cvename>CVE-2015-4830</cvename>
	<cvename>CVE-2015-4836</cvename>
	<cvename>CVE-2015-4858</cvename>
	<cvename>CVE-2015-4861</cvename>
	<cvename>CVE-2015-4870</cvename>
	<cvename>CVE-2015-4913</cvename>
	<cvename>CVE-2015-4792</cvename>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/</url>
	<url>https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html</url>
	<url>https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html</url>
	</references>
	<dates>
	<discovery>2015-11-10</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="b665668a-91db-4f13-8113-9e4b5b0e47f7">
	<topic>jenkins -- remote code execution via unsafe deserialization</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.638</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>1.625.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Developers report:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11">
	<p>Unsafe deserialization allows unauthenticated remote attackers to
	run arbitrary code on the Jenkins master.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11</url>
	<url>https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli</url>
	<url>http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix</url>
	</references>
	<dates>
	<discovery>2015-11-06</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="71af4ded-8864-11e5-af1b-001999f8d30b">
	<topic>owncloudclient -- Improper validation of certificates when using self-signed certificates</topic>
	<affects>
	<package>
	<name>owncloudclient</name>
	<range><lt>2.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>owncloud.org reports:</p>
	<blockquote cite="https://owncloud.org/security/advisory/?id=oc-sa-2015-016">
	<p>The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://owncloud.org/security/advisory/?id=oc-sa-2015-016</url>
	<cvename>CVE-2015-7298</cvename>
	</references>
	<dates>
	<discovery>2015-09-21</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="c0e76d33-8821-11e5-ab94-002590263bf5">
	<topic>xen-tools -- populate-on-demand balloon size inaccuracy can crash guests</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>3.4</ge><lt>4.5.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-153.html">
	<p>Guests configured with PoD might be unstable, especially under
	load. In an affected guest, an unprivileged guest user might be
	able to cause a guest crash, perhaps simply by applying load so
	as to cause heavy memory pressure within the guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7972</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-153.html</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="e4848ca4-8820-11e5-ab94-002590263bf5">
	<topic>xen-kernel -- some pmu and profiling hypercalls log without rate limiting</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>3.2</ge><lt>4.5.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-152.html">
	<p>HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and
	attempts at invalid operations. These log messages are not
	rate-limited, even though they can be triggered by guests.</p>
	<p>A malicious guest could cause repeated logging to the hypervisor
	console, leading to a Denial of Service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7971</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-152.html</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="e3792855-881f-11e5-ab94-002590263bf5">
	<topic>xen-kernel -- leak of per-domain profiling-related vcpu pointer array</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.0</ge><lt>4.5.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-151.html">
	<p>A domain's xenoprofile state contains an array of per-vcpu
	information... This array is leaked on domain teardown. This memory
	leak could -- over time -- exhaust the host's memory.</p>
	<p>The following parties can mount a denial of service attack
	affecting the whole system:</p>
	<ul>
	<li>A malicious guest administrator via XENOPROF_get_buffer.</li>
	<li>A domain given suitable privilege over another domain via
	XENOPROF_set_passive (this would usually be a domain being
	used to profile another domain, eg with the xenoprof tool).</li>
	</ul>
	<p>The ability to also restart or create suitable domains is also
	required to fully exploit the issue. Without this the leak is
	limited to a small multiple of the maximum number of vcpus for the
	domain.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7969</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-151.html</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="83350009-881e-11e5-ab94-002590263bf5">
	<topic>xen-kernel -- Long latency populate-on-demand operation is not preemptible</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-150.html">
	<p>When running an HVM domain in Populate-on-Demand mode, Xen would
	sometimes search the domain for memory to reclaim, in response to
	demands for population of other pages in the same domain. This
	search runs without preemption. The guest can, by suitable
	arrangement of its memory contents, create a situation where this
	search is a time-consuming linear scan of the guest's address
	space.</p>
	<p>A malicious HVM guest administrator can cause a denial of service.
	Specifically, prevent use of a physical CPU for a significant
	period.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7970</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-150.html</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="fc1f8795-881d-11e5-ab94-002590263bf5">
	<topic>xen-kernel -- leak of main per-domain vcpu pointer array</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-149.html">
	<p>A domain's primary array of vcpu pointers can be allocated by a
	toolstack exactly once in the lifetime of a domain via the
	XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain
	teardown. This memory leak could -- over time -- exhaust the host's
	memory.</p>
	<p>A domain given partial management control via XEN_DOMCTL_max_vcpus
	can mount a denial of service attack affecting the whole system. The
	ability to also restart or create suitable domains is also required
	to fully exploit the issue. Without this the leak is limited to a
	small multiple of the maximum number of vcpus for the domain. The
	maximum leak is 64kbytes per domain (re)boot (less on ARM).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7969</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-149.html</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="3d9f6260-881d-11e5-ab94-002590263bf5">
	<topic>xen-kernel -- Uncontrolled creation of large page mappings by PV guests</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-148.html">
	<p>The code to validate level 2 page table entries is bypassed when
	certain conditions are satisfied. This means that a PV guest can
	create writable mappings using super page mappings. Such writable
	mappings can violate Xen intended invariants for pages which Xen is
	supposed to keep read-only. This is possible even if the
	"allowsuperpage" command line option is not used.</p>
	<p>Malicious PV guest administrators can escalate privilege so as to
	control the whole system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7835</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-148.html</url>
	</references>
	<dates>
	<discovery>2015-10-29</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="301b04d7-881c-11e5-ab94-002590263bf5">
	<topic>xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>4.1</ge><lt>4.5.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-142.html">
	<p>Callers of libxl can specify that a disk should be read-only to the
	guest. However, there is no code in libxl to pass this information
	to qemu-xen (the upstream-based qemu); and indeed there is no way in
	qemu to make a disk read-only.</p>
	<p>The vulnerability is exploitable only via devices emulated by the
	device model, not the parallel PV devices for supporting PVHVM.
	Normally the PVHVM device unplug protocol renders the emulated
	devices inaccessible early in boot.</p>
	<p>Malicious guest administrators or (in some situations) users may be
	able to write to supposedly read-only disk images.</p>
	<p>CDROM devices (that is, devices specified to be presented to the
	guest as CDROMs, regardless of the nature of the backing storage on
	the host) are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7311</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-142.html</url>
	</references>
	<dates>
	<discovery>2015-09-22</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="2f7f4db2-8819-11e5-ab94-002590263bf5">
	<topic>p5-HTML-Scrubber -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>p5-HTML-Scrubber</name>
	<range><lt>0.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5667">
	<p>Cross-site scripting (XSS) vulnerability in the HTML-Scrubber
	module before 0.15 for Perl, when the comment feature is enabled,
	allows remote attackers to inject arbitrary web script or HTML via
	a crafted comment.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5667</cvename>
	<url>https://metacpan.org/release/HTML-Scrubber</url>
	<url>http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171</url>
	<url>http://jvn.jp/en/jp/JVN53973084/index.html</url>
	</references>
	<dates>
	<discovery>2015-10-10</discovery>
	<entry>2015-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="6ca7eddd-d436-486a-b169-b948436bcf14">
	<topic>libvpx -- buffer overflow in vp9_init_context_buffers</topic>
	<affects>
	<package>
	<name>libvpx</name>
	<range><lt>1.4.0.488_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-101/">
	<p>Security researcher Khalil Zhani reported that a
	maliciously crafted vp9 format video could be used to
	trigger a buffer overflow while parsing the file. This leads
	to a potentially exploitable crash due to a flaw in the
	libvpx library.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4506</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
	</references>
	<dates>
	<discovery>2015-09-22</discovery>
	<entry>2015-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="56665ccb-8723-11e5-9b13-14dae9d210b8">
	<topic>powerdns -- Denial of Service</topic>
	<affects>
	<package>
	<name>powerdns</name>
	<range><ge>3.4.4</ge><lt>3.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS reports:</p>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/">
	<p>A bug was found using afl-fuzz in our packet parsing code.
	This bug, when exploited, causes an assertion error and consequent
	termination of the the pdns_server process, causing a Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/</url>
	<cvename>CVE-2015-5311</cvename>
	</references>
	<dates>
	<discovery>2015-11-03</discovery>
	<entry>2015-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="0cb0afd9-86b8-11e5-bf60-080027ef73ec">
	<topic>PuTTY -- memory corruption in terminal emulator's erase character handling</topic>
	<affects>
	<package>
	<name>putty</name>
	<range><ge>0.54</ge><lt>0.66</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ben Harris reports:</p>
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html">
	<p>Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a
	potentially memory-corrupting integer overflow in the handling of
	the ECH (erase characters) control sequence in the terminal
	emulator.</p>
	<p>To exploit a vulnerability in the terminal emulator, an attacker
	must be able to insert a carefully crafted escape sequence into the
	terminal stream. For a PuTTY SSH session, this must be before
	encryption, so the attacker likely needs access to the server you're
	connecting to. For instance, an attacker on a multi-user machine
	that you connect to could trick you into running cat on a file they
	control containing a malicious escape sequence. (Unix write(1) is
	not a vector for this, if implemented correctly.)</p>
	<p>Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do
	not include the terminal emulator, so cannot be exploited this
	way.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html</url>
	<cvename>CVE-2015-5309</cvename>
	</references>
	<dates>
	<discovery>2015-11-06</discovery>
	<entry>2015-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="18b3c61b-83de-11e5-905b-ac9e174be3af">
	<topic>OpenOffice 4.1.1 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache-openoffice</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1705368,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache OpenOffice Project reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-4551.html">
	<p>A vulnerability in OpenOffice settings of OpenDocument Format
	files and templates allows silent access to files that are
	readable from an user account, over-riding the user's default
	configuration settings. Once these files are imported into a
	maliciously-crafted document, the data can be silently hidden
	in the document and possibly exported to an external party
	without being observed. </p>
	</blockquote>
	<p>The Apache OpenOffice Project reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5212.html">
	<p>A crafted ODF document can be used to create a buffer that is
	too small for the amount of data loaded into it, allowing an
	attacker to cause denial of service (memory corruption and
	application crash) and possible execution of arbitrary code.</p>
	</blockquote>
	<p>The Apache OpenOffice Project reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5213.html">
	<p>A crafted Microsoft Word DOC file can be used to specify a
	document buffer that is too small for the amount of data
	provided for it. Failure to detect the discrepancy allows an
	attacker to cause denial of service (memory corruption and
	application crash) and possible execution of arbitrary code.</p>
	</blockquote>
	<p>The Apache OpenOffice Project reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5214.html">
	<p>A crafted Microsoft Word DOC can contain invalid bookmark
	positions leading to memory corruption when the document is
	loaded or bookmarks are manipulated. The defect allows an
	attacker to cause denial of service (memory corruption and
	application crash) and possible execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4551</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
	<cvename>CVE-2015-5212</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2015-5212.html</url>
	<cvename>CVE-2015-5213</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2015-5213.html</url>
	<cvename>CVE-2015-5214</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2015-5214.html</url>
	</references>
	<dates>
	<discovery>2015-11-04</discovery>
	<entry>2015-11-05</entry>
	<modified>2015-11-05</modified>
	</dates>
	</vuln>

	<vuln vid="698403a7-803d-11e5-ab94-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>Fixed an XSS attack vector in Security Library method
	xss_clean().</p>
	<p>Changed Config Library method base_url() to fallback to
	``$_SERVER['SERVER_ADDR']`` in order to avoid Host header
	injections.</p>
	<p>Changed CAPTCHA Helper to try to use the operating system's PRNG
	first.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203403</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2015-10-31</discovery>
	<entry>2015-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="017a493f-7db6-11e5-a762-14dae9d210b8">
	<topic>openafs -- information disclosure</topic>
	<affects>
	<package>
	<name>openafs</name>
	<range><lt>1.6.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenAFS development team reports:</p>
	<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt">
	<p>When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx
	implementations do not initialize three octets of data that are padding
	in the C language structure and were inadvertently included in the wire
	protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75
	through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include
	a variable-length padding at the end of the ACK packet, in an attempt to
	detect the path MTU, but only four octets of the additional padding are
	initialized (CVE-2015-7763).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt</url>
	<cvename>CVE-2015-7762</cvename>
	<cvename>CVE-2015-7763</cvename>
	</references>
	<dates>
	<discovery>2015-10-28</discovery>
	<entry>2015-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="4b9393b8-7c0c-11e5-a010-080027ddead3">
	<topic>xscreensaver - lock bypass</topic>
	<affects>
	<package>
	<name>xscreensaver</name>
	<name>xscreensaver-gnome</name>
	<name>xscreensaver-gnome-hacks</name>
	<range><lt>5.34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat bugzilla reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1274452">
	<p>In dual screen configurations, unplugging one screen will cause
	xscreensaver to crash, leaving the screen unlocked.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.jwz.org/xscreensaver/changelog.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1274452</url>
	<cvename>CVE-2015-8025</cvename>
	</references>
	<dates>
	<discovery>2015-10-24</discovery>
	<entry>2015-10-27</entry>
	<modified>2015-11-04</modified>
	</dates>
	</vuln>

	<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
	<topic>lldpd -- Buffer overflow/Denial of service</topic>
	<affects>
	<package>
	<name>lldpd</name>
	<range><ge>0.5.6</ge><lt>0.7.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The lldpd developer Vincent Bernat reports:</p>
	<blockquote cite="https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS">
	<p>A buffer overflow may allow arbitrary code execution
	only if hardening was disabled.</p>
	</blockquote>
	<blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
	<p>Malformed packets should not make lldpd crash. Ensure we can
	handle them by not using assert() in this part.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8011</cvename>
	<cvename>CVE-2015-8012</cvename>
	<url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
	<url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
	</references>
	<dates>
	<discovery>2015-10-04</discovery>
	<entry>2015-10-26</entry>
	<modified>2015-11-10</modified>
	</dates>
	</vuln>

	<vuln vid="24e4d383-7b3e-11e5-a250-68b599b52a02">
	<topic>wireshark -- Pcapng file parser crash</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>1.12.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html">
	<p>The following vulnerability has been fixed.</p>
	<ul>
	<li><p>wnpa-sec-2015-30</p>
	<p>Pcapng file parser crash. (Bug 11455)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html</url>
	<cvename>CVE-2015-7830</cvename>
	</references>
	<dates>
	<discovery>2015-10-14</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="0ebc6e78-7ac6-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.2.0</ge><lt>3.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html">
	<h2>[20151001] - Core - SQL Injection</h2>
	<p>Inadequate filtering of request data leads to a SQL Injection
	vulnerability.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html">
	<h2>[20151002] - Core - ACL Violations</h2>
	<p>Inadequate ACL checks in com_contenthistory provide potential read
	access to data which should be access restricted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7297</cvename>
	<cvename>CVE-2015-7857</cvename>
	<cvename>CVE-2015-7858</cvename>
	<cvename>CVE-2015-7859</cvename>
	<url>http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html</url>
	<url>http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html</url>
	<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
	</references>
	<dates>
	<discovery>2015-10-22</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="03e54e42-7ac6-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - ACL Violation vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.0.0</ge><lt>3.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html">
	<h2>[20151003] - Core - ACL Violations</h2>
	<p>Inadequate ACL checks in com_content provide potential read access
	to data which should be access restricted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7899</cvename>
	<url>http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html</url>
	<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
	</references>
	<dates>
	<discovery>2015-10-22</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="f8c37915-7ac5-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - XSS Vulnerability</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.4.0</ge><lt>3.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html">
	<h2>[20150908] - Core - XSS Vulnerability</h2>
	<p>Inadequate escaping leads to XSS vulnerability in login module.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6939</cvename>
	<url>http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html</url>
	<url>https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html</url>
	</references>
	<dates>
	<discovery>2015-09-08</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="ec2d1cfd-7ac5-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - CSRF Protection vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.2.0</ge><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html">
	<h2>[20150602] - Core - CSRF Protection</h2>
	<p>Lack of CSRF checks potentially enabled uploading malicious code.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5397</cvename>
	<url>http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html</url>
	<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
	</references>
	<dates>
	<discovery>2015-06-30</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="deaba148-7ac5-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - Open Redirect vulnerability</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.0.0</ge><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html">
	<h2>[20150601] - Core - Open Redirect</h2>
	<p>Inadequate checking of the return value allowed to redirect to an
	external page.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5608</cvename>
	<url>http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html</url>
	<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
	</references>
	<dates>
	<discovery>2015-06-30</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="cec4d01a-7ac5-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><lt>3.2.6</lt></range>
	<range><ge>3.3.0</ge><lt>3.3.5</lt></range>
	</package>
	<package>
	<name>joomla2</name>
	<range><ge>2.5.4</ge><lt>2.5.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html">
	<h2>[20140903] - Core - Remote File Inclusion</h2>
	<p>Inadequate checking allowed the potential for remote files to be
	executed.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html">
	<h2>[20140904] - Core - Denial of Service</h2>
	<p>Inadequate checking allowed the potential for a denial of service
	attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-7228</cvename>
	<cvename>CVE-2014-7229</cvename>
	<url>http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html</url>
	<url>http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html</url>
	<url>https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html</url>
	<url>https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html</url>
	</references>
	<dates>
	<discovery>2014-09-30</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="beb3d5fc-7ac5-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - Unauthorized Login vulnerability</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><lt>3.2.5</lt></range>
	<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
	</package>
	<package>
	<name>joomla2</name>
	<range><lt>2.5.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html">
	<h2>[20140902] - Core - Unauthorized Logins</h2>
	<p>Inadequate checking allowed unauthorized logins via LDAP
	authentication.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-6632</cvename>
	<url>http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html</url>
	<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
	<url>https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html</url>
	</references>
	<dates>
	<discovery>2014-09-23</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="adbb32d9-7ac5-11e5-b35a-002590263bf5">
	<topic>Joomla! -- Core - XSS Vulnerability</topic>
	<affects>
	<package>
	<name>joomla3</name>
	<range><ge>3.2.0</ge><lt>3.2.5</lt></range>
	<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html">
	<h2>[20140901] - Core - XSS Vulnerability</h2>
	<p>Inadequate escaping leads to XSS vulnerability in com_media.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-6631</cvename>
	<url>http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html</url>
	<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
	</references>
	<dates>
	<discovery>2014-09-23</discovery>
	<entry>2015-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="75f39413-7a00-11e5-a2a1-002590263bf5">
	<topic>drupal -- open redirect vulnerability</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.41</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal development team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2015-004">
	<p>The Overlay module in Drupal core displays administrative pages
	as a layer over the current page (using JavaScript), rather than
	replacing the page in the browser window. The Overlay module does
	not sufficiently validate URLs prior to displaying their contents,
	leading to an open redirect vulnerability.</p>
	<p>This vulnerability is mitigated by the fact that it can only be
	used against site users who have the "Access the administrative
	overlay" permission, and that the Overlay module must be enabled.
	</p>
	<p>An incomplete fix for this issue was released as part of
	SA-CORE-2015-002.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7943</cvename>
	<url>https://www.drupal.org/SA-CORE-2015-004</url>
	<url>http://www.openwall.com/lists/oss-security/2015/10/23/6</url>
	</references>
	<dates>
	<discovery>2015-10-21</discovery>
	<entry>2015-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="08d11134-79c5-11e5-8987-6805ca0b3d42">
	<topic>phpMyAdmin -- Content spoofing vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.4.0</ge><lt>4.4.15.1</lt></range>
	<range><ge>4.5.0</ge><lt>4.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-5/">
	<p>This vulnerability allows an attacker to perform a
	content spoofing attack using the phpMyAdmin's redirection
	mechanism to external sites.</p>
	<p>We consider this vulnerability to be non critical since
	the spoofed content is escaped and no HTML injection is
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2015-5/</url>
	<cvename>CVE-2015-7873</cvename>
	</references>
	<dates>
	<discovery>2015-10-23</discovery>
	<entry>2015-10-23</entry>
	</dates>
	</vuln>

	<vuln vid="b973a763-7936-11e5-a2a1-002590263bf5">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki123</name>
	<range><lt>1.23.11</lt></range>
	</package>
	<package>
	<name>mediawiki124</name>
	<range><lt>1.24.4</lt></range>
	</package>
	<package>
	<name>mediawiki125</name>
	<range><lt>1.25.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MediaWiki reports:</p>
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html">
	<p>Wikipedia user RobinHood70 reported two issues in the chunked
	upload API. The API failed to correctly stop adding new chunks to
	the upload when the reported size was exceeded (T91203), allowing
	a malicious users to upload add an infinite number of chunks for a
	single file upload. Additionally, a malicious user could upload
	chunks of 1 byte for very large files, potentially creating a very
	large number of files on the server's filesystem (T91205).</p>
	<p>Internal review discovered that it is not possible to throttle file
	uploads.</p>
	<p>Internal review discovered a missing authorization check when
	removing suppression from a revision. This allowed users with the
	'viewsuppressed' user right but not the appropriate
	'suppressrevision' user right to unsuppress revisions.</p>
	<p>Richard Stanway from teamliquid.net reported that thumbnails of PNG
	files generated with ImageMagick contained the local file path in
	the image metadata.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8001</cvename>
	<cvename>CVE-2015-8002</cvename>
	<cvename>CVE-2015-8003</cvename>
	<cvename>CVE-2015-8004</cvename>
	<cvename>CVE-2015-8005</cvename>
	<cvename>CVE-2015-8006</cvename>
	<cvename>CVE-2015-8007</cvename>
	<cvename>CVE-2015-8008</cvename>
	<cvename>CVE-2015-8009</cvename>
	<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html</url>
	<url>https://phabricator.wikimedia.org/T91203</url>
	<url>https://phabricator.wikimedia.org/T91205</url>
	<url>https://phabricator.wikimedia.org/T91850</url>
	<url>https://phabricator.wikimedia.org/T95589</url>
	<url>https://phabricator.wikimedia.org/T108616</url>
	<url>http://www.openwall.com/lists/oss-security/2015/10/29/14</url>
	</references>
	<dates>
	<discovery>2015-10-16</discovery>
	<entry>2015-10-23</entry>
	<modified>2015-12-24</modified>
	</dates>
	</vuln>

	<vuln vid="c4a18a12-77fc-11e5-a687-206a8a720317">
	<topic>ntp -- 13 low- and medium-severity vulnerabilities</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p4</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><lt>4.3.76</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_7</lt></range>
	<range><ge>10.1</ge><lt>10.1_24</lt></range>
	<range><ge>9.3</ge><lt>9.3_30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ntp.org reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities">
	<p>NTF's NTP Project has been notified of the following 13 low-
	and medium-severity vulnerabilities that are fixed in
	ntp-4.2.8p4, released on Wednesday, 21 October 2015:</p>
	<ul>
	<li>Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric
	association authentication bypass via crypto-NAK
	(Cisco ASIG)</li>
	<li>Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch
	instead of returning FAIL on some bogus values (IDA)</li>
	<li>Bug 2921 CVE-2015-7854 Password Length Memory Corruption
	Vulnerability. (Cisco TALOS)</li>
	<li>Bug 2920 CVE-2015-7853 Invalid length data provided by a
	custom refclock driver could cause a buffer overflow.
	(Cisco TALOS)</li>
	<li>Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
	Vulnerability. (Cisco TALOS)</li>
	<li>Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
	Vulnerability. (OpenVMS) (Cisco TALOS)</li>
	<li>Bug 2917 CVE-2015-7850 remote config logfile-keyfile.
	(Cisco TALOS)</li>
	<li>Bug 2916 CVE-2015-7849 trusted key use-after-free.
	(Cisco TALOS)</li>
	<li>Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.
	(Cisco TALOS)</li>
	<li>Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.
	(Tenable)</li>
	<li>Bug 2902 : CVE-2015-7703 configuration directives "pidfile"
	and "driftfile" should only be allowed locally. (RedHat)</li>
	<li>Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that
	receive a KoD should validate the origin timestamp field.
	(Boston University)</li>
	<li>Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
	Incomplete autokey data packet length checks. (Tenable)</li>
	</ul>
	<p>The only generally-exploitable bug in the above list is the
	crypto-NAK bug, which has a CVSS2 score of 6.4.</p>
	<p>Additionally, three bugs that have already been fixed in
	ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd
	have a security component, but are all below 1.8 CVSS score,
	so we're reporting them here:</p>
	<ul>
	<li>Bug 2382 : Peer precision < -31 gives division by zero</li>
	<li>Bug 1774 : Segfaults if cryptostats enabled when built
	without OpenSSL</li>
	<li>Bug 1593 : ntpd abort in free() with logconfig syntax error</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:25.ntp</freebsdsa>
	<cvename>CVE-2015-7691</cvename>
	<cvename>CVE-2015-7692</cvename>
	<cvename>CVE-2015-7701</cvename>
	<cvename>CVE-2015-7702</cvename>
	<cvename>CVE-2015-7703</cvename>
	<cvename>CVE-2015-7704</cvename>
	<cvename>CVE-2015-7705</cvename>
	<cvename>CVE-2015-7848</cvename>
	<cvename>CVE-2015-7849</cvename>
	<cvename>CVE-2015-7850</cvename>
	<cvename>CVE-2015-7851</cvename>
	<cvename>CVE-2015-7852</cvename>
	<cvename>CVE-2015-7853</cvename>
	<cvename>CVE-2015-7854</cvename>
	<cvename>CVE-2015-7855</cvename>
	<cvename>CVE-2015-7871</cvename>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities</url>
	</references>
	<dates>
	<discovery>2015-10-21</discovery>
	<entry>2015-10-21</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="95602550-76cf-11e5-a2a1-002590263bf5">
	<topic>codeigniter -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>Fixed a number of XSS attack vectors in Security Library method
	xss_clean (thanks to Frans Rosén from Detectify.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203403</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2015-10-08</discovery>
	<entry>2015-10-20</entry>
	</dates>
	</vuln>

	<vuln vid="7f645ee5-7681-11e5-8519-005056ac623e">
	<topic>Git -- Execute arbitrary code</topic>
	<affects>
	<package>
	<name>git</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>git-gui</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>git-lite</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>git-subversion</name>
	<range><lt>2.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Git release notes:</p>
	<blockquote cite="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt">
	<p>Some protocols (like git-remote-ext) can execute arbitrary code
	found in the URL. The URLs that submodules use may come from
	arbitrary sources (e.g., .gitmodules files in a remote
	repository), and can hurt those who blindly enable recursive
	fetch. Restrict the allowed protocols to well known and safe
	ones.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7545</cvename>
	<url>https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt</url>
	<url>http://www.openwall.com/lists/oss-security/2015/12/11/7</url>
	</references>
	<dates>
	<discovery>2015-09-23</discovery>
	<entry>2015-10-19</entry>
	<modified>2015-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="3934cc60-f0fa-4eca-be09-c8bd7ae42871">
	<topic>Salt -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<range><lt>2015.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Salt release notes:</p>
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html">
	<p>CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log</p>
	<p>Updated the Git state and execution modules to no longer display HTTPS basic
	authentication credentials in loglevel debug output on the Salt master. These
	credentials are now replaced with REDACTED in the debug output. Thanks to
	Andreas Stieger for bringing this to our attention.</p>
	<p>CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug
	log</p>
	<p>Updated the win_useradd module return data to no longer include the password
	of the newly created user. The password is now replaced with the string
	XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display
	win_password and sudo_password authentication credentials. Also updated the
	Linode driver to no longer display authentication credentials in debug logs.
	These credentials are now replaced with REDACTED in the debug output.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html</url>
	<cvename>CVE-2015-6918</cvename>
	<cvename>CVE-2015-6941</cvename>
	</references>
	<dates>
	<discovery>2015-10-16</discovery>
	<entry>2015-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="79c68ef7-c8ae-4ade-91b4-4b8221b7c72a">
	<topic>firefox -- Cross-origin restriction bypass using Fetch</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>41.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>41.0.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Firefox Developers report:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/">
	<p>Security researcher Abdulrahman Alqabandi reported that the fetch()
	API did not correctly implement the Cross-Origin Resource Sharing
	(CORS) specification, allowing a malicious page to access private
	data from other origins. Mozilla developer Ben Kelly independently reported the
	same issue.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/</url>
	<cvename>CVE-2015-7184</cvename>
	</references>
	<dates>
	<discovery>2015-10-15</discovery>
	<entry>2015-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="84147b46-e876-486d-b746-339ee45a8bb9">
	<topic>flash -- remote code execution</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.540</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-27.html">
	<p>These updates resolve type confusion vulnerabilities that
	could lead to code execution (CVE-2015-7645, CVE-2015-7647,
	CVE-2015-7648).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7645</cvename>
	<cvename>CVE-2015-7647</cvename>
	<cvename>CVE-2015-7648</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-27.html</url>
	</references>
	<dates>
	<discovery>2015-10-16</discovery>
	<entry>2015-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="e75a96df-73ca-11e5-9b45-b499baebfeaf">
	<topic>LibreSSL -- Memory leak and buffer overflow</topic>
	<affects>
	<package>
	<name>libressl</name>
	<range><lt>2.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Qualys reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/16/1">
	<p>During the code review of OpenSMTPD a memory leak and buffer overflow
	(an off-by-one, usually stack-based) were discovered in LibreSSL's
	OBJ_obj2txt() function. This function is called automatically during
	a TLS handshake (both client-side, unless an anonymous mode is used,
	and server-side, if client authentication is requested).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://marc.info/?l=openbsd-announce&m=144495690528446</url>
	<cvename>CVE-2015-5333</cvename>
	<cvename>CVE-2015-5334</cvename>
	</references>
	<dates>
	<discovery>2015-10-15</discovery>
	<entry>2015-10-16</entry>
	<modified>2015-10-26</modified>
	</dates>
	</vuln>

	<vuln vid="07a1a76c-734b-11e5-ae81-14dae9d210b8">
	<topic>mbedTLS/PolarSSL -- DoS and possible remote code execution</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.17</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.14</lt></range>
	</package>
	<package>
	<name>mbedtls</name>
	<range><lt>2.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ARM Limited reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01">
	<p>When the client creates its ClientHello message, due to
	insufficient bounds checking it can overflow the heap-based buffer
	containing the message while writing some extensions. Two extensions in
	particular could be used by a remote attacker to trigger the overflow:
	the session ticket extension and the server name indication (SNI)
	extension.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01</url>
	<cvename>CVE-2015-5291</cvename>
	</references>
	<dates>
	<discovery>2015-10-05</discovery>
	<entry>2015-10-15</entry>
	</dates>
	</vuln>

	<vuln vid="ea1d2530-72ce-11e5-a2a1-002590263bf5">
	<topic>magento -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>magento</name>
	<range><lt>1.9.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Magento, Inc. reports:</p>
	<blockquote cite="https://www.magentocommerce.com/download">
	<p>SUPEE-6482 - This patch addresses two issues related to APIs and
	two cross-site scripting risks.</p>
	<p>SUPEE-6285 - This patch provides protection against several types
	of security-related issues, including information leaks, request
	forgeries, and cross-site scripting.</p>
	<p>SUPEE-5994 - This patch addresses multiple security
	vulnerabilities in Magento Community Edition software, including
	issues that can put customer information at risk.</p>
	<p>SUPEE-5344 - Addresses a potential remote code execution
	exploit.</p>
	<p>SUPEE-1533 - Addresses two potential remote code execution
	exploits.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/201709</freebsdpr>
	<url>https://www.magentocommerce.com/download</url>
	<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html</url>
	<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html</url>
	</references>
	<dates>
	<discovery>2014-10-03</discovery>
	<entry>2015-10-14</entry>
	</dates>
	</vuln>

	<vuln vid="705b759c-7293-11e5-a371-14dae9d210b8">
	<topic>pear-twig -- remote code execution</topic>
	<affects>
	<package>
	<name>pear-twig-twig</name>
	<range><lt>1.20.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fabien Potencier reports:</p>
	<blockquote cite="http://symfony.com/blog/security-release-twig-1-20-0">
	<p>End users can craft valid Twig code that allows them to
	execute arbitrary code (RCEs) via the _self variable, which is always
	available, even in sandboxed templates.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://symfony.com/blog/security-release-twig-1-20-0</url>
	<cvename>CVE-2015-7809</cvename>
	</references>
	<dates>
	<discovery>2015-08-12</discovery>
	<entry>2015-10-14</entry>
	</dates>
	</vuln>

	<vuln vid="06fefd2f-728f-11e5-a371-14dae9d210b8">
	<topic>miniupnpc -- buffer overflow</topic>
	<affects>
	<package>
	<name>miniupnpc</name>
	<range><ge>1.9.1</ge><lt>1.9.20150917</lt></range>
	<range><lt>1.9_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Talos reports:</p>
	<blockquote cite="http://talosintel.com/reports/TALOS-2015-0035/">
	<p>An exploitable buffer overflow vulnerability exists in the
	XML parser functionality of the MiniUPnP library. A specially crafted
	XML response can lead to a buffer overflow on the stack resulting in
	remote code execution. An attacker can set up a server on the local
	network to trigger this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6031</cvename>
	<url>http://talosintel.com/reports/TALOS-2015-0035/</url>
	<url>https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78</url>
	</references>
	<dates>
	<discovery>2015-09-15</discovery>
	<entry>2015-10-14</entry>
	<modified>2015-10-14</modified>
	</dates>
	</vuln>

	<vuln vid="a63f2c06-726b-11e5-a12b-bcaec565249c">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.535</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html">
	<p>These updates resolve a vulnerability that could be exploited
	to bypass the same-origin-policy and lead to information
	disclosure (CVE-2015-7628).</p>

	<p>These updates include a defense-in-depth feature in the Flash
	broker API (CVE-2015-5569).</p>

	<p>These updates resolve use-after-free vulnerabilities that
	could lead to code execution (CVE-2015-7629, CVE-2015-7631,
	CVE-2015-7643, CVE-2015-7644).</p>

	<p>These updates resolve a buffer overflow vulnerability that
	could lead to code execution (CVE-2015-7632).</p>

	<p>These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2015-7625, CVE-2015-7626,
	CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5569</cvename>
	<cvename>CVE-2015-7625</cvename>
	<cvename>CVE-2015-7626</cvename>
	<cvename>CVE-2015-7627</cvename>
	<cvename>CVE-2015-7628</cvename>
	<cvename>CVE-2015-7629</cvename>
	<cvename>CVE-2015-7630</cvename>
	<cvename>CVE-2015-7631</cvename>
	<cvename>CVE-2015-7632</cvename>
	<cvename>CVE-2015-7633</cvename>
	<cvename>CVE-2015-7634</cvename>
	<cvename>CVE-2015-7643</cvename>
	<cvename>CVE-2015-7644</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-25.html</url>
	</references>
	<dates>
	<discovery>2015-10-13</discovery>
	<entry>2015-10-14</entry>
	</dates>
	</vuln>

	<vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<!--pcbsd-->
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>46.0.2490.71</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html">
	<p>24 security fixes in this release, including:</p>
	<ul>
	<li>[519558] High CVE-2015-6755: Cross-origin bypass in Blink.
	Credit to Mariusz Mlynski.</li>
	<li>[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit
	to anonymous.</li>
	<li>[529520] High CVE-2015-6757: Use-after-free in ServiceWorker.
	Credit to Collin Payne.</li>
	<li>[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte
	Kettunen of OUSPG.</li>
	<li>[514076] Medium CVE-2015-6759: Information leakage in
	LocalStorage. Credit to Muneaki Nishimura (nishimunea).</li>
	<li>[519642] Medium CVE-2015-6760: Improper error handling in
	libANGLE. Credit to lastland.net.</li>
	<li>[447860,532967] Medium CVE-2015-6761: Memory corruption in
	FFMpeg. Credit to Aki Helin of OUSPG and anonymous.</li>
	<li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit
	to Muneaki Nishimura (nishimunea).</li>
	<li> [542517] CVE-2015-6763: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.6
	branch (currently 4.6.85.23).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6755</cvename>
	<cvename>CVE-2015-6756</cvename>
	<cvename>CVE-2015-6757</cvename>
	<cvename>CVE-2015-6758</cvename>
	<cvename>CVE-2015-6759</cvename>
	<cvename>CVE-2015-6760</cvename>
	<cvename>CVE-2015-6761</cvename>
	<cvename>CVE-2015-6762</cvename>
	<cvename>CVE-2015-6763</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2015-10-13</discovery>
	<entry>2015-10-13</entry>
	</dates>
	</vuln>

	<vuln vid="00dadbf0-6f61-11e5-a2a1-002590263bf5">
	<topic>p5-UI-Dialog -- shell command execution vulnerability</topic>
	<affects>
	<package>
	<name>p5-UI-Dialog</name>
	<range><lt>1.09_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthijs Kooijman reports:</p>
	<blockquote cite="https://rt.cpan.org/Public/Bug/Display.html?id=107364">
	<p>It seems that the whiptail, cdialog and kdialog backends apply
	some improper escaping in their shell commands, causing special
	characters present in menu item titles to be interpreted by the
	shell. This includes the backtick evaluation operator, so this
	constitutes a security issue, allowing execution of arbitrary
	commands if an attacker has control over the text displayed in
	a menu.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-7315</cvename>
	<freebsdpr>ports/203667</freebsdpr>
	<url>https://rt.cpan.org/Public/Bug/Display.html?id=107364</url>
	<url>https://bugs.debian.org/496448</url>
	<url>https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61</url>
	</references>
	<dates>
	<discovery>2008-08-24</discovery>
	<entry>2015-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="290351c9-6f5c-11e5-a2a1-002590263bf5">
	<topic>devel/ipython -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ipython</name>
	<range><lt>3.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Bussonnier reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/3">
	<p>Summary: Local folder name was used in HTML templates without
	escaping, allowing XSS in said pages by carefully crafting folder
	name and URL to access it.</p>
	<p>URI with issues:</p>
	<ul>
	<li>GET /tree/**</li>
	</ul>
	</blockquote>
	<p>Benjamin RK reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/16/3">
	<p>Vulnerability: A maliciously forged file opened for editing can
	execute javascript, specifically by being redirected to /files/ due
	to a failure to treat the file as plain text.</p>
	<p>URI with issues:</p>
	<ul>
	<li>GET /edit/**</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203668</freebsdpr>
	<cvename>CVE-2015-6938</cvename>
	<cvename>CVE-2015-7337</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/02/3</url>
	<url>https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892</url>
	<url>http://www.openwall.com/lists/oss-security/2015/09/16/3</url>
	<url>https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967</url>
	</references>
	<dates>
	<discovery>2015-09-01</discovery>
	<entry>2015-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="a0182578-6e00-11e5-a90c-0026551a22dc">
	<topic>PostgreSQL -- minor security problems.</topic>
	<affects>
	<package>
	<name>postgresql90-server</name>
	<range><ge>9.0.0</ge><lt>9.0.22</lt></range>
	</package>
	<package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.18</lt></range>
	</package>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.13</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.9</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1615/">
	<p>
	Two security issues have been fixed in this release which affect
	users of specific PostgreSQL features.
	</p>
	<ul>
	<li>CVE-2015-5289 json or jsonb input values constructed from
	arbitrary user input can crash the PostgreSQL server and cause a denial of
	service.
	</li>
	<li>CVE-2015-5288: The crypt() function included with the optional pgCrypto
	extension could be exploited to read a few additional bytes of memory.
	No working exploit for this issue has been developed.
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5289</cvename>
	<cvename>CVE-2015-5288</cvename>
	</references>
	<dates>
	<discovery>2015-10-08</discovery>
	<entry>2015-10-08</entry>
	</dates>
	</vuln>

	<vuln vid="d3324fdb-6bf0-11e5-bc5e-00505699053e">
	<topic>ZendFramework1 -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>ZendFramework1</name>
	<range><lt>1.12.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Zend Framework developers report:</p>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2015-08">
	<p>The PDO adapters of Zend Framework 1 do not filter null bytes values
	in SQL statements. A PDO adapter can treat null bytes in a query as a
	string terminator, allowing an attacker to add arbitrary SQL
	following a null byte, and thus create a SQL injection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7695</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/30/6</url>
	<url>http://framework.zend.com/security/advisory/ZF2015-08</url>
	</references>
	<dates>
	<discovery>2015-09-15</discovery>
	<entry>2015-10-06</entry>
	<modified>2015-10-12</modified>
	</dates>
	</vuln>

	<vuln vid="42852f72-6bd3-11e5-9909-002590263bf5">
	<topic>OpenSMTPD -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opensmtpd</name>
	<range><lt>5.7.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSMTPD developers report:</p>
	<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.3.txt">
	<p>fix an mda buffer truncation bug which allows a user to create
	forward files that pass session checks but fail delivery later down
	the chain, within the user mda</p>
	<p>fix remote buffer overflow in unprivileged pony process</p>
	<p>reworked offline enqueue to better protect against hardlink
	attacks</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/10/04/2</url>
	<url>https://www.opensmtpd.org/announces/release-5.7.3.txt</url>
	</references>
	<dates>
	<discovery>2015-10-04</discovery>
	<entry>2015-10-06</entry>
	</dates>
	</vuln>

	<vuln vid="5d280761-6bcf-11e5-9909-002590263bf5">
	<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.16</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.13</lt></range>
	</package>
	<package>
	<name>mbedtls</name>
	<range><lt>2.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ARM Limited reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released">
	<p>Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach
	for PKCS#1 v1.5 signatures. These releases include countermeasures
	against that attack.</p>
	<p>Fabian Foerg of Gotham Digital Science found a possible client-side
	NULL pointer dereference, using the AFL Fuzzer. This dereference can
	only occur when misusing the API, although a fix has still been
	implemented.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released</url>
	</references>
	<dates>
	<discovery>2015-09-18</discovery>
	<entry>2015-10-06</entry>
	</dates>
	</vuln>

	<vuln vid="953aaa57-6bce-11e5-9909-002590263bf5">
	<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.15</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ARM Limited reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released">
	<p>In order to strengthen the minimum requirements for connections and
	to protect against the Logjam attack, the minimum size of
	Diffie-Hellman parameters accepted by the client has been increased
	to 1024 bits.</p>
	<p>In addition the default size for the Diffie-Hellman parameters on
	the server are increased to 2048 bits. This can be changed with
	ssl_set_dh_params() in case this is necessary.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released</url>
	</references>
	<dates>
	<discovery>2015-08-11</discovery>
	<entry>2015-10-06</entry>
	</dates>
	</vuln>

	<vuln vid="9272a5b0-6b40-11e5-bd7f-bcaec565249c">
	<topic>gdk-pixbuf2 -- head overflow and DoS</topic>
	<affects>
	<package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.32.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/9">
	<p>We found a heap overflow and a DoS in the gdk-pixbuf
	implementation triggered by the scaling of tga file.</p>
	</blockquote>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/10">
	<p>We found a heap overflow in the gdk-pixbuf implementation
	triggered by the scaling of gif file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-7673</cvename>
	<cvename>CVE-2015-7674</cvename>
	<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html</url>
	<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html</url>
	<url>http://www.openwall.com/lists/oss-security/2015/10/02/9</url>
	<url>http://www.openwall.com/lists/oss-security/2015/10/02/10</url>
	</references>
	<dates>
	<discovery>2015-10-02</discovery>
	<entry>2015-10-05</entry>
	</dates>
	</vuln>

	<vuln vid="6b3374d4-6b0b-11e5-9909-002590263bf5">
	<topic>plone -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>plone</name>
	<range><lt>4.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Plone.org reports:</p>
	<blockquote cite="https://plone.org/products/plone/security/advisories/20150910-announcement">
	<p>Versions Affected: All current Plone versions.</p>
	<p>Versions Not Affected: None.</p>
	<p>Nature of vulnerability: Allows creation of members by anonymous
	users on sites that have self-registration enabled, allowing bypass
	of CAPTCHA and similar protections against scripted attacks.</p>
	<p>The patch can be added to buildouts as Products.PloneHotfix20150910
	(available from PyPI) or downloaded from Plone.org.</p>
	<p>Immediate Measures You Should Take: Disable self-registration until
	you have applied the patch.</p>
	</blockquote>
	<blockquote cite="https://plone.org/security/20150910/non-persistent-xss-in-plone">
	<p>Plone's URL checking infrastructure includes a method for checking
	if URLs valid and located in the Plone site. By passing HTML into
	this specially crafted url, XSS can be achieved.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203255</freebsdpr>
	<url>https://plone.org/products/plone-hotfix/releases/20150910</url>
	<url>https://plone.org/products/plone/security/advisories/20150910-announcement</url>
	<url>https://plone.org/security/20150910/non-persistent-xss-in-plone</url>
	<url>https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087</url>
	</references>
	<dates>
	<discovery>2015-09-10</discovery>
	<entry>2015-10-05</entry>
	</dates>
	</vuln>

	<vuln vid="c1da8b75-6aef-11e5-9909-002590263bf5">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5-phar</name>
	<range><le>5.4.45</le></range>
	</package>
	<package>
	<name>php55-phar</name>
	<range><lt>5.5.30</lt></range>
	</package>
	<package>
	<name>php56-phar</name>
	<range><lt>5.6.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.5.30">
	<p>Phar:</p>
	<ul>
	<li>Fixed bug #69720 (Null pointer dereference in
	phar_get_fp_offset()).</li>
	<li>Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream
	when zip entry filename is "/").</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203541</freebsdpr>
	<cvename>CVE-2015-7803</cvename>
	<cvename>CVE-2015-7804</cvename>
	<url>http://php.net/ChangeLog-5.php#5.5.30</url>
	<url>http://php.net/ChangeLog-5.php#5.6.14</url>
	</references>
	<dates>
	<discovery>2015-10-01</discovery>
	<entry>2015-10-04</entry>
	<modified>2015-10-12</modified>
	</dates>
	</vuln>

	<vuln vid="ee7bdf7f-11bb-4eea-b054-c692ab848c20">
	<topic>OpenSMTPD -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opensmtpd</name>
	<range><lt>5.7.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSMTPD developers report:</p>
	<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.2.txt">
	<p>an oversight in the portable version of fgetln() that allows
	attackers to read and write out-of-bounds memory</p>
	<p>multiple denial-of-service vulnerabilities that allow local users
	to kill or hang OpenSMTPD</p>
	<p>a stack-based buffer overflow that allows local users to crash
	OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd
	user</p>
	<p>a hardlink attack (or race-conditioned symlink attack) that allows
	local users to unset the chflags() of arbitrary files</p>
	<p>a hardlink attack that allows local users to read the first line of
	arbitrary files (for example, root's hash from /etc/master.passwd)
	</p>
	<p>a denial-of-service vulnerability that allows remote attackers to
	fill OpenSMTPD's queue or mailbox hard-disk partition</p>
	<p>an out-of-bounds memory read that allows remote attackers to crash
	OpenSMTPD, or leak information and defeat the ASLR protection</p>
	<p>a use-after-free vulnerability that allows remote attackers to
	crash OpenSMTPD, or execute arbitrary code as the non-chrooted
	_smtpd user</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.opensmtpd.org/announces/release-5.7.2.txt</url>
	<cvename>CVE-2015-7687</cvename>
	</references>
	<dates>
	<discovery>2015-10-02</discovery>
	<entry>2015-10-04</entry>
	<modified>2015-10-06</modified>
	</dates>
	</vuln>

	<vuln vid="be3069c9-67e7-11e5-9909-002590263bf5">
	<topic>james -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>james</name>
	<range><lt>2.3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache James Project reports:</p>
	<blockquote cite="http://james.apache.org/download.cgi#Apache_James_Server">
	<p>This release has many enhancements and bug fixes over the previous
	release. See the Release Notes for a detailed list of changes. Some
	of the earlier defects could turn a James mail server into an Open
	Relay and allow files to be written on disk. All users of James
	Server are urged to upgrade to version v2.3.2.1 as soon as
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203461</freebsdpr>
	<certvu>988628</certvu>
	<cvename>CVE-2015-7611</cvename>
	<url>http://james.apache.org/download.cgi#Apache_James_Server</url>
	<url>https://blogs.apache.org/james/entry/apache_james_server_2_3</url>
	</references>
	<dates>
	<discovery>2015-09-30</discovery>
	<entry>2015-10-01</entry>
	<modified>2015-10-04</modified>
	</dates>
	</vuln>

	<vuln vid="1e7f0c11-673a-11e5-98c8-60a44c524f57">
	<topic>otrs -- Scheduler Process ID File Access</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><gt>3.2.*</gt><lt>3.2.18</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.15</lt></range>
	<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS project reports:</p>
	<blockquote cite="https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/">
	<p>An attacker with valid LOCAL credentials could access and
	manipulate the process ID file for bin/otrs.schduler.pl from the
	CLI.</p>
	<p>The Proc::Daemon module 0.14 for Perl uses world-writable
	permissions for a file that stores a process ID, which allows local
	users to have an unspecified impact by modifying this file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/</url>
	<cvename>CVE-2015-6842</cvename>
	<cvename>CVE-2013-7135</cvename>
	</references>
	<dates>
	<discovery>2015-09-17</discovery>
	<entry>2015-09-30</entry>
	</dates>
	</vuln>

	<vuln vid="4e3e8a50-65c1-11e5-948e-bcaec565249c">
	<topic>flash -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.521</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-23.html">
	<p>These updates resolve a type confusion vulnerability that could
	lead to code execution (CVE-2015-5573).</p>

	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).</p>

	<p>These updates resolve buffer overflow vulnerabilities that could
	lead to code execution (CVE-2015-6676, CVE-2015-6678).</p>

	<p>These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2015-5575, CVE-2015-5577,
	CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588,
	CVE-2015-6677).</p>

	<p>These updates include additional validation checks to ensure
	that Flash Player rejects malicious content from vulnerable
	JSONP callback APIs (CVE-2015-5571).</p>

	<p>These updates resolve a memory leak vulnerability
	(CVE-2015-5576).</p>

	<p>These updates include further hardening to a mitigation to
	defend against vector length corruptions (CVE-2015-5568).</p>

	<p>These updates resolve stack corruption vulnerabilities that
	could lead to code execution (CVE-2015-5567, CVE-2015-5579).</p>

	<p>These updates resolve a stack overflow vulnerability that could
	lead to code execution (CVE-2015-5587).</p>

	<p>These updates resolve a security bypass vulnerability that could
	lead to information disclosure (CVE-2015-5572).</p>

	<p>These updates resolve a vulnerability that could be exploited to
	bypass the same-origin-policy and lead to information disclosure
	(CVE-2015-6679).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5567</cvename>
	<cvename>CVE-2015-5568</cvename>
	<cvename>CVE-2015-5570</cvename>
	<cvename>CVE-2015-5571</cvename>
	<cvename>CVE-2015-5572</cvename>
	<cvename>CVE-2015-5573</cvename>
	<cvename>CVE-2015-5574</cvename>
	<cvename>CVE-2015-5575</cvename>
	<cvename>CVE-2015-5576</cvename>
	<cvename>CVE-2015-5577</cvename>
	<cvename>CVE-2015-5578</cvename>
	<cvename>CVE-2015-5588</cvename>
	<cvename>CVE-2015-6676</cvename>
	<cvename>CVE-2015-6677</cvename>
	<cvename>CVE-2015-6678</cvename>
	<cvename>CVE-2015-6679</cvename>
	<cvename>CVE-2015-6682</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-23.html</url>
	</references>
	<dates>
	<discovery>2015-09-21</discovery>
	<entry>2015-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="5114cd11-6571-11e5-9909-002590263bf5">
	<topic>codeigniter -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>Security: Fixed an SQL injection vulnerability in Active Record
	method offset().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203401</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2015-08-20</discovery>
	<entry>2015-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="01bce4c6-6571-11e5-9909-002590263bf5">
	<topic>codeigniter -- mysql database driver vulnerability</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>Security: Removed a fallback to mysql_escape_string() in the mysql
	database driver (escape_str() method) when there's no active database
	connection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203401</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2015-07-15</discovery>
	<entry>2015-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="c21f4e61-6570-11e5-9909-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>Security: Added HTTP "Host" header character validation to prevent
	cache poisoning attacks when base_url auto-detection is used.</p>
	<p>Security: Added FSCommand and seekSegmentTime to the "evil
	attributes" list in CI_Security::xss_clean().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203401</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2015-04-15</discovery>
	<entry>2015-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="f838dcb4-656f-11e5-9909-002590263bf5">
	<topic>codeigniter -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>Security: The xor_encode() method in the Encrypt Class has been
	removed. The Encrypt Class now requires the Mcrypt extension to be
	installed.</p>
	<p>Security: The Session Library now uses HMAC authentication instead
	of a simple MD5 checksum.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203401</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2014-06-05</discovery>
	<entry>2015-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="b7d785ea-656d-11e5-9909-002590263bf5">
	<topic>codeigniter -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>2.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CodeIgniter changelog reports:</p>
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	<p>An improvement was made to the MySQL and MySQLi drivers to prevent
	exposing a potential vector for SQL injection on sites using
	multi-byte character sets in the database client connection.</p>
	<p>An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7
	with mysql_set_charset() creates a situation where using multi-byte
	character sets on these environments may potentially expose a SQL
	injection attack vector. Latin-1, UTF-8, and other "low ASCII"
	character sets are unaffected on all environments.</p>
	<p>If you are running or considering running a multi-byte character
	set for your database connection, please pay close attention to the
	server environment you are deploying on to ensure you are not
	vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/156486</freebsdpr>
	<url>https://codeigniter.com/userguide2/changelog.html</url>
	</references>
	<dates>
	<discovery>2011-08-20</discovery>
	<entry>2015-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="0e425bb7-64f2-11e5-b2fd-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>45.0.2454.101</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-npapi</name>
	<range><lt>45.0.2454.101</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-pulse</name>
	<range><lt>45.0.2454.101</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html">
	<p>Two vulnerabilities were fixed in this release:</p>
	<ul>
	<li>[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit
	to Mariusz Mlynski.</li>
	<li>[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit
	to Mariusz Mlynski.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1303</cvename>
	<cvename>CVE-2015-1304</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html</url>
	</references>
	<dates>
	<discovery>2015-09-24</discovery>
	<entry>2015-09-27</entry>
	</dates>
	</vuln>

	<vuln vid="9770d6ac-614d-11e5-b379-14dae9d210b8">
	<topic>libssh2 -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>libssh2</name>
	<range><lt>1.5.0,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mariusz Ziulek reports:</p>
	<blockquote cite="http://www.libssh2.org/adv_20150311.html">
	<p>A malicious attacker could man in the middle a real server
	and cause libssh2 using clients to crash (denial of service) or
	otherwise read and use completely unintended memory areas in this
	process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.libssh2.org/adv_20150311.html</url>
	<url>https://trac.libssh2.org/ticket/294</url>
	<cvename>CVE-2015-1782</cvename>
	</references>
	<dates>
	<discovery>2015-01-25</discovery>
	<entry>2015-09-22</entry>
	<modified>2015-09-22</modified>
	</dates>
	</vuln>

	<vuln vid="2d56c7f4-b354-428f-8f48-38150c607a05">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>41.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>41.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.38</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.38</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.3.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>38.3.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>38.3.0</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0
	/ rv:38.3)</p>
	<p>MFSA 2015-97 Memory leak in mozTCPSocket to servers</p>
	<p>MFSA 2015-98 Out of bounds read in QCMS library with ICC
	V4 profile attributes</p>
	<p>MFSA 2015-99 Site attribute spoofing on Android by
	pasting URL with unknown scheme</p>
	<p>MFSA 2015-100 Arbitrary file manipulation by local user
	through Mozilla updater</p>
	<p>MFSA 2015-101 Buffer overflow in libvpx while parsing vp9
	format video</p>
	<p>MFSA 2015-102 Crash when using debugger with SavedStacks
	in JavaScript</p>
	<p>MFSA 2015-103 URL spoofing in reader mode</p>
	<p>MFSA 2015-104 Use-after-free with shared workers and
	IndexedDB</p>
	<p>MFSA 2015-105 Buffer overflow while decoding WebM
	video</p>
	<p>MFSA 2015-106 Use-after-free while manipulating HTML
	media content</p>
	<p>MFSA 2015-107 Out-of-bounds read during 2D canvas display
	on Linux 16-bit color depth systems</p>
	<p>MFSA 2015-108 Scripted proxies can access inner
	window</p>
	<p>MFSA 2015-109 JavaScript immutable property enforcement
	can be bypassed</p>
	<p>MFSA 2015-110 Dragging and dropping images exposes final
	URL after redirects</p>
	<p>MFSA 2015-111 Errors in the handling of CORS preflight
	request headers</p>
	<p>MFSA 2015-112 Vulnerabilities found through code
	inspection</p>
	<p>MFSA 2015-113 Memory safety errors in libGLES in the
	ANGLE graphics library</p>
	<p>MFSA 2015-114 Information disclosure via the High
	Resolution Time API</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4476</cvename>
	<cvename>CVE-2015-4500</cvename>
	<cvename>CVE-2015-4501</cvename>
	<cvename>CVE-2015-4502</cvename>
	<cvename>CVE-2015-4503</cvename>
	<cvename>CVE-2015-4504</cvename>
	<cvename>CVE-2015-4505</cvename>
	<cvename>CVE-2015-4506</cvename>
	<cvename>CVE-2015-4507</cvename>
	<cvename>CVE-2015-4508</cvename>
	<cvename>CVE-2015-4509</cvename>
	<cvename>CVE-2015-4510</cvename>
	<cvename>CVE-2015-4512</cvename>
	<cvename>CVE-2015-4516</cvename>
	<cvename>CVE-2015-4517</cvename>
	<cvename>CVE-2015-4519</cvename>
	<cvename>CVE-2015-4520</cvename>
	<cvename>CVE-2015-4521</cvename>
	<cvename>CVE-2015-4522</cvename>
	<cvename>CVE-2015-7174</cvename>
	<cvename>CVE-2015-7175</cvename>
	<cvename>CVE-2015-7176</cvename>
	<cvename>CVE-2015-7177</cvename>
	<cvename>CVE-2015-7178</cvename>
	<cvename>CVE-2015-7179</cvename>
	<cvename>CVE-2015-7180</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-96/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-97/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-98/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-99/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-100/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-102/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-103/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-104/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-105/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-106/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-107/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-108/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-109/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-110/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-111/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-112/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-113/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-114/</url>
	</references>
	<dates>
	<discovery>2015-09-22</discovery>
	<entry>2015-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="3d950687-b4c9-4a86-8478-c56743547af8">
	<topic>ffmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libav</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>gstreamer1-libav</name>
	<!-- gst-libav-1.4.5 has libav-10.5 -->
	<range><lt>1.5.90</lt></range>
	</package>
	<package>
	<name>gstreamer-ffmpeg</name>
	<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>handbrake</name>
	- <!-- handbrake-0.10.2 has libav-10.1 -->
	- <!-- no known fixed version -->
	- <range><ge>0</ge></range>
	+ <!-- handbrake prior to 1.2.0 has libav-10.1 -->
	+ <!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
	+ <range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>ffmpeg</name>
	<range><lt>2.7.2,1</lt></range>
	</package>
	<package>
	<name>ffmpeg26</name>
	<range><lt>2.6.4</lt></range>
	</package>
	<package>
	<name>ffmpeg25</name>
	<range><lt>2.5.8</lt></range>
	</package>
	<package>
	<name>ffmpeg24</name>
	<range><lt>2.4.11</lt></range>
	</package>
	<package>
	<name>ffmpeg-devel</name>
	<name>ffmpeg23</name>
	<name>ffmpeg2</name>
	<name>ffmpeg1</name>
	<name>ffmpeg-011</name>
	<name>ffmpeg0</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>avidemux</name>
	<name>avidemux2</name>
	<name>avidemux26</name>
	<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
	<range><lt>2.6.11</lt></range>
	</package>
	<package>
	<name>kodi</name>
	<!-- kodi-14.2 has ffmpeg-2.4.6 -->
	<range><lt>15.1</lt></range>
	</package>
	<package>
	<name>mplayer</name>
	<name>mencoder</name>
	<!-- mplayer-1.1.r20150403 has ffmpeg-2.7.0+ (snapshot, c299fbb) -->
	<range><lt>1.1.r20150822</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
	<range><le>0.27.5,1</le></range>
	</package>
	<package>
	<name>plexhometheater</name>
	<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6818">
	<p>The decode_ihdr_chunk function in libavcodec/pngdec.c in
	FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR
	(aka image header) chunk in a PNG image, which allows remote
	attackers to cause a denial of service (out-of-bounds array
	access) or possibly have unspecified other impact via a
	crafted image with two or more of these chunks.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6819">
	<p>Multiple integer underflows in the ff_mjpeg_decode_frame
	function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2
	allow remote attackers to cause a denial of service
	(out-of-bounds array access) or possibly have unspecified
	other impact via crafted MJPEG data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6820">
	<p>The ff_sbr_apply function in libavcodec/aacsbr.c in
	FFmpeg before 2.7.2 does not check for a matching AAC frame
	syntax element before proceeding with Spectral Band
	Replication calculations, which allows remote attackers to
	cause a denial of service (out-of-bounds array access) or
	possibly have unspecified other impact via crafted AAC
	data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6821">
	<p>The ff_mpv_common_init function in libavcodec/mpegvideo.c
	in FFmpeg before 2.7.2 does not properly maintain the
	encoding context, which allows remote attackers to cause a
	denial of service (invalid pointer access) or possibly have
	unspecified other impact via crafted MPEG data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6822">
	<p>The destroy_buffers function in libavcodec/sanm.c in
	FFmpeg before 2.7.2 does not properly maintain height and
	width values in the video context, which allows remote
	attackers to cause a denial of service (segmentation
	violation and application crash) or possibly have
	unspecified other impact via crafted LucasArts Smush video
	data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6823">
	<p>The allocate_buffers function in libavcodec/alac.c in
	FFmpeg before 2.7.2 does not initialize certain context
	data, which allows remote attackers to cause a denial of
	service (segmentation violation) or possibly have
	unspecified other impact via crafted Apple Lossless Audio
	Codec (ALAC) data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6824">
	<p>The sws_init_context function in libswscale/utils.c in
	FFmpeg before 2.7.2 does not initialize certain pixbuf data
	structures, which allows remote attackers to cause a denial
	of service (segmentation violation) or possibly have
	unspecified other impact via crafted video data.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6825">
	<p>The ff_frame_thread_init function in
	libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles
	certain memory-allocation failures, which allows remote
	attackers to cause a denial of service (invalid pointer
	access) or possibly have unspecified other impact via a
	crafted file, as demonstrated by an AVI file.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6826">
	<p>The ff_rv34_decode_init_thread_copy function in
	libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize
	certain structure members, which allows remote attackers to
	cause a denial of service (invalid pointer access) or
	possibly have unspecified other impact via crafted (1) RV30
	or (2) RV40 RealVideo data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6818</cvename>
	<cvename>CVE-2015-6819</cvename>
	<cvename>CVE-2015-6820</cvename>
	<cvename>CVE-2015-6821</cvename>
	<cvename>CVE-2015-6822</cvename>
	<cvename>CVE-2015-6823</cvename>
	<cvename>CVE-2015-6824</cvename>
	<cvename>CVE-2015-6825</cvename>
	<cvename>CVE-2015-6826</cvename>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a</url>
	<url>https://ffmpeg.org/security.html</url>
	</references>
	<dates>
	<discovery>2015-09-05</discovery>
	<entry>2015-09-20</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="c2fcbec2-5daa-11e5-9909-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle27</name>
	<range><lt>2.7.10</lt></range>
	</package>
	<package>
	<name>moodle28</name>
	<range><lt>2.8.8</lt></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Moodle Release Notes report:</p>
	<blockquote cite="https://docs.moodle.org/dev/Moodle_2.7.10_release_notes">
	<p>MSA-15-0030: Students can re-attempt answering questions in the
	lesson (CVE-2015-5264)</p>
	<p>MSA-15-0031: Teacher in forum can still post to "all participants"
	and groups they are not members of (CVE-2015-5272 - 2.7.10 only)</p>
	<p>MSA-15-0032: Users can delete files uploaded by other users in wiki
	(CVE-2015-5265)</p>
	<p>MSA-15-0033: Meta course synchronization enrolls suspended students
	as managers for a short period of time (CVE-2015-5266)</p>
	<p>MSA-15-0034: Vulnerability in password recovery mechanism
	(CVE-2015-5267)</p>
	<p>MSA-15-0035: Rating component does not check separate groups
	(CVE-2015-5268)</p>
	<p>MSA-15-0036: XSS in grouping description (CVE-2015-5269)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5264</cvename>
	<cvename>CVE-2015-5272</cvename>
	<cvename>CVE-2015-5265</cvename>
	<cvename>CVE-2015-5266</cvename>
	<cvename>CVE-2015-5267</cvename>
	<cvename>CVE-2015-5268</cvename>
	<cvename>CVE-2015-5269</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/09/21/1</url>
	<url>https://docs.moodle.org/dev/Moodle_2.7.10_release_notes</url>
	<url>https://docs.moodle.org/dev/Moodle_2.8.8_release_notes</url>
	<url>https://docs.moodle.org/dev/Moodle_2.9.2_release_notes</url>
	</references>
	<dates>
	<discovery>2015-09-14</discovery>
	<entry>2015-09-18</entry>
	<modified>2015-09-24</modified>
	</dates>
	</vuln>

	<vuln vid="d3a98c2d-5da1-11e5-9909-002590263bf5">
	<topic>squid -- TLS/SSL parser denial of service vulnerability</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.5.0.1</ge><lt>3.5.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Amos Jeffries, release manager of the Squid-3 series, reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/1">
	<p>Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are
	built with OpenSSL and configured for "SSL-Bump" decryption.</p>
	<p>Integer overflows can lead to invalid pointer math reading from
	random memory on some CPU architectures. In the best case this leads
	to wrong TLS extensions being used for the client, worst-case a
	crash of the proxy terminating all active transactions.</p>
	<p>Incorrect message size checks and assumptions about the existence
	of TLS extensions in the SSL/TLS handshake message can lead to very
	high CPU consumption (up to and including 'infinite loop'
	behaviour).</p>
	<p>The above can be triggered remotely. Though there is one layer of
	authorization applied before this processing to check that the
	client is allowed to use the proxy, that check is generally weak. MS
	Skype on Windows XP is known to trigger some of these.</p>
	</blockquote>
	<p>The FreeBSD port does not use SSL by default and is not vulnerable
	in the default configuration.</p>
	</body>
	</description>
	<references>
	<freebsdpr>ports/203186</freebsdpr>
	<url>http://www.squid-cache.org/Advisories/SQUID-2015_3.txt</url>
	<url>http://www.openwall.com/lists/oss-security/2015/09/18/1</url>
	</references>
	<dates>
	<discovery>2015-09-18</discovery>
	<entry>2015-09-18</entry>
	<modified>2016-02-18</modified>
	</dates>
	</vuln>

	<vuln vid="b55ecf12-5d98-11e5-9909-002590263bf5">
	<topic>remind -- buffer overflow with malicious reminder file input</topic>
	<affects>
	<package>
	<name>remind</name>
	<range><lt>3.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dianne Skoll reports:</p>
	<blockquote cite="http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html">
	<p>BUG FIX: Fix a buffer overflow found by Alexander Keller.</p>
	</blockquote>
	<p>The bug can be manifested by an extended DUMP command using a system
	variable (that is a special variable whose name begins with '$')</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5957</cvename>
	<freebsdpr>ports/202942</freebsdpr>
	<url>http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html</url>
	<url>http://www.openwall.com/lists/oss-security/2015/08/07/1</url>
	</references>
	<dates>
	<discovery>2015-07-27</discovery>
	<entry>2015-09-18</entry>
	</dates>
	</vuln>

	<vuln vid="d45ad7ae-5d56-11e5-9ad8-14dae9d210b8">
	<topic>shutter -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>shutter</name>
	<range><ge>0.80</ge><lt>0.93.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Luke Farone reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/541">
	<p>In the "Shutter" screenshot application, I discovered that using the
	"Show in folder" menu option while viewing a file with a
	specially-crafted path allows for arbitrary code execution with the
	permissions of the user running Shutter.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/541</url>
	<url>https://bugs.launchpad.net/shutter/+bug/1495163</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862</url>
	<cvename>CVE-2015-0854</cvename>
	</references>
	<dates>
	<discovery>2015-09-13</discovery>
	<entry>2015-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="a233d51f-5d4c-11e5-9ad8-14dae9d210b8">
	<topic>openjpeg -- use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>openjpeg</name>
	<range><lt>2.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Feist Josselin reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/550">
	<p>Use-after-free was found in openjpeg. The vuln is fixed in
	version 2.1.1 and was located in opj_j2k_write_mco function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/550</url>
	<url>https://github.com/uclouvain/openjpeg/issues/563</url>
	</references>
	<dates>
	<discovery>2015-08-14</discovery>
	<entry>2015-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="bab05188-5d4b-11e5-9ad8-14dae9d210b8">
	<topic>optipng -- use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>optipng</name>
	<range><le>0.6.5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Grieco reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/556">
	<p>We found a use-after-free causing an invalid/double free in
	optipng 0.6.4.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/556</url>
	<cvename>CVE-2015-7801</cvename>
	</references>
	<dates>
	<discovery>2015-09-16</discovery>
	<entry>2015-09-17</entry>
	<modified>2015-10-14</modified>
	</dates>
	</vuln>

	<vuln vid="3c259621-5d4a-11e5-9ad8-14dae9d210b8">
	<topic>openslp -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>openslp</name>
	<range><lt>2.0.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Qinghao Tang reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/559">
	<p>The function ParseExtension() in openslp 1.2.1 contains
	vulnerability: an attacker can cause a denial of service
	(infinite loop) via a packet with crafted "nextoffset"
	value and "extid" value.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/559</url>
	<cvename>CVE-2015-5155</cvename>
	</references>
	<dates>
	<discovery>2015-09-16</discovery>
	<entry>2015-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="8f5c9dd6-5cac-11e5-9ad8-14dae9d210b8">
	<topic>p7zip -- directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>p7zip</name>
	<range><lt>9.38.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alexander Cherepanov reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660">
	<p>7z (and 7zr) is susceptible to a directory traversal vulnerability.
	While extracting an archive, it will extract symlinks and then follow
	them if they are referenced in further entries. This can be exploited by
	a rogue archive to write files outside the current directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660</url>
	<url>http://www.openwall.com/lists/oss-security/2015/01/11/2</url>
	<url>http://sourceforge.net/p/p7zip/bugs/147/</url>
	<cvename>CVE-2015-1038</cvename>
	</references>
	<dates>
	<discovery>2015-01-05</discovery>
	<entry>2015-09-16</entry>
	</dates>
	</vuln>

	<vuln vid="31ea7f73-5c55-11e5-8607-74d02b9a84d5">
	<topic>h2o -- directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>h2o</name>
	<range><lt>1.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yakuzo reports:</p>
	<blockquote cite="https://h2o.examp1e.net/vulnerabilities.html">
	<p>H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
	normalization logic.</p>
	<p>When file.dir directive is used, this flaw
	allows a remote attacker to retrieve arbitrary files that exist
	outside the directory specified by the directive.</p>
	<p>H2O version 1.4.5 and version 1.5.0-beta2 have been released
	to address this vulnerability.</p>
	<p>Users are advised to upgrade their servers immediately.</p>
	<p>The vulnerability was reported by: Yusuke OSUMI.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5638</cvename>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638</url>
	</references>
	<dates>
	<discovery>2015-09-14</discovery>
	<entry>2015-09-16</entry>
	</dates>
	</vuln>

	<vuln vid="f4ce64c2-5bd4-11e5-9040-3c970e169bc2">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.3.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samuel Sidler reports:</p>
	<blockquote cite="https://wordpress.org/news/2015/09/wordpress-4-3-1/">
	<p>WordPress 4.3.1 is now available. This is a security
	release for all previous versions and we strongly
	encourage you to update your sites immediately.</p>
	<ul>
	<li>WordPress versions 4.3 and earlier are vulnerable
	to a cross-site scripting vulnerability when processing
	shortcode tags (CVE-2015-5714). Reported by Shahar Tal
	and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
	<li>A separate cross-site scripting vulnerability was found
	in the user list table. Reported by Ben Bidner of the
	WordPress security team.</li>
	<li>Finally, in certain cases, users without proper
	permissions could publish private posts and make
	them sticky (CVE-2015-5715). Reported by Shahar Tal
	and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5714</cvename>
	<cvename>CVE-2015-5715</cvename>
	<cvename>CVE-2015-7989</cvename>
	<url>http://www.openwall.com/lists/oss-security/2015/10/28/1</url>
	<url>https://wordpress.org/news/2015/09/wordpress-4-3-1/</url>
	</references>
	<dates>
	<discovery>2015-09-15</discovery>
	<entry>2015-09-15</entry>
	<modified>2015-10-29</modified>
	</dates>
	</vuln>

	<vuln vid="ea893f06-5a92-11e5-98c0-20cf30e32f6d">
	<topic>Bugzilla security issues</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.10</lt></range>
	</package>
	<package>
	<name>bugzilla50</name>
	<range><lt>5.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bugzilla Security Advisory</p>
	<blockquote cite="https://www.bugzilla.org/security/4.2.14/">
	<p>Login names (usually an email address) longer than 127
	characters are silently truncated in MySQL which could
	cause the domain name of the email address to be
	corrupted. An attacker could use this vulnerability to
	create an account with an email address different from the
	one originally requested. The login name could then be
	automatically added to groups based on the group's regular
	expression setting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4499</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1202447</url>
	</references>
	<dates>
	<discovery>2015-09-10</discovery>
	<entry>2015-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="4910d161-58a4-11e5-9ad8-14dae9d210b8">
	<topic>openldap -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>openldap-server</name>
	<range><lt>2.4.42_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Denis Andzakovic reports:</p>
	<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240">
	<p>By sending a crafted packet, an attacker may cause the
	OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240</url>
	<url>http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629</url>
	<cvename>CVE-2015-6908</cvename>
	</references>
	<dates>
	<discovery>2015-09-09</discovery>
	<entry>2015-09-12</entry>
	<modified>2015-09-13</modified>
	</dates>
	</vuln>

	<vuln vid="a35f415d-572a-11e5-b0a4-f8b156b6dcc8">
	<topic>vorbis-tools, opus-tools -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>vorbis-tools</name>
	<range><lt>1.4.0_10,3</lt></range>
	</package>
	<package>
	<name>opus-tools</name>
	<range><lt>0.1.9_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Paris Zoumpouloglou reports:</p>
	<blockquote cite="https://trac.xiph.org/ticket/2136">
	<p>I discovered an integer overflow issue in oggenc,
	related to the number of channels in the input WAV file.
	The issue triggers an out-of-bounds memory access which
	causes oggenc to crash.</p>
	</blockquote>
	<p>Paris Zoumpouloglou reports:</p>
	<blockquote cite="https://trac.xiph.org/ticket/2136">
	<p>A crafted WAV file with number of channels set to 0
	will cause oggenc to crash due to a division by zero
	issue.</p>
	</blockquote>
	<p>pengsu reports:</p>
	<blockquote cite="https://trac.xiph.org/ticket/2212">
	<p>I discovered an buffer overflow issue in oggenc/audio.c
	when it tries to open invalid aiff file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/202941</freebsdpr>
	<url>https://trac.xiph.org/ticket/2136</url>
	<cvename>CVE-2014-9639</cvename>
	<url>https://trac.xiph.org/ticket/2137</url>
	<cvename>CVE-2014-9638</cvename>
	<url>https://trac.xiph.org/ticket/2212</url>
	<cvename>CVE-2015-6749</cvename>
	</references>
	<dates>
	<discovery>2015-08-08</discovery>
	<entry>2015-09-09</entry>
	<modified>2015-09-09</modified>
	</dates>
	</vuln>

	<vuln vid="d76961da-56f6-11e5-934b-002590263bf5">
	<topic>pgbouncer -- failed auth_query lookup leads to connection as auth_user</topic>
	<affects>
	<package>
	<name>pgbouncer</name>
	<range><eq>1.6.0</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PgBouncer reports:</p>
	<blockquote cite="http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/">
	<p>New auth_user functionality introduced in 1.6 allows login as
	auth_user when client presents unknown username. It's quite likely
	auth_user is superuser. Affects only setups that have enabled
	auth_user in their config.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6817</cvename>
	<url>https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/</url>
	<url>https://github.com/pgbouncer/pgbouncer/issues/69</url>
	<url>http://www.openwall.com/lists/oss-security/2015/09/04/3</url>
	</references>
	<dates>
	<discovery>2015-09-03</discovery>
	<entry>2015-09-09</entry>
	</dates>
	</vuln>

	<vuln vid="3904f759-5659-11e5-a207-6805ca0b3d42">
	<topic>phpMyAdmin -- reCaptcha bypass</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.4.0</ge><lt>4.4.14.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-4/">
	<p>This vulnerability allows to complete the reCaptcha test
	and subsequently perform a brute force attack to guess user
	credentials without having to complete further reCaptcha
	tests.</p>

	<p>We consider this vulnerability to be non critical since
	reCaptcha is an additional opt-in security measure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.phpmyadmin.net/security/PMASA-2015-4/</url>
	<cvename>CVE-2015-6830</cvename>
	</references>
	<dates>
	<discovery>2015-09-08</discovery>
	<entry>2015-09-08</entry>
	</dates>
	</vuln>

	<vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<name>php5-soap</name>
	<name>php5-xsl</name>
	<range><lt>5.4.45</lt></range>
	</package>
	<package>
	<name>php55</name>
	<name>php55-soap</name>
	<name>php55-xsl</name>
	<range><lt>5.5.29</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-soap</name>
	<name>php56-xsl</name>
	<range><lt>5.6.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.4.45">
	<ul><li>Core:
	<ul>
	<li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li>
	<li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li>
	</ul></li>
	<li>EXIF:
	<ul>
	<li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li>
	</ul></li>
	<li>hash:
	<ul>
	<li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li>
	</ul></li>
	<li>PCRE:
	<ul>
	<li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li>
	</ul></li>
	<li>SOAP:
	<ul>
	<li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li>
	</ul></li>
	<li>SPL:
	<ul>
	<li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li>
	<li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li>
	</ul></li>
	<li>XSLT:
	<ul>
	<li>Fixed bug #69782 (NULL pointer dereference).</li>
	</ul></li>
	<li>ZIP:
	<ul>
	<li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li>
	</ul></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-5.php#5.4.45</url>
	<url>http://php.net/ChangeLog-5.php#5.5.29</url>
	<url>http://php.net/ChangeLog-5.php#5.6.13</url>
	<cvename>CVE-2015-6834</cvename>
	<cvename>CVE-2015-6835</cvename>
	<cvename>CVE-2015-6836</cvename>
	<cvename>CVE-2015-6837</cvename>
	<cvename>CVE-2015-6838</cvename>
	</references>
	<dates>
	<discovery>2015-09-03</discovery>
	<entry>2015-09-08</entry>
	<modified>2015-09-08</modified>
	</dates>
	</vuln>

	<vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8">
	<topic>ganglia-webfrontend -- auth bypass</topic>
	<affects>
	<package>
	<name>ganglia-webfrontend</name>
	<range><lt>3.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ivan Novikov reports:</p>
	<blockquote cite="https://github.com/ganglia/ganglia-web/issues/267">
	<p>It's easy to bypass auth by using boolean serialization...</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/ganglia/ganglia-web/issues/267</url>
	<cvename>CVE-2015-6816</cvename>
	</references>
	<dates>
	<discovery>2015-09-04</discovery>
	<entry>2015-09-08</entry>
	<modified>2015-09-08</modified>
	</dates>
	</vuln>

	<vuln vid="9bdd8eb5-564a-11e5-9ad8-14dae9d210b8">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>1.12.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html">
	<p>The following vulnerabilities have been fixed.</p>
	<ul>
	<li><p>wnpa-sec-2015-21</p>
	<p>Protocol tree crash. (Bug 11309)</p></li>
	<li><p>wnpa-sec-2015-22</p>
	<p>Memory manager crash. (Bug 11373)</p></li>
	<li><p>wnpa-sec-2015-23</p>
	<p>Dissector table crash. (Bug 11381)</p></li>
	<li><p>wnpa-sec-2015-24</p>
	<p>ZigBee crash. (Bug 11389)</p></li>
	<li><p>wnpa-sec-2015-25</p>
	<p>GSM RLC/MAC infinite loop. (Bug 11358)</p></li>
	<li><p>wnpa-sec-2015-26</p>
	<p>WaveAgent crash. (Bug 11358)</p></li>
	<li><p>wnpa-sec-2015-27</p>
	<p>OpenFlow infinite loop. (Bug 11358)</p></li>
	<li><p>wnpa-sec-2015-28</p>
	<p>Ptvcursor crash. (Bug 11358)</p></li>
	<li><p>wnpa-sec-2015-29</p>
	<p>WCCP crash. (Bug 11358)</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html</url>
	<cvename>CVE-2015-6241</cvename>
	<cvename>CVE-2015-6242</cvename>
	<cvename>CVE-2015-6243</cvename>
	<cvename>CVE-2015-6244</cvename>
	<cvename>CVE-2015-6245</cvename>
	<cvename>CVE-2015-6246</cvename>
	<cvename>CVE-2015-6247</cvename>
	<cvename>CVE-2015-6248</cvename>
	<cvename>CVE-2015-6249</cvename>
	</references>
	<dates>
	<discovery>2015-08-12</discovery>
	<entry>2015-09-08</entry>
	<modified>2015-09-08</modified>
	</dates>
	</vuln>

	<vuln vid="98092444-5645-11e5-9ad8-14dae9d210b8">
	<topic>screen -- stack overflow</topic>
	<affects>
	<package>
	<name>screen</name>
	<range><lt>4.3.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kuang-che Wu reports:</p>
	<blockquote cite="https://savannah.gnu.org/bugs/?45713">
	<p>screen will recursively call MScrollV to depth n/256. This
	is time consuming and will overflow stack if n is huge.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://savannah.gnu.org/bugs/?45713</url>
	<cvename>CVE-2015-6806</cvename>
	</references>
	<dates>
	<discovery>2015-08-07</discovery>
	<entry>2015-09-08</entry>
	</dates>
	</vuln>

	<vuln vid="b5e654c3-5644-11e5-9ad8-14dae9d210b8">
	<topic>libvncserver -- memory corruption</topic>
	<affects>
	<package>
	<name>libvncserver</name>
	<range><lt>0.9.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Petr Pisar reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=706087">
	<p>libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=706087</url>
	<url>https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6</url>
	</references>
	<dates>
	<discovery>2011-05-19</discovery>
	<entry>2015-09-08</entry>
	</dates>
	</vuln>

	<vuln vid="ed0ecad5-531d-11e5-9850-bcaec565249c">
	<topic>gdk-pixbuf2 -- integer overflows</topic>
	<affects>
	<package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.31.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Clasen reports:</p>
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html">
	<p>Fix several integer overflows.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html</url>
	</references>
	<dates>
	<discovery>2015-09-01</discovery>
	<entry>2015-09-04</entry>
	</dates>
	</vuln>

	<vuln vid="2c5e7e23-5248-11e5-9ad8-14dae9d210b8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><ge>9.9.7</ge><lt>9.9.7P3</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><lt>9.10.2P4</lt></range>
	</package>
	<package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/">
	<p>An incorrect boundary check in openpgpkey_61.c can cause
	named to terminate due to a REQUIRE assertion failure. This defect can
	be deliberately exploited by an attacker who can provide a maliciously
	constructed response in answer to a query.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/</url>
	<cvename>CVE-2015-5986</cvename>
	</references>
	<dates>
	<discovery>2015-08-19</discovery>
	<entry>2015-09-03</entry>
	</dates>
	</vuln>

	<vuln vid="eaf3b255-5245-11e5-9ad8-14dae9d210b8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.7P3</lt></range>
	</package>
	<package>
	<name>bind910</name>
	<range><ge>9.10.2</ge><lt>9.10.2P4</lt></range>
	</package>
	<package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/">
	<p>Parsing a malformed DNSSEC key can cause a validating
	resolver to exit due to a failed assertion in buffer.c. It is possible
	for a remote attacker to deliberately trigger this condition, for
	example by using a query which requires a response from a zone
	containing a deliberately malformed key.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/</url>
	<cvename>CVE-2015-5722</cvename>
	<freebsdsa>SA-15:23.bind</freebsdsa>
	</references>
	<dates>
	<discovery>2015-08-19</discovery>
	<entry>2015-09-03</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="a9350df8-5157-11e5-b5c1-e8e0b747a45a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>45.0.2454.85</lt></range>
	</package>
	<package>
	<!--pcbsd-->
	<name>chromium-npapi</name>
	<range><lt>45.0.2454.85</lt></range>
	</package>
	<package>
	<!--pcbsd-->
	<name>chromium-pulse</name>
	<range><lt>45.0.2454.85</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl">
	<p>29 security fixes in this release, including:</p>
	<ul>
	<li>[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
	to anonymous.</li>
	<li>[522791] High CVE-2015-1292: Cross-origin bypass in
	ServiceWorker. Credit to Mariusz Mlynski.</li>
	<li>[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
	to Mariusz Mlynski.</li>
	<li>[492263] High CVE-2015-1294: Use-after-free in Skia. Credit
	to cloudfuzzer.</li>
	<li>[502562] High CVE-2015-1295: Use-after-free in Printing. Credit
	to anonymous.</li>
	<li>[421332] High CVE-2015-1296: Character spoofing in omnibox.
	Credit to zcorpan.</li>
	<li>[510802] Medium CVE-2015-1297: Permission scoping error in
	Webrequest. Credit to Alexander Kashev.</li>
	<li>[518827] Medium CVE-2015-1298: URL validation error in
	extensions. Credit to Rob Wu.</li>
	<li>[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
	to taro.suzuki.dev.</li>
	<li>[511616] Medium CVE-2015-1300: Information leak in Blink. Credit
	to cgvwzq.</li>
	<li>[526825] CVE-2015-1301: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1291</cvename>
	<cvename>CVE-2015-1292</cvename>
	<cvename>CVE-2015-1293</cvename>
	<cvename>CVE-2015-1294</cvename>
	<cvename>CVE-2015-1295</cvename>
	<cvename>CVE-2015-1296</cvename>
	<cvename>CVE-2015-1297</cvename>
	<cvename>CVE-2015-1298</cvename>
	<cvename>CVE-2015-1299</cvename>
	<cvename>CVE-2015-1300</cvename>
	<cvename>CVE-2015-1301</cvename>
	<url>http://googlechromereleases.blogspot.nl</url>
	</references>
	<dates>
	<discovery>2015-09-01</discovery>
	<entry>2015-09-02</entry>
	</dates>
	</vuln>

	<vuln vid="55c43f5b-5190-11e5-9ad8-14dae9d210b8">
	<topic>powerdns -- denial of service</topic>
	<affects>
	<package>
	<name>powerdns</name>
	<range><ge>3.4.0</ge><lt>3.4.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS reports:</p>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/">
	<p>A bug was found in our DNS packet parsing/generation code,
	which, when exploited, can cause individual threads (disabling service)
	or whole processes (allowing a supervisor to restart them) to crash with
	just one or a few query packets.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/</url>
	<cvename>CVE-2015-5230</cvename>
	</references>
	<dates>
	<discovery>2015-09-02</discovery>
	<entry>2015-09-02</entry>
	</dates>
	</vuln>

	<vuln vid="fc1f6658-4f53-11e5-934b-002590263bf5">
	<topic>ghostscript -- denial of service (crash) via crafted Postscript files</topic>
	<affects>
	<package>
	<name>ghostscript7</name>
	<name>ghostscript7-nox11</name>
	<name>ghostscript7-base</name>
	<name>ghostscript7-x11</name>
	<range><lt>7.07_32</lt></range>
	</package>
	<package>
	<name>ghostscript8</name>
	<name>ghostscript8-nox11</name>
	<name>ghostscript8-base</name>
	<name>ghostscript8-x11</name>
	<range><lt>8.71_19</lt></range>
	</package>
	<package>
	<name>ghostscript9</name>
	<name>ghostscript9-nox11</name>
	<name>ghostscript9-base</name>
	<name>ghostscript9-x11</name>
	<range><lt>9.06_11</lt></range>
	</package>
	<package>
	<name>ghostscript9-agpl</name>
	<name>ghostscript9-agpl-nox11</name>
	<range><lt>9.15_2</lt></range>
	</package>
	<package>
	<name>ghostscript9-agpl-base</name>
	<name>ghostscript9-agpl-x11</name>
	<range><lt>9.16_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228">
	<p>Integer overflow in the gs_heap_alloc_bytes function in
	base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
	attackers to cause a denial of service (crash) via a crafted
	Postscript (ps) file, as demonstrated by using the ps2pdf command,
	which triggers an out-of-bounds read or write.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3228</cvename>
	<url>http://bugs.ghostscript.com/show_bug.cgi?id=696041</url>
	<url>http://bugs.ghostscript.com/show_bug.cgi?id=696070</url>
	<url>http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859</url>
	</references>
	<dates>
	<discovery>2015-06-17</discovery>
	<entry>2015-09-01</entry>
	<modified>2015-09-02</modified>
	</dates>
	</vuln>

	<vuln vid="80c66af0-d1c5-449e-bd31-63b12525ff88">
	<topic>ffmpeg -- out-of-bounds array access</topic>
	<affects>
	<package>
	<name>libav</name>
	<range><ge>11.0</ge><lt>11.4</lt></range>
	<range><lt>10.7</lt></range>
	</package>
	<package>
	<name>gstreamer1-libav</name>
	<!-- gst-libav-1.4.5 has libav-10.5 -->
	<range><lt>1.5.1</lt></range>
	</package>
	<package>
	<name>handbrake</name>
	- <!-- handbrake-0.10.2 has libav-10.1 -->
	- <!-- no known fixed version -->
	- <range><ge>0</ge></range>
	+ <!-- handbrake prior to 1.2.0 has libav-10.1 -->
	+ <!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
	+ <range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>ffmpeg</name>
	<range><ge>2.2.0,1</ge><lt>2.2.15,1</lt></range>
	<range><lt>2.0.7,1</lt></range>
	</package>
	<package>
	<name>ffmpeg26</name>
	<range><lt>2.6.2</lt></range>
	</package>
	<package>
	<name>ffmpeg25</name>
	<range><lt>2.5.6</lt></range>
	</package>
	<package>
	<name>ffmpeg24</name>
	<range><lt>2.4.8</lt></range>
	</package>
	<package>
	<name>ffmpeg23</name>
	<!-- just in case: f7e1367 wasn't cherry-picked -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>ffmpeg1</name>
	<!-- just in case: f7e1367 wasn't cherry-picked -->
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>avidemux</name>
	<name>avidemux26</name>
	<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
	<range><lt>2.6.11</lt></range>
	</package>
	<package>
	<name>kodi</name>
	<!-- kodi-14.2 has ffmpeg-2.4.6 -->
	<range><lt>15.1</lt></range>
	</package>
	<package>
	<name>mplayer</name>
	<name>mencoder</name>
	<!-- mplayer-1.1.r20141223 has ffmpeg-2.5.1+ (snapshot, 03b84f2) -->
	<range><lt>1.1.r20150403</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
	<range><le>0.27.5,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3395">
	<p>The msrle_decode_pal4 function in msrledec.c in Libav
	before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
	2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
	and 2.6.x before 2.6.2 allows remote attackers to have
	unspecified impact via a crafted image, related to a pixel
	pointer, which triggers an out-of-bounds array access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3395</cvename>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553</url>
	<url>https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948</url>
	<url>https://ffmpeg.org/security.html</url>
	<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
	</references>
	<dates>
	<discovery>2015-04-12</discovery>
	<entry>2015-09-01</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="da434a78-e342-4d9a-87e2-7497e5f117ba">
	<topic>ffmpeg -- use-after-free</topic>
	<affects>
	<package>
	<name>libav</name>
	<range><ge>11.0</ge><lt>11.4</lt></range>
	<range><lt>10.7</lt></range>
	</package>
	<package>
	<name>gstreamer1-libav</name>
	<!-- gst-libav-1.4.5 has libav-10.5 -->
	<range><lt>1.5.0</lt></range>
	</package>
	<package>
	<name>handbrake</name>
	- <!-- handbrake-0.10.2 has libav-10.1 -->
	- <!-- no known fixed version -->
	- <range><ge>0</ge></range>
	+ <!-- handbrake prior to 1.2.0 has libav-10.1 -->
	+ <!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
	+ <range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>ffmpeg</name>
	<range><ge>2.2.0,1</ge><lt>2.2.12,1</lt></range>
	<range><ge>2.1.0,1</ge><lt>2.1.7,1</lt></range>
	<range><lt>2.0.7,1</lt></range>
	</package>
	<package>
	<name>ffmpeg25</name>
	<range><lt>2.5.2</lt></range>
	</package>
	<package>
	<name>ffmpeg24</name>
	<range><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>ffmpeg23</name>
	<range><lt>2.3.6</lt></range>
	</package>
	<package>
	<name>ffmpeg1</name>
	<range><lt>1.2.11</lt></range>
	</package>
	<package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
	<range><le>0.27.5,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3417">
	<p>Use-after-free vulnerability in the ff_h264_free_tables
	function in libavcodec/h264.c in FFmpeg before 2.3.6 allows
	remote attackers to cause a denial of service or possibly
	have unspecified other impact via crafted H.264 data in an
	MP4 file, as demonstrated by an HTML VIDEO element that
	references H.264 data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3417</cvename>
	<!-- ffmpeg and libav fixes are different -->
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214</url>
	<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e</url>
	<url>https://ffmpeg.org/security.html</url>
	<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
	</references>
	<dates>
	<discovery>2014-12-19</discovery>
	<entry>2015-09-01</entry>
	<modified>2018-03-25</modified>
	</dates>
	</vuln>

	<vuln vid="5300711b-4e61-11e5-9ad8-14dae9d210b8">
	<topic>graphviz -- format string vulnerability</topic>
	<affects>
	<package>
	<name>graphviz</name>
	<range><lt>2.38.0_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joshua Rogers reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2014/q4/784">
	<p>A format string vulnerability has been found in `graphviz'.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2014/q4/784</url>
	<url>https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081</url>
	</references>
	<dates>
	<discovery>2014-11-24</discovery>
	<entry>2015-08-29</entry>
	</dates>
	</vuln>

	<vuln vid="237a201c-888b-487f-84d3-7d92266381d6">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>40.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>40.0.3,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.2.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-95 Add-on notification bypass through data URLs</p>
	<p>MFSA 2015-94 Use-after-free when resizing canvas element
	during restyling</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4497</cvename>
	<cvename>CVE-2015-4498</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-94/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-95/</url>
	</references>
	<dates>
	<discovery>2015-08-27</discovery>
	<entry>2015-08-28</entry>
	</dates>
	</vuln>

	<vuln vid="4464212e-4acd-11e5-934b-002590263bf5">
	<topic>go -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>go</name>
	<range><lt>1.4.3,1</lt></range>
	</package>
	<package>
	<name>go14</name>
	<range><lt>1.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason Buberel, Go Product Manager, reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/237">
	<p>CVE-2015-5739 - "Content Length" treated as valid header</p>
	<p>CVE-2015-5740 - Double content-length headers does not return 400
	error</p>
	<p>CVE-2015-5741 - Additional hardening, not sending Content-Length
	w/Transfer-Encoding, Closing connections</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5739</cvename>
	<cvename>CVE-2015-5740</cvename>
	<cvename>CVE-2015-5741</cvename>
	<url>https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9</url>
	<url>https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e</url>
	<url>https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f</url>
	<url>http://seclists.org/oss-sec/2015/q3/237</url>
	</references>
	<dates>
	<discovery>2015-07-29</discovery>
	<entry>2015-08-25</entry>
	</dates>
	</vuln>

	<vuln vid="40497e81-fee3-4e54-9d5f-175a5c633b73">
	<topic>libtremor -- memory corruption</topic>
	<affects>
	<package>
	<name>libtremor</name>
	<range><lt>1.2.0.s20120120</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2012-07/">
	<p>Security researcher regenrecht reported via
	TippingPoint's Zero Day Initiative the possibility of memory
	corruption during the decoding of Ogg Vorbis files. This can
	cause a crash during decoding and has the potential for
	remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0444</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=719612</url>
	<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274</url>
	</references>
	<dates>
	<discovery>2012-01-31</discovery>
	<entry>2015-08-25</entry>
	<modified>2015-08-25</modified>
	</dates>
	</vuln>

	<vuln vid="3dac84c9-bce1-4199-9784-d68af1eb7b2e">
	<topic>libtremor -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libtremor</name>
	<range><lt>1.2.0.s20101013</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The RedHat Project reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=438125">
	<p>Will Drewry of the Google Security Team reported multiple
	issues in OGG Vorbis and Tremor libraries, that could cause
	application using those libraries to crash (NULL pointer
	dereference or divide by zero), enter an infinite loop or
	cause heap overflow caused by integer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1418</cvename>
	<cvename>CVE-2008-1419</cvename>
	<cvename>CVE-2008-1420</cvename>
	<cvename>CVE-2008-1423</cvename>
	<cvename>CVE-2008-2009</cvename>
	<url>http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html</url>
	<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea</url>
	<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e</url>
	<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4</url>
	</references>
	<dates>
	<discovery>2008-03-19</discovery>
	<entry>2015-08-25</entry>
	<modified>2015-08-25</modified>
	</dates>
	</vuln>

	<vuln vid="6900e6f1-4a79-11e5-9ad8-14dae9d210b8">
	<topic>pcre -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><lt>8.37_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Guanxing Wen reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/295">
	<p>PCRE library is prone to a vulnerability which leads to
	Heap Overflow.
	During the compilation of a malformed regular expression, more data is
	written on the malloced block than the expected size output by
	compile_regex().
	The Heap Overflow vulnerability is caused by the following regular
	expression.</p>
	<p>/(?J:(?\|(:(?\|(?'R')(\z(?\|(?'R')(\k'R')\|((?'R')))k'R')\|((?'R')))H'Ak'Rf)\|s(?'R')))/</p>
	<p>A dry run of this particular regular expression with pcretest will
	reports "double free or corruption (!prev)".
	But it is actually a heap overflow problem.
	The overflow only affects pcre 8.x branch, pcre2 branch is not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/295</url>
	<url>https://bugs.exim.org/show_bug.cgi?id=1672</url>
	</references>
	<dates>
	<discovery>2015-08-21</discovery>
	<entry>2015-08-24</entry>
	</dates>
	</vuln>

	<vuln vid="9393213d-489b-11e5-b8c7-d050996490d0">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.37</lt></range>
	</package>
	<package>
	<name>drupal7</name>
	<range><lt>7.39</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal development team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2015-003">
	<p>This security advisory fixes multiple vulnerabilities.
	See below for a list.</p>
	<h3>Cross-site Scripting - Ajax system - Drupal 7</h3>
	<p>A vulnerability was found that allows a malicious
	user to perform a cross-site scripting attack by
	invoking Drupal.ajax() on a whitelisted HTML element.</p>
	<p>This vulnerability is mitigated on sites that do not
	allow untrusted users to enter HTML.</p>
	<h3>Cross-site Scripting - Autocomplete system - Drupal 6 and 7</h3>
	<p>A cross-site scripting vulnerability was found in
	the autocomplete functionality of forms. The
	requested URL is not sufficiently sanitized.</p>
	<p>This vulnerability is mitigated by the fact that
	the malicious user must be allowed to upload files.</p>
	<h3>SQL Injection - Database API - Drupal 7</h3>
	<p>A vulnerability was found in the SQL comment
	filtering system which could allow a user with
	elevated permissions to inject malicious code in
	SQL comments.</p>
	<p>This vulnerability is mitigated by the fact that
	only one contributed module that the security team
	found uses the comment filtering system in a way
	that would trigger the vulnerability. That module
	requires you to have a very high level of access
	in order to perform the attack.</p>
	<h3>Cross-site Request Forgery - Form API - Drupal 6 and 7</h3>
	<p>A vulnerability was discovered in Drupal's form API
	that could allow file upload value callbacks to run
	with untrusted input, due to form token validation
	not being performed early enough. This vulnerability
	could allow a malicious user to upload files to the
	site under another user's account.</p>
	<p>This vulnerability is mitigated by the fact that
	the uploaded files would be temporary, and Drupal
	normally deletes temporary files automatically
	after 6 hours.</p>
	<h3>Information Disclosure in Menu Links - Access system - Drupal 6 and 7</h3>
	<p>Users without the "access content" permission
	can see the titles of nodes that they do not have
	access to, if the nodes are added to a menu on the
	site that the users have access to.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.drupal.org/SA-CORE-2015-003</url>
	</references>
	<dates>
	<discovery>2015-08-19</discovery>
	<entry>2015-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="2920c449-4850-11e5-825f-c80aa9043978">
	<topic>OpenSSH -- PAM vulnerabilities</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><lt>7.0.p1,1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_2</lt></range>
	<range><ge>10.1</ge><lt>10.1_19</lt></range>
	<range><ge>9.3</ge><lt>9.3_24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.openssh.com/txt/release-7.0">
	<p>OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
	Local attackers may be able to write arbitrary messages to
	logged-in users, including terminal escape sequences. Reported
	by Nikolay Edigaryev.</p>
	<p>Fixed a privilege separation
	weakness related to PAM support. Attackers who could successfully
	compromise the pre-authentication process for remote code
	execution and who had valid credentials on the host could
	impersonate other users.</p>
	<p>Fixed a use-after-free bug
	related to PAM support that was reachable by attackers who could
	compromise the pre-authentication process for remote code
	execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openssh.com/txt/release-7.0</url>
	<cvename>CVE-2015-6563</cvename>
	<cvename>CVE-2015-6564</cvename>
	<cvename>CVE-2015-6565</cvename>
	<freebsdsa>SA-15:22.openssh</freebsdsa>
	</references>
	<dates>
	<discovery>2015-08-11</discovery>
	<entry>2015-08-21</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="27fed73e-484f-11e5-825f-c80aa9043978">
	<topic>OpenSSH -- PermitRootLogin may allow password connections with 'without-password'</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><eq>7.0.p1,1</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.openssh.com/txt/release-7.1">
	<p>OpenSSH 7.0 contained a logic error in PermitRootLogin=
	prohibit-password/without-password that could, depending on
	compile-time configuration, permit password authentication to
	root while preventing other forms of authentication. This problem
	was reported by Mantas Mikulenas.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openssh.com/txt/release-7.1</url>
	</references>
	<dates>
	<discovery>2015-08-20</discovery>
	<entry>2015-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="2fe40238-480f-11e5-adde-14dae9d210b8">
	<topic>tarsnap -- buffer overflow and local DoS</topic>
	<affects>
	<package>
	<name>tarsnap</name>
	<range><lt>1.0.36</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Colin Percival reports:</p>
	<blockquote cite="http://mail.tarsnap.com/tarsnap-announce/msg00032.html">
	<p>1. SECURITY FIX: When constructing paths of objects being archived, a buffer
	could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
	paths. Theoretically this could be exploited by an unprivileged user whose
	files are being archived; I do not believe it is exploitable in practice,
	but I am offering a $1000 bounty for the first person who can prove me wrong:
	http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</p>
	<p>2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
	and control of the tarsnap service, could make tarsnap allocate a large
	amount of memory upon listing archives or reading an archive the attacker
	created; on 32-bit machines, tarsnap can be caused to crash under the
	aforementioned conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mail.tarsnap.com/tarsnap-announce/msg00032.html</url>
	<url>http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</url>
	</references>
	<dates>
	<discovery>2015-08-21</discovery>
	<entry>2015-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="a0a4e24c-4760-11e5-9391-3c970e169bc2">
	<topic>vlc -- arbitrary pointer dereference vulnerability</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>2.2.1_5,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="https://www.ocert.org/advisories/ocert-2015-009.html">
	<p>The stable VLC version suffers from an arbitrary pointer
	dereference vulnerability.</p>
	<p>The vulnerability affects the 3GP file format parser,
	insufficient restrictions on a writable buffer can be
	exploited to execute arbitrary code via the heap memory.
	A specific 3GP file can be crafted to trigger the
	vulnerability.</p>
	<p>Credit: vulnerability reported by Loren Maggiore of
	Trail of Bits.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5949</cvename>
	<url>https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd</url>
	<url>https://www.ocert.org/advisories/ocert-2015-009.html</url>
	</references>
	<dates>
	<discovery>2015-08-20</discovery>
	<entry>2015-08-20</entry>
	</dates>
	</vuln>

	<vuln vid="9a71953a-474a-11e5-adde-14dae9d210b8">
	<topic>libpgf -- use-after-free</topic>
	<affects>
	<package>
	<name>libpgf</name>
	<range><le>6.14.12</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pengsu Cheng reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/404">
	<p>An use-after-free issue in Decoder.cpp was reported to
	upstream. The problem is due to lack of validation of ColorTableSize.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/404</url>
	<url>https://sourceforge.net/p/libpgf/code/147/</url>
	<url>https://sourceforge.net/p/libpgf/code/148/</url>
	<cvename>CVE-2015-6673</cvename>
	</references>
	<dates>
	<discovery>2015-08-08</discovery>
	<entry>2015-08-20</entry>
	<modified>2015-08-26</modified>
	</dates>
	</vuln>

	<vuln vid="f5b8b670-465c-11e5-a49d-bcaec565249c">
	<topic>gdk-pixbuf2 -- heap overflow and DoS</topic>
	<affects>
	<package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.31.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Grieco reports:</p>
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
	<p>We found a heap overflow and a DoS in the gdk-pixbuf
	implementation triggered by the scaling of a malformed bmp.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4491</cvename>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
	</references>
	<dates>
	<discovery>2015-07-12</discovery>
	<entry>2015-08-19</entry>
	</dates>
	</vuln>

	<vuln vid="b0e54dc1-45d2-11e5-adde-14dae9d210b8">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<name>py32-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<range><lt>1.8.4</lt></range>
	</package>
	<package>
	<name>py27-django17</name>
	<name>py32-django17</name>
	<name>py33-django17</name>
	<name>py34-django17</name>
	<range><lt>1.7.10</lt></range>
	</package>
	<package>
	<name>py27-django14</name>
	<name>py32-django14</name>
	<name>py33-django14</name>
	<name>py34-django14</name>
	<range><lt>1.4.22</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<name>py32-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<range><le>20150709,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Graham reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/aug/18/security-releases/">
	<p>Denial-of-service possibility in logout() view by filling
	session store</p>
	<p>Previously, a session could be created when anonymously
	accessing the django.contrib.auth.views.logout view
	(provided it wasn't decorated with django.contrib.auth.decorators.login_required
	as done in the admin). This could allow an attacker to
	easily create many new session records by sending repeated
	requests, potentially filling up the session store or
	causing other users' session records to be evicted.</p>
	<p>The django.contrib.sessions.middleware.SessionMiddleware
	has been modified to no longer create empty session records.</p>
	<p>This portion of the fix has been assigned CVE-2015-5963.</p>
	<p>Additionally, on the 1.4 and 1.7 series only, the
	contrib.sessions.backends.base.SessionBase.flush() and
	cache_db.SessionStore.flush() methods have been modified
	to avoid creating a new empty session. Maintainers of
	third-party session backends should check if the same
	vulnerability is present in their backend and correct
	it if so.</p>
	<p>This portion of the fix has been assigned CVE-2015-5964.
	Anyone reporting a similar vulnerability in a third-party
	session backend should not use this CVE ID.</p>
	<p>Thanks Lin Hua Cheng for reporting the issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2015/aug/18/security-releases/</url>
	<cvename>CVE-2015-5963</cvename>
	<cvename>CVE-2015-5964</cvename>
	</references>
	<dates>
	<discovery>2015-08-18</discovery>
	<entry>2015-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="0ecc1f55-45d0-11e5-adde-14dae9d210b8">
	<topic>unreal -- denial of service</topic>
	<affects>
	<package>
	<name>Unreal</name>
	<range><ge>3.2.10</ge><lt>3.2.10.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unreal reports:</p>
	<blockquote cite="https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt">
	<p>Summary: If SASL support is enabled in UnrealIRCd (this is
	not the default) and is also enabled in your services
	package then a malicious user with a services account can cause
	UnrealIRCd to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt</url>
	<url>http://seclists.org/oss-sec/2015/q3/367</url>
	</references>
	<dates>
	<discovery>2015-08-13</discovery>
	<entry>2015-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="f1692469-45ce-11e5-adde-14dae9d210b8">
	<topic>jasper -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jasper</name>
	<range><lt>1.900.1_16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin Prpic reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0">
	<p>A double free flaw was found in the way JasPer's
	jasper_image_stop_load() function parsed certain JPEG 2000 image files.
	A specially crafted file could cause an application using JasPer to
	crash.</p>
	</blockquote>
	<p>Feist Josselin reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/408">
	<p>A new use-after-free was found in Jasper JPEG-200. The
	use-after-free appears in the function mif_process_cmpt of the
	src/libjasper/mif/mif_cod.c file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0</url>
	<url>http://seclists.org/oss-sec/2015/q3/366</url>
	<url>http://seclists.org/oss-sec/2015/q3/408</url>
	<cvename>CVE-2015-5203</cvename>
	<cvename>CVE-2015-5221</cvename>
	</references>
	<dates>
	<discovery>2015-08-17</discovery>
	<entry>2015-08-18</entry>
	<modified>2016-02-24</modified>
	</dates>
	</vuln>

	<vuln vid="a59e263a-45cd-11e5-adde-14dae9d210b8">
	<topic>freexl -- integer overflow</topic>
	<affects>
	<package>
	<name>freexl</name>
	<range><lt>1.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Cornelius reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/06/7">
	<p>There's an integer overflow in the allocate_cells() function
	when trying to allocate the memory for worksheet with specially
	crafted row/column dimensions. This can be exploited to cause a
	heap memory corruption. The most likely outcome of this is a crash
	when trying to initialize the cells later in the function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/07/06/7</url>
	</references>
	<dates>
	<discovery>2015-07-06</discovery>
	<entry>2015-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="ac98d090-45cc-11e5-adde-14dae9d210b8">
	<topic>freexl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>freexl</name>
	<range><lt>1.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jodie Cunningham reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/03/25/1">
	<p>#1: A flaw was found in the way FreeXL reads sectors from
	the input file. A specially crafted file could possibly
	result in stack corruption near freexl.c:3752.</p>
	<p>#2: A flaw was found in the function allocate_cells(). A
	specially crafted file with invalid workbook dimensions
	could possibly result in stack corruption near freexl.c:1074</p>
	<p>#3: A flaw was found in the way FreeXL handles a premature EOF. A
	specially crafted input file could possibly result in stack corruption
	near freexl.c:1131</p>
	<p>#4: FreeXL 1.0.0g did not properly check requests for workbook memory
	allocation. A specially crafted input file could cause a Denial of
	Service, or possibly write onto the stack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/03/25/1</url>
	<cvename>CVE-2015-2776</cvename>
	</references>
	<dates>
	<discovery>2015-03-24</discovery>
	<entry>2015-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="47aa4343-44fa-11e5-9daa-14dae9d210b8">
	<topic>mod_jk -- information disclosure</topic>
	<affects>
	<package>
	<name>ap22-mod_jk</name>
	<name>ap24-mod_jk</name>
	<range><lt>1.2.41,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NIST reports:</p>
	<blockquote cite="http://www.cvedetails.com/cve/CVE-2014-8111/">
	<p>Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores
	JkUnmount rules for subtrees of previous JkMount rules, which allows
	remote attackers to access otherwise restricted artifacts via
	unspecified vectors. </p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html</url>
	<url>http://readlist.com/lists/tomcat.apache.org/users/27/135512.html</url>
	<url>http://www.cvedetails.com/cve/CVE-2014-8111/</url>
	<cvename>CVE-2014-8111</cvename>
	</references>
	<dates>
	<discovery>2015-01-15</discovery>
	<entry>2015-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="f06f20dc-4347-11e5-93ad-002590263bf5">
	<topic>qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><le>0.11.1_20</le></range>
	<range><ge>0.12</ge><le>2.3.0_2</le></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-140.html">
	<p>The QEMU model of the RTL8139 network card did not sufficiently
	validate inputs in the C+ mode offload emulation. This results in
	uninitialized memory from the QEMU process's heap being leaked to
	the domain as well as to the network.</p>
	<p>A guest may be able to read sensitive host-level data relating to
	itself which resides in the QEMU process.</p>
	<p>Such information may include things such as information relating to
	real devices backing emulated devices or passwords which the host
	administrator does not intend to share with the guest admin.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5165</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-140.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef</url>
	</references>
	<dates>
	<discovery>2015-08-03</discovery>
	<entry>2015-08-17</entry>
	<modified>2015-08-19</modified>
	</dates>
	</vuln>

	<vuln vid="ee99899d-4347-11e5-93ad-002590263bf5">
	<topic>qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><le>0.11.1_20</le></range>
	<range><ge>0.12</ge><le>2.3.0_2</le></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-139.html">
	<p>When unplugging an emulated block device the device was not fully
	unplugged, meaning a second unplug attempt would attempt to unplug
	the device a second time using a previously freed pointer.</p>
	<p>An HVM guest which has access to an emulated IDE disk device may be
	able to exploit this vulnerability in order to take over the qemu
	process elevating its privilege to that of the qemu process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5166</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-139.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52</url>
	</references>
	<dates>
	<discovery>2015-08-03</discovery>
	<entry>2015-08-17</entry>
	<modified>2015-08-19</modified>
	</dates>
	</vuln>

	<vuln vid="787ef75e-44da-11e5-93ad-002590263bf5">
	<topic>php5 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<name>php5-openssl</name>
	<name>php5-phar</name>
	<name>php5-soap</name>
	<range><lt>5.4.44</lt></range>
	</package>
	<package>
	<name>php55</name>
	<name>php55-openssl</name>
	<name>php55-phar</name>
	<name>php55-soap</name>
	<range><lt>5.5.28</lt></range>
	</package>
	<package>
	<name>php56</name>
	<name>php56-openssl</name>
	<name>php56-phar</name>
	<name>php56-soap</name>
	<range><lt>5.6.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php">
	<p>Core:</p>
	<ul>
	<li>Fixed bug #69793 (Remotely triggerable stack exhaustion via
	recursive method calls).</li>
	<li>Fixed bug #70121 (unserialize() could lead to unexpected methods
	execution / NULL pointer deref).</li>
	</ul>
	<p>OpenSSL:</p>
	<ul>
	<li>Fixed bug #70014 (openssl_random_pseudo_bytes() is not
	cryptographically secure).</li>
	</ul>
	<p>Phar:</p>
	<ul>
	<li>Improved fix for bug #69441.</li>
	<li>Fixed bug #70019 (Files extracted from archive may be placed
	outside of destination directory).</li>
	</ul>
	<p>SOAP:</p>
	<ul>
	<li>Fixed bug #70081 (SoapClient info leak / null pointer
	dereference via multiple type confusions).</li>
	</ul>
	<p>SPL:</p>
	<ul>
	<li>Fixed bug #70068 (Dangling pointer in the unserialization of
	ArrayObject items).</li>
	<li>Fixed bug #70166 (Use After Free Vulnerability in unserialize()
	with SPLArrayObject).</li>
	<li>Fixed bug #70168 (Use After Free Vulnerability in unserialize()
	with SplObjectStorage).</li>
	<li>Fixed bug #70169 (Use After Free Vulnerability in unserialize()
	with SplDoublyLinkedList).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/ChangeLog-5.php#5.4.44</url>
	<url>http://php.net/ChangeLog-5.php#5.5.28</url>
	<url>http://php.net/ChangeLog-5.php#5.6.12</url>
	<cvename>CVE-2015-6831</cvename>
	<cvename>CVE-2015-6832</cvename>
	<cvename>CVE-2015-6833</cvename>
	</references>
	<dates>
	<discovery>2015-08-06</discovery>
	<entry>2015-08-17</entry>
	<modified>2015-09-08</modified>
	</dates>
	</vuln>

	<vuln vid="6241b5df-42a1-11e5-93ad-002590263bf5">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki123</name>
	<range><lt>1.23.10</lt></range>
	</package>
	<package>
	<name>mediawiki124</name>
	<range><lt>1.24.3</lt></range>
	</package>
	<package>
	<name>mediawiki125</name>
	<range><lt>1.25.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MediaWiki reports:</p>
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html">
	<p>Internal review discovered that Special:DeletedContributions did
	not properly protect the IP of autoblocked users. This fix makes
	the functionality of Special:DeletedContributions consistent with
	Special:Contributions and Special:BlockList.</p>
	<p>Internal review discovered that watchlist anti-csrf tokens were not
	being compared in constant time, which could allow various timing
	attacks. This could allow an attacker to modify a user's watchlist
	via csrf</p>
	<p>John Menerick reported that MediaWiki's thumb.php failed to sanitize
	various error messages, resulting in xss.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-6727</cvename>
	<cvename>CVE-2013-7444</cvename>
	<cvename>CVE-2015-6728</cvename>
	<cvename>CVE-2015-6729</cvename>
	<cvename>CVE-2015-6730</cvename>
	<cvename>CVE-2015-6731</cvename>
	<cvename>CVE-2015-6733</cvename>
	<cvename>CVE-2015-6734</cvename>
	<cvename>CVE-2015-6735</cvename>
	<cvename>CVE-2015-6736</cvename>
	<cvename>CVE-2015-6737</cvename>
	<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html</url>
	<url>https://phabricator.wikimedia.org/T106893</url>
	<url>https://phabricator.wikimedia.org/T94116</url>
	<url>https://phabricator.wikimedia.org/T97391</url>
	<url>http://www.openwall.com/lists/oss-security/2015/08/27/6</url>
	</references>
	<dates>
	<discovery>2015-08-10</discovery>
	<entry>2015-08-14</entry>
	<modified>2015-12-24</modified>
	</dates>
	</vuln>

	<vuln vid="0c2c4d84-42a2-11e5-9daa-14dae9d210b8">
	<topic>freeradius3 -- insufficient validation on packets</topic>
	<affects>
	<package>
	<name>freeradius3</name>
	<range><lt>3.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jouni Malinen reports:</p>
	<blockquote cite="http://freeradius.org/security.html#eap-pwd-2015">
	<p>The EAP-PWD module performed insufficient validation on
	packets received from an EAP peer. This module is not enabled in the
	default configuration. Administrators must manually enable it for their
	server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://freeradius.org/security.html#eap-pwd-2015</url>
	</references>
	<dates>
	<discovery>2015-04-04</discovery>
	<entry>2015-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="ec6a2a1e-429d-11e5-9daa-14dae9d210b8">
	<topic>gnutls -- double free in certificate DN decoding</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>3.3.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>gnutls.org reports:</p>
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2015-3">
	<p>Kurt Roeckx reported that decoding a specific certificate with very
	long DistinguishedName (DN) entries leads to double free, which may
	result to a denial of service. Since the DN decoding occurs in almost
	all applications using certificates it is recommended to upgrade the
	latest GnuTLS version fixing the issue. Recommendation: Upgrade to
	GnuTLS 3.4.4, or 3.3.17.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-3</url>
	<mlist>http://seclists.org/oss-sec/2015/q3/308</mlist>
	<url>https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12</url>
	<cvename>CVE-2015-6251</cvename>
	</references>
	<dates>
	<discovery>2015-07-20</discovery>
	<entry>2015-08-14</entry>
	<modified>2015-08-18</modified>
	</dates>
	</vuln>

	<vuln vid="3de36a19-429d-11e5-9daa-14dae9d210b8">
	<topic>gnutls -- MD5 downgrade in TLS signatures</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>3.3.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Karthikeyan Bhargavan reports:</p>
	<blockquote cite="http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132">
	<p>GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5
	signature-hash algorithm needs to be explicitly enabled using the
	priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE
	profiles, GnuTLS clients do not offer RSA-MD5 in the signature
	algorithms extension. However, we find that all GnuTLS clients still
	accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still
	accept RSA-MD5 in the ClientCertificateVerify.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132</mlist>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-2</url>
	<mlist>http://seclists.org/oss-sec/2015/q2/367</mlist>
	</references>
	<dates>
	<discovery>2015-04-25</discovery>
	<entry>2015-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="9ee72858-4159-11e5-93ad-002590263bf5">
	<topic>froxlor -- database password information leak</topic>
	<affects>
	<package>
	<name>froxlor</name>
	<range><lt>0.9.33.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oss-security-list@demlak.de reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/238">
	<p>An unauthenticated remote attacker is able to get the database
	password via webaccess due to wrong file permissions of the /logs/
	folder in froxlor version 0.9.33.1 and earlier. The plain SQL
	password and username may be stored in the /logs/sql-error.log file.
	This directory is publicly reachable under the default
	configuration/setup.</p>
	</blockquote>
	<p>Note that froxlor 0.9.33.2 prevents future logging of passwords but
	does not retroactively remove passwords already logged. Michael
	Kaufmann, the Froxlor lead developer reports:</p>
	<blockquote cite="http://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/#entry30025">
	<p>Removing all .log files from the directory should do the job,
	alternatively just use the class.ConfigIO.php from Github</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5959</cvename>
	<freebsdpr>ports/202262</freebsdpr>
	<url>http://seclists.org/oss-sec/2015/q3/238</url>
	<url>https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/</url>
	</references>
	<dates>
	<discovery>2015-07-29</discovery>
	<entry>2015-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="83b38a2c-413e-11e5-bfcf-6805ca0b3d42">
	<topic>RT -- two XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
	</package>
	<package>
	<name>rt40</name>
	<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Best Practical reports:</p>
	<blockquote cite="http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html">
	<p>RT 4.0.0 and above are vulnerable to a cross-site
	scripting (XSS) attack via the user and group rights
	management pages. This vulnerability is assigned
	CVE-2015-5475. It was discovered and reported by Marcin
	Kopec at Data Reliance Shared Service Center.</p>
	<p>RT 4.2.0 and above are vulnerable to a cross-site
	scripting (XSS) attack via the cryptography interface.
	This vulnerability could allow an attacker with a
	carefully-crafted key to inject JavaScript into RT's user
	interface. Installations which use neither GnuPG nor
	S/MIME are unaffected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5475</cvename>
	<cvename>CVE-2015-6506</cvename>
	<url>http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html</url>
	</references>
	<dates>
	<discovery>2015-08-12</discovery>
	<entry>2015-08-12</entry>
	<modified>2015-08-18</modified>
	</dates>
	</vuln>

	<vuln vid="09fff0d9-4126-11e5-9f01-14dae9d210b8">
	<topic>py-foolscap -- local file inclusion</topic>
	<affects>
	<package>
	<name>py27-foolscap</name>
	<name>py32-foolscap</name>
	<name>py33-foolscap</name>
	<name>py34-foolscap</name>
	<range><lt>0.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Brian Warner reports:</p>
	<blockquote cite="https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS">
	<p>The "flappserver" feature was found to have a vulnerability in the
	service-lookup code which, when combined with an attacker who has the ability
	to write files to a location where the flappserver process could read them,
	would allow that attacker to obtain control of the flappserver process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS</url>
	<url>http://foolscap.lothar.com/trac/ticket/226</url>
	</references>
	<dates>
	<discovery>2014-09-23</discovery>
	<entry>2015-08-12</entry>
	</dates>
	</vuln>

	<vuln vid="42c98cef-62b1-4b8b-9065-f4621e08d526">
	<topic>libvpx -- out-of-bounds write</topic>
	<affects>
	<package>
	<name>libvpx</name>
	<range><lt>1.4.0</lt></range>
	</package>
	<package>
	<name>firefox</name>
	<range><lt>33.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.1.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>33.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.30</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.1.2</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.30</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.1.2</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2014-77/">
	<p>Using the Address Sanitizer tool, security researcher
	Abhishek Arya (Inferno) of the Google Chrome Security Team
	found an out-of-bounds write when buffering WebM format
	video containing frames with invalid tile sizes. This can
	lead to a potentially exploitable crash during WebM video
	playback.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1578</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-77/</url>
	<url>https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba</url>
	</references>
	<dates>
	<discovery>2014-10-14</discovery>
	<entry>2015-08-12</entry>
	</dates>
	</vuln>

	<vuln vid="f3778328-d288-4b39-86a4-65877331eaf7">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.508</lt></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.508</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-19.html">
	<p>Adobe has released security updates for Adobe Flash Player.
	These updates address critical vulnerabilities that could
	potentially allow an attacker to take control of the affected
	system.</p>
	<p>These updates resolve type confusion vulnerabilities that could
	lead to code execution (CVE-2015-5128, CVE-2015-5554,
	CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).</p>
	<p>These updates include further hardening to a mitigation
	introduced in version 18.0.0.209 to defend against vector
	length corruptions (CVE-2015-5125).</p>
	<p>These updates resolve use-after-free vulnerabilities that could
	lead to code execution (CVE-2015-5550, CVE-2015-5551,
	CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134,
	CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559,
	CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124,
	CVE-2015-5564).</p>
	<p>These updates resolve heap buffer overflow vulnerabilities
	that could lead to code execution (CVE-2015-5129,
	CVE-2015-5541).</p>
	<p>These updates resolve buffer overflow vulnerabilities that
	could lead to code execution (CVE-2015-5131, CVE-2015-5132,
	CVE-2015-5133).</p>
	<p>These updates resolve memory corruption vulnerabilities that
	could lead to code execution (CVE-2015-5544, CVE-2015-5545,
	CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549,
	CVE-2015-5552, CVE-2015-5553).</p>
	<p>These updates resolve an integer overflow vulnerability that
	could lead to code execution (CVE-2015-5560).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3107</cvename>
	<cvename>CVE-2015-5124</cvename>
	<cvename>CVE-2015-5125</cvename>
	<cvename>CVE-2015-5127</cvename>
	<cvename>CVE-2015-5128</cvename>
	<cvename>CVE-2015-5129</cvename>
	<cvename>CVE-2015-5130</cvename>
	<cvename>CVE-2015-5131</cvename>
	<cvename>CVE-2015-5132</cvename>
	<cvename>CVE-2015-5133</cvename>
	<cvename>CVE-2015-5134</cvename>
	<cvename>CVE-2015-5539</cvename>
	<cvename>CVE-2015-5540</cvename>
	<cvename>CVE-2015-5541</cvename>
	<cvename>CVE-2015-5544</cvename>
	<cvename>CVE-2015-5545</cvename>
	<cvename>CVE-2015-5546</cvename>
	<cvename>CVE-2015-5547</cvename>
	<cvename>CVE-2015-5548</cvename>
	<cvename>CVE-2015-5549</cvename>
	<cvename>CVE-2015-5550</cvename>
	<cvename>CVE-2015-5551</cvename>
	<cvename>CVE-2015-5552</cvename>
	<cvename>CVE-2015-5553</cvename>
	<cvename>CVE-2015-5554</cvename>
	<cvename>CVE-2015-5555</cvename>
	<cvename>CVE-2015-5556</cvename>
	<cvename>CVE-2015-5557</cvename>
	<cvename>CVE-2015-5558</cvename>
	<cvename>CVE-2015-5559</cvename>
	<cvename>CVE-2015-5560</cvename>
	<cvename>CVE-2015-5561</cvename>
	<cvename>CVE-2015-5562</cvename>
	<cvename>CVE-2015-5563</cvename>
	<cvename>CVE-2015-5564</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-19.html</url>
	</references>
	<dates>
	<discovery>2015-08-11</discovery>
	<entry>2015-08-12</entry>
	</dates>
	</vuln>

	<vuln vid="34e60332-2448-4ed6-93f0-12713749f250">
	<topic>libvpx -- multiple buffer overflows</topic>
	<affects>
	<package>
	<name>libvpx</name>
	<range><lt>1.4.0.488</lt></range>
	</package>
	<package>
	<name>firefox</name>
	<range><lt>40.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>40.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-89/">
	<p>Security researcher Abhishek Arya (Inferno) of the Google
	Chrome Security Team used the Address Sanitizer tool to
	discover two buffer overflow issues in the Libvpx library
	used for WebM video when decoding a malformed WebM video
	file. These buffer overflows result in potentially
	exploitable crashes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4485</cvename>
	<cvename>CVE-2015-4486</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-89/</url>
	</references>
	<dates>
	<discovery>2015-08-11</discovery>
	<entry>2015-08-11</entry>
	<modified>2015-08-14</modified>
	</dates>
	</vuln>

	<vuln vid="c66a5632-708a-4727-8236-d65b2d5b2739">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>40.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>40.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><ge>2.36</ge><lt>2.37</lt></range>
	<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
	<range><lt>2.35</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><ge>2.36</ge><lt>2.37</lt></range>
	<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
	<range><lt>2.35</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.2.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>38.2.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>38.2.0</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>38.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0
	/ rv:38.2)</p>
	<p>MFSA 2015-80 Out-of-bounds read with malformed MP3
	file</p>
	<p>MFSA 2015-81 Use-after-free in MediaStream playback</p>
	<p>MFSA 2015-82 Redefinition of non-configurable JavaScript object properties</p>
	<p>MFSA 2015-83 Overflow issues in libstagefright</p>
	<p>MFSA 2015-84 Arbitrary file overwriting through Mozilla
	Maintenance Service with hard links</p>
	<p>MFSA 2015-85 Out-of-bounds write with Updater and
	malicious MAR file</p>
	<p>MFSA 2015-86 Feed protocol with POST bypasses mixed
	content protections</p>
	<p>MFSA 2015-87 Crash when using shared memory in
	JavaScript</p>
	<p>MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling
	bitmap images</p>
	<p>MFSA 2015-90 Vulnerabilities found through code
	inspection</p>
	<p>MFSA 2015-91 Mozilla Content Security Policy allows for
	asterisk wildcards in violation of CSP specification</p>
	<p>MFSA 2015-92 Use-after-free in XMLHttpRequest with shared
	workers</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4473</cvename>
	<cvename>CVE-2015-4474</cvename>
	<cvename>CVE-2015-4475</cvename>
	<cvename>CVE-2015-4477</cvename>
	<cvename>CVE-2015-4478</cvename>
	<cvename>CVE-2015-4479</cvename>
	<cvename>CVE-2015-4480</cvename>
	<cvename>CVE-2015-4481</cvename>
	<cvename>CVE-2015-4482</cvename>
	<cvename>CVE-2015-4483</cvename>
	<cvename>CVE-2015-4484</cvename>
	<cvename>CVE-2015-4487</cvename>
	<cvename>CVE-2015-4488</cvename>
	<cvename>CVE-2015-4489</cvename>
	<cvename>CVE-2015-4490</cvename>
	<cvename>CVE-2015-4491</cvename>
	<cvename>CVE-2015-4492</cvename>
	<cvename>CVE-2015-4493</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-79/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-80/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-81/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-82/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-83/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-84/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-85/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-86/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-87/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-88/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-90/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-91/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-92/</url>
	</references>
	<dates>
	<discovery>2015-08-11</discovery>
	<entry>2015-08-11</entry>
	<modified>2015-08-22</modified>
	</dates>
	</vuln>

	<vuln vid="dd7f29cc-3ee9-11e5-93ad-002590263bf5">
	<topic>lighttpd -- Log injection vulnerability in mod_auth</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.36</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3200">
	<p>mod_auth in lighttpd before 1.4.36 allows remote attackers to
	inject arbitrary log entries via a basic HTTP authentication string
	without a colon character, as demonstrated by a string containing a
	NULL and new line character.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3200</cvename>
	<url>http://redmine.lighttpd.net/issues/2646</url>
	</references>
	<dates>
	<discovery>2015-05-25</discovery>
	<entry>2015-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="ff0acfb4-3efa-11e5-93ad-002590263bf5">
	<topic>pcre -- heap overflow vulnerability in '(?\|' situations</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><le>8.37_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Venustech ADLAB reports:</p>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1667">
	<p>PCRE library is prone to a vulnerability which leads to Heap
	Overflow. During the compilation of a malformed regular expression,
	more data is written on the malloced block than the expected size
	output by compile_regex. Exploits with advanced Heap Fengshui
	techniques may allow an attacker to execute arbitrary code in the
	context of the user running the affected application.</p>
	<p>Latest version of PCRE is prone to a Heap Overflow vulnerability
	which could caused by the following regular expression.</p>
	<p>/(?J:(?\|(:(?\|(?'R')(\k'R')\|((?'R')))H'Rk'Rf)\|s(?'R'))))/</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/202209</freebsdpr>
	<url>https://bugs.exim.org/show_bug.cgi?id=1667</url>
	</references>
	<dates>
	<discovery>2015-08-05</discovery>
	<entry>2015-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="8eee06d4-c21d-4f07-a669-455151ff426f">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>39.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>39.0.3,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>38.1.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-78 Same origin violation and local file
	stealing via PDF reader</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4495</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-78/</url>
	</references>
	<dates>
	<discovery>2015-08-06</discovery>
	<entry>2015-08-07</entry>
	</dates>
	</vuln>

	<vuln vid="ac5ec8e3-3c6c-11e5-b921-00a0986f28c4">
	<topic>wordpress -- Multiple vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.2.4,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gary Pendergast reports:</p>
	<blockquote cite="https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/">
	<p>WordPress 4.2.4 fixes three cross-site scripting vulnerabilities
	and a potential SQL injection that could be used to compromise a
	site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/</url>
	<cvename>CVE-2015-2213</cvename>
	<cvename>CVE-2015-5730</cvename>
	<cvename>CVE-2015-5731</cvename>
	<cvename>CVE-2015-5732</cvename>
	<cvename>CVE-2015-5733</cvename>
	<cvename>CVE-2015-5734</cvename>
	</references>
	<dates>
	<discovery>2015-08-04</discovery>
	<entry>2015-08-06</entry>
	<modified>2015-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="57bb5e3d-3c4f-11e5-a4d4-001e8c75030d">
	<topic>subversion -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.8.0</ge><lt>1.8.14</lt></range>
	<range><ge>1.7.0</ge><lt>1.7.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion reports:</p>
	<blockquote cite="http://svn.haxx.se/dev/archive-2015-08/0024.shtml">
	<p>CVE-2015-3184:<br/>
	Subversion's mod_authz_svn does not properly restrict anonymous access
	in some mixed anonymous/authenticated environments when
	using Apache httpd 2.4.</p>
	<p>CVE-2015-3187:<br/>
	Subversion servers, both httpd and svnserve, will reveal some
	paths that should be hidden by path-based authz.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3184</cvename>
	<url>http://subversion.apache.org/security/CVE-2015-3184-advisory.txt</url>
	<cvename>CVE-2015-3187</cvename>
	<url>http://subversion.apache.org/security/CVE-2015-3187-advisory.txt</url>
	</references>
	<dates>
	<discovery>2015-07-27</discovery>
	<entry>2015-08-06</entry>
	</dates>
	</vuln>

	<vuln vid="ae8c09cb-32da-11e5-a4a5-002590263bf5">
	<topic>elasticsearch -- directory traversal attack via snapshot API</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><ge>1.0.0</ge><lt>1.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0
	are vulnerable to a directory traversal attack.</p>
	<p>Remediation Summary: Users should upgrade to 1.6.1 or later, or
	constrain access to the snapshot API to trusted sources.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5531</cvename>
	<freebsdpr>ports/201834</freebsdpr>
	<url>https://www.elastic.co/community/security</url>
	</references>
	<dates>
	<discovery>2015-07-16</discovery>
	<entry>2015-08-05</entry>
	</dates>
	</vuln>

	<vuln vid="fb3668df-32d7-11e5-a4a5-002590263bf5">
	<topic>elasticsearch -- remote code execution via transport protocol</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><lt>1.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are
	vulnerable to an attack that can result in remote code execution.</p>
	<p>Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0.
	Alternately, ensure that only trusted applications have access to
	the transport protocol port.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5377</cvename>
	<freebsdpr>ports/201834</freebsdpr>
	<url>https://www.elastic.co/community/security</url>
	</references>
	<dates>
	<discovery>2015-07-16</discovery>
	<entry>2015-08-05</entry>
	</dates>
	</vuln>

	<vuln vid="da451130-365d-11e5-a4a5-002590263bf5">
	<topic>qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><le>0.11.1_20</le></range>
	<range><ge>0.12</ge><le>2.3.0_2</le></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.0_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-138.html">
	<p>A heap overflow flaw was found in the way QEMU's IDE subsystem
	handled I/O buffer access while processing certain ATAPI
	commands.</p>
	<p>A privileged guest user in a guest with CDROM drive enabled could
	potentially use this flaw to execute arbitrary code on the host
	with the privileges of the host's QEMU process corresponding to
	the guest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5154</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-138.html</url>
	<url>http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28</url>
	</references>
	<dates>
	<discovery>2015-07-27</discovery>
	<entry>2015-08-04</entry>
	<modified>2015-08-19</modified>
	</dates>
	</vuln>

	<vuln vid="4622635f-37a1-11e5-9970-14dae9d210b8">
	<topic>net-snmp -- snmptrapd crash</topic>
	<affects>
	<package>
	<name>net-snmp</name>
	<range><ge>5.7.0</ge><le>5.7.2.1</le></range>
	<range><ge>5.6.0</ge><le>5.6.2.1</le></range>
	<range><ge>5.5.0</ge><le>5.5.2.1</le></range>
	<range><ge>5.4.0</ge><le>5.4.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Murray McAllister reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2014/q3/473">
	<p>A remote denial-of-service flaw was found in the way
	snmptrapd handled certain SNMP traps when started with the
	"-OQ" option. If an attacker sent an SNMP trap containing a
	variable with a NULL type where an integer variable type was
	expected, it would cause snmptrapd to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2014/q3/473</url>
	<url>http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/</url>
	<url>https://sourceforge.net/p/net-snmp/official-patches/48/</url>
	<cvename>CVE-2014-3565</cvename>
	</references>
	<dates>
	<discovery>2014-07-31</discovery>
	<entry>2015-07-31</entry>
	</dates>
	</vuln>

	<vuln vid="381183e8-3798-11e5-9970-14dae9d210b8">
	<topic>net-snmp -- snmp_pdu_parse() function incomplete initialization</topic>
	<affects>
	<package>
	<name>net-snmp</name>
	<range><le>5.7.3_7</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Qinghao Tang reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/116">
	<p>Incompletely initialized vulnerability exists in the function
	‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory
	leak, DOS and possible command executions by sending malicious packets.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q2/116</url>
	<url>http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1212408</url>
	<cvename>CVE-2015-5621</cvename>
	</references>
	<dates>
	<discovery>2015-04-11</discovery>
	<entry>2015-07-31</entry>
	</dates>
	</vuln>

	<vuln vid="731cdeaa-3564-11e5-9970-14dae9d210b8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind910</name>
	<range><lt>9.10.2P3</lt></range>
	</package>
	<package>
	<name>bind99</name>
	<range><lt>9.9.7P2</lt></range>
	</package>
	<package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_21</lt></range>
	<range><ge>8.4</ge><lt>8.4_35</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01272/">
	<p>An error in the handling of TKEY queries can be exploited
	by an attacker for use as a denial-of-service vector, as a constructed
	packet can use the defect to trigger a REQUIRE assertion failure,
	causing BIND to exit.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:17.bind</freebsdsa>
	<cvename>CVE-2015-5477</cvename>
	<url>https://kb.isc.org/article/AA-01272/</url>
	</references>
	<dates>
	<discovery>2015-07-21</discovery>
	<entry>2015-07-28</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="5b74a5bc-348f-11e5-ba05-c80aa9043978">
	<topic>OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><lt>6.9.p1_2,1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_21</lt></range>
	<range><ge>8.4</ge><lt>8.4_36</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2015-5600">
	<p>It was discovered that the OpenSSH sshd daemon did not check the
	list of keyboard-interactive authentication methods for duplicates.
	A remote attacker could use this flaw to bypass the MaxAuthTries
	limit, making it easier to perform password guessing attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://access.redhat.com/security/cve/CVE-2015-5600</url>
	<cvename>CVE-2015-5600</cvename>
	<freebsdsa>SA-15:16.openssh</freebsdsa>
	</references>
	<dates>
	<discovery>2015-07-21</discovery>
	<entry>2015-07-27</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="c470bcc7-33fe-11e5-a4a5-002590263bf5">
	<topic>logstash -- SSL/TLS vulnerability with Lumberjack input</topic>
	<affects>
	<package>
	<name>logstash</name>
	<range><lt>1.4.4</lt></range>
	<range><ge>1.5.0</ge><lt>1.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: All Logstash versions prior to 1.5.2 that
	use Lumberjack input (in combination with Logstash Forwarder agent)
	are vulnerable to a SSL/TLS security issue called the FREAK attack.
	This allows an attacker to intercept communication and access secure
	data. Users should upgrade to 1.5.3 or 1.4.4.</p>
	<p>Remediation Summary: Users that do not want to upgrade can address
	the vulnerability by disabling the Lumberjack input.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5378</cvename>
	<url>https://www.elastic.co/community/security</url>
	</references>
	<dates>
	<discovery>2015-07-22</discovery>
	<entry>2015-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="9d732078-32c7-11e5-b263-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>44.0.2403.89</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-npapi</name>
	<range><lt>44.0.2403.89</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-pulse</name>
	<range><lt>44.0.2403.89</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/">
	<p>43 security fixes in this release, including:</p>
	<ul>
	<li>[446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium.
	Credit to cloudfuzzer.</li>
	<li>[459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium.
	Credit to makosoft.</li>
	<li>[461858] High CVE-2015-1274: Settings allowed executable files
	to run immediately after download. Credit to andrewm.bpi.</li>
	<li>[462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit
	to WangTao(neobyte) of Baidu X-Team.</li>
	<li>[472614] High CVE-2015-1276: Use-after-free in IndexedDB.
	Credit to Collin Payne.</li>
	<li>[483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium.
	Credit to mlafon.</li>
	<li>[486947] High CVE-2015-1280: Memory corruption in skia. Credit
	to cloudfuzzer.</li>
	<li>[487155] High CVE-2015-1281: CSP bypass. Credit to Masato
	Kinugawa.</li>
	<li>[487928] High CVE-2015-1282: Use-after-free in pdfium. Credit
	to Chamal de Silva.</li>
	<li>[492052] High CVE-2015-1283: Heap-buffer-overflow in expat.
	Credit to sidhpurwala.huzaifa.</li>
	<li>[493243] High CVE-2015-1284: Use-after-free in blink. Credit to
	Atte Kettunen of OUSPG.</li>
	<li>[504011] High CVE-2015-1286: UXSS in blink. Credit to
	anonymous.</li>
	<li>[505374] High CVE-2015-1290: Memory corruption in V8. Credit to
	Yongjun Liu of NSFOCUS Security Team.</li>
	<li>[419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to
	filedescriptor.</li>
	<li>[444573] Medium CVE-2015-1270: Uninitialized memory read in
	ICU. Credit to Atte Kettunen of OUSPG.</li>
	<li>[451456] Medium CVE-2015-1272: Use-after-free related to
	unexpected GPU process termination. Credit to Chamal de
	Silva.</li>
	<li>[479743] Medium CVE-2015-1277: Use-after-free in accessibility.
	Credit to SkyLined.</li>
	<li>[482380] Medium CVE-2015-1278: URL spoofing using pdf files.
	Credit to Chamal de Silva.</li>
	<li>[498982] Medium CVE-2015-1285: Information leak in XSS auditor.
	Credit to gazheyes.</li>
	<li>[479162] Low CVE-2015-1288: Spell checking dictionaries fetched
	over HTTP. Credit to mike@michaelruddy.com.</li>
	<li>[512110] CVE-2015-1289: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1270</cvename>
	<cvename>CVE-2015-1271</cvename>
	<cvename>CVE-2015-1272</cvename>
	<cvename>CVE-2015-1273</cvename>
	<cvename>CVE-2015-1274</cvename>
	<cvename>CVE-2015-1275</cvename>
	<cvename>CVE-2015-1276</cvename>
	<cvename>CVE-2015-1277</cvename>
	<cvename>CVE-2015-1278</cvename>
	<cvename>CVE-2015-1279</cvename>
	<cvename>CVE-2015-1280</cvename>
	<cvename>CVE-2015-1281</cvename>
	<cvename>CVE-2015-1282</cvename>
	<cvename>CVE-2015-1283</cvename>
	<cvename>CVE-2015-1284</cvename>
	<cvename>CVE-2015-1285</cvename>
	<cvename>CVE-2015-1286</cvename>
	<cvename>CVE-2015-1287</cvename>
	<cvename>CVE-2015-1288</cvename>
	<cvename>CVE-2015-1289</cvename>
	<cvename>CVE-2015-1290</cvename>
	<url>http://googlechromereleases.blogspot.nl/</url>
	</references>
	<dates>
	<discovery>2015-07-21</discovery>
	<entry>2015-07-25</entry>
	</dates>
	</vuln>

	<vuln vid="b202e4ce-3114-11e5-aa32-0026551a22dc">
	<topic>shibboleth-sp -- DoS vulnerability</topic>
	<affects>
	<package>
	<name>xmltooling</name>
	<range><lt>1.5.5</lt></range>
	</package>
	<package>
	<name>opensaml2</name>
	<range><lt>2.5.5</lt></range>
	</package>
	<package>
	<name>shibboleth-sp</name>
	<range><lt>2.5.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Shibboleth consortium reports:</p>
	<blockquote cite="http://shibboleth.net/community/advisories/secadv_20150721.txt">
	<p>
	Shibboleth SP software crashes on well-formed but invalid XML.
	</p>
	<p>
	The Service Provider software contains a code path with an uncaught
	exception that can be triggered by an unauthenticated attacker by
	supplying well-formed but schema-invalid XML in the form of SAML
	metadata or SAML protocol messages. The result is a crash and so
	causes a denial of service.
	</p>
	<p>
	You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or
	later. The easiest way to do so is to update the whole chain including
	shibboleth-2.5.5 an opensaml2.5.5.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://shibboleth.net/community/advisories/secadv_20150721.txt</url>
	<cvename>CVE-2015-2684</cvename>
	</references>
	<dates>
	<discovery>2015-07-21</discovery>
	<entry>2015-07-23</entry>
	</dates>
	</vuln>

	<vuln vid="c80b27a2-3165-11e5-8a1d-14dae9d210b8">
	<topic>wordpress -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.2.3,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gary Pendergast reports:</p>
	<blockquote cite="https://wordpress.org/news/2015/07/wordpress-4-2-3/">
	<p>WordPress versions 4.2.2 and earlier are affected by a
	cross-site scripting vulnerability, which could allow users with the
	Contributor or Author role to compromise a site. This was reported by
	Jon Cave and fixed by Robert Chapin, both of the WordPress security
	team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2015/07/wordpress-4-2-3/</url>
	<cvename>CVE-2015-5622</cvename>
	<cvename>CVE-2015-5623</cvename>
	</references>
	<dates>
	<discovery>2015-07-23</discovery>
	<entry>2015-07-23</entry>
	<modified>2015-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="4caf01e2-30e6-11e5-a4a5-002590263bf5">
	<topic>libidn -- out-of-bounds read issue with invalid UTF-8 input</topic>
	<affects>
	<package>
	<name>libidn</name>
	<range><lt>1.31</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Josefsson reports:</p>
	<blockquote cite="http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31">
	<p>stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function
	has always been documented to not validate that the input UTF-8
	string is actually valid UTF-8...
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2059</cvename>
	<url>http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31</url>
	</references>
	<dates>
	<discovery>2015-02-09</discovery>
	<entry>2015-07-23</entry>
	<modified>2015-08-03</modified>
	</dates>
	</vuln>

	<vuln vid="9dd761ff-30cb-11e5-a4a5-002590263bf5">
	<topic>sox -- memory corruption vulnerabilities</topic>
	<affects>
	<package>
	<name>sox</name>
	<range><le>14.4.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michele Spagnuolo, Google Security Team, reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/167">
	<p>The write heap buffer overflows are related to ADPCM handling in
	WAV files, while the read heap buffer overflow is while opening a
	.VOC.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://seclists.org/oss-sec/2015/q3/167</url>
	</references>
	<dates>
	<discovery>2015-07-22</discovery>
	<entry>2015-07-23</entry>
	</dates>
	</vuln>

	<vuln vid="92cda470-30cb-11e5-a4a5-002590263bf5">
	<topic>sox -- input sanitization errors</topic>
	<affects>
	<package>
	<name>sox</name>
	<range><lt>14.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-010.html">
	<p>The sox command line tool is affected by two heap-based buffer
	overflows, respectively located in functions start_read() and
	AdpcmReadBlock().</p>
	<p>A specially crafted wav file can be used to trigger the
	vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>71774</bid>
	<cvename>CVE-2014-8145</cvename>
	<url>http://www.ocert.org/advisories/ocert-2014-010.html</url>
	</references>
	<dates>
	<discovery>2014-11-20</discovery>
	<entry>2015-07-23</entry>
	</dates>
	</vuln>

	<vuln vid="95eee71d-3068-11e5-a9b5-bcaec565249c">
	<topic>gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs</topic>
	<affects>
	<package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.31.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>gustavo.grieco@imag.fr reports:</p>
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
	<p>We found a heap overflow and a DoS in the gdk-pixbuf
	implementation triggered by the scaling of a malformed bmp.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
	</references>
	<dates>
	<discovery>2015-07-12</discovery>
	<entry>2015-07-22</entry>
	</dates>
	</vuln>

	<vuln vid="8a1d0e63-1e07-11e5-b43d-002590263bf5">
	<topic>pcre -- Heap Overflow Vulnerability in find_fixedlength()</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><le>8.37_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Venustech ADLAB reports:</p>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1651">
	<p>PCRE library is prone to a vulnerability which leads to Heap
	Overflow. During subpattern calculation of a malformed regular
	expression, an offset that is used as an array index is fully
	controlled and can be large enough so that unexpected heap
	memory regions are accessed.</p>
	<p>One could at least exploit this issue to read objects nearby of
	the affected application's memory.</p>
	<p>Such information disclosure may also be used to bypass memory
	protection method such as ASLR.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5073</cvename>
	<url>https://bugs.exim.org/show_bug.cgi?id=1651</url>
	<url>http://vcs.pcre.org/pcre?view=revision&revision=1571</url>
	<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/1</mlist>
	</references>
	<dates>
	<discovery>2015-06-23</discovery>
	<entry>2015-06-29</entry>
	</dates>
	</vuln>

	<vuln vid="0bfda05f-2e6f-11e5-a4a5-002590263bf5">
	<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.8e</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cacti Group, Inc. reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8e.php">
	<p>Important Security Fixes</p>
	<ul>
	<li>Multiple XSS and SQL injection vulnerabilities</li>
	<li>CVE-2015-4634 - SQL injection in graphs.php</li>
	</ul>
	<p>Changelog</p>
	<ul>
	<li>bug: Fixed various SQL Injection vectors</li>
	<li>bug#0002574: SQL Injection Vulnerabilities in graph items and
	graph template items</li>
	<li>bug#0002577: CVE-2015-4634 - SQL injection in graphs.php</li>
	<li>bug#0002579: SQL Injection Vulnerabilities in data sources</li>
	<li>bug#0002580: SQL Injection in cdef.php</li>
	<li>bug#0002582: SQL Injection in data_templates.php</li>
	<li>bug#0002583: SQL Injection in graph_templates.php</li>
	<li>bug#0002584: SQL Injection in host_templates.php</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4634</cvename>
	<freebsdpr>ports/201702</freebsdpr>
	<url>http://www.cacti.net/release_notes_0_8_8e.php</url>
	<mlist>http://seclists.org/oss-sec/2015/q3/150</mlist>
	</references>
	<dates>
	<discovery>2015-07-12</discovery>
	<entry>2015-07-20</entry>
	</dates>
	</vuln>

	<vuln vid="8b1f53f3-2da5-11e5-86ff-14dae9d210b8">
	<topic>php-phar -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php56-phar</name>
	<range><lt>5.6.11</lt></range>
	</package>
	<package>
	<name>php55-phar</name>
	<range><lt>5.5.27</lt></range>
	</package>
	<package>
	<name>php5-phar</name>
	<range><lt>5.4.43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/141">
	<p>Segfault in Phar::convertToData on invalid file.</p>
	<p>Buffer overflow and stack smashing error in phar_fix_filepath.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://seclists.org/oss-sec/2015/q3/141</mlist>
	<url>https://bugs.php.net/bug.php?id=69958</url>
	<url>http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf</url>
	<url>https://bugs.php.net/bug.php?id=69923</url>
	<url>http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f</url>
	<cvename>CVE-2015-5589</cvename>
	<cvename>CVE-2015-5590</cvename>
	</references>
	<dates>
	<discovery>2015-06-24</discovery>
	<entry>2015-07-18</entry>
	<modified>2015-12-18</modified>
	</dates>
	</vuln>

	<vuln vid="43891162-2d5e-11e5-a4a5-002590263bf5">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle27</name>
	<range><lt>2.7.9</lt></range>
	</package>
	<package>
	<name>moodle28</name>
	<range><lt>2.8.7</lt></range>
	</package>
	<package>
	<name>moodle29</name>
	<range><lt>2.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marina Glancy reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/94">
	<p>MSA-15-0026: Possible phishing when redirecting to external site
	using referer header. (CVE-2015-3272)</p>
	<p>MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not
	respected when using 'Post a copy to all groups' in forum
	(CVE-2015-3273)</p>
	<p>MSA-15-0028: Possible XSS through custom text profile fields in Web
	Services (CVE-2015-3274)</p>
	<p>MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3272</cvename>
	<cvename>CVE-2015-3273</cvename>
	<cvename>CVE-2015-3274</cvename>
	<cvename>CVE-2015-3275</cvename>
	<mlist>http://seclists.org/oss-sec/2015/q3/94</mlist>
	<url>https://docs.moodle.org/dev/Moodle_2.7.9_release_notes</url>
	<url>https://docs.moodle.org/dev/Moodle_2.8.7_release_notes</url>
	<url>https://docs.moodle.org/dev/Moodle_2.9.1_release_notes</url>
	</references>
	<dates>
	<discovery>2015-07-06</discovery>
	<entry>2015-07-18</entry>
	<modified>2015-07-19</modified>
	</dates>
	</vuln>

	<vuln vid="29083f8e-2ca8-11e5-86ff-14dae9d210b8">
	<topic>apache22 -- chunk header parsing defect</topic>
	<affects>
	<package>
	<name>apache22</name>
	<name>apache22-event-mpm</name>
	<name>apache22-itk-mpm</name>
	<name>apache22-peruser-mpm</name>
	<name>apache22-worker-mpm</name>
	<range><le>2.2.29_5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Foundation reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
	<p>CVE-2015-3183 core: Fix chunk header parsing defect. Remove
	apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN
	filter, parse chunks in a single pass with zero copy. Limit accepted
	chunk-size to 2^63-1 and be strict about chunk-ext authorized
	characters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
	<url>https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e</url>
	<cvename>CVE-2015-3183</cvename>
	</references>
	<dates>
	<discovery>2015-06-24</discovery>
	<entry>2015-07-17</entry>
	</dates>
	</vuln>

	<vuln vid="5c399624-2bef-11e5-86ff-14dae9d210b8">
	<topic>zenphoto -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>zenphoto</name>
	<range><lt>1.4.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>zenphoto reports:</p>
	<blockquote cite="http://www.zenphoto.org/news/zenphoto-1.4.9">
	<p>Fixes several SQL Injection, XSS and path traversal
	security issues</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.zenphoto.org/news/zenphoto-1.4.9</url>
	<mlist>http://seclists.org/oss-sec/2015/q3/123</mlist>
	<url>https://github.com/zenphoto/zenphoto/pull/935</url>
	<cvename>CVE-2015-5591</cvename>
	<cvename>CVE-2015-5592</cvename>
	<cvename>CVE-2015-5593</cvename>
	<cvename>CVE-2015-5594</cvename>
	<cvename>CVE-2015-5595</cvename>
	</references>
	<dates>
	<discovery>2015-05-24</discovery>
	<entry>2015-07-16</entry>
	<modified>2015-07-18</modified>
	</dates>
	</vuln>

	<vuln vid="67b3fef2-2bea-11e5-86ff-14dae9d210b8">
	<topic>groovy -- remote execution of untrusted code</topic>
	<affects>
	<package>
	<name>groovy</name>
	<range><ge>1.7.0</ge><lt>2.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cédric Champeau reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/121">
	<p>Description</p>
	<p>When an application has Groovy on the classpath and that
	it uses standard Java serialization mechanism to communicate
	between servers, or to store local data, it is possible for
	an attacker to bake a special serialized object that will
	execute code directly when deserialized. All applications
	which rely on serialization and do not isolate the code which
	deserializes objects are subject to this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://seclists.org/oss-sec/2015/q3/121</mlist>
	<url>http://groovy-lang.org/security.html</url>
	<url>https://issues.apache.org/jira/browse/GROOVY-7504</url>
	<cvename>CVE-2015-3253</cvename>
	</references>
	<dates>
	<discovery>2015-07-09</discovery>
	<entry>2015-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="a928960a-2bdc-11e5-86ff-14dae9d210b8">
	<topic>libav -- divide by zero</topic>
	<affects>
	<package>
	<name>libav</name>
	<range><le>11.3_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Agostino Sarubbo reports:</p>
	<blockquote cite="https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/">
	<p>libav: divide-by-zero in ff_h263_decode_mba()</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/</url>
	<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f</url>
	<cvename>CVE-2015-5479</cvename>
	</references>
	<dates>
	<discovery>2015-06-21</discovery>
	<entry>2015-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="44d9daee-940c-4179-86bb-6e3ffd617869">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>39.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>39.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
	<range><lt>2.35</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
	<range><lt>2.35</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.8.0,1</lt></range>
	<range><ge>38.0,1</ge><lt>38.1.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.8.0</lt></range>
	<range><ge>38.0</ge><lt>38.1.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.8.0</lt></range>
	<range><ge>38.0</ge><lt>38.1.0</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.8.0</lt></range>
	<range><ge>38.0</ge><lt>38.1.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0
	/ rv:31.8 / rv:38.1)</p>
	<p>MFSA 2015-60 Local files or privileged URLs in pages can
	be opened into new tabs</p>
	<p>MFSA 2015-61 Type confusion in Indexed Database
	Manager</p>
	<p>MFSA 2015-62 Out-of-bound read while computing an
	oscillator rendering range in Web Audio</p>
	<p>MFSA 2015-63 Use-after-free in Content Policy due to
	microtask execution error</p>
	<p>MFSA 2015-64 ECDSA signature validation fails to handle
	some signatures correctly</p>
	<p>MFSA 2015-65 Use-after-free in workers while using
	XMLHttpRequest</p>
	<p>MFSA 2015-66 Vulnerabilities found through code
	inspection</p>
	<p>MFSA 2015-67 Key pinning is ignored when overridable
	errors are encountered</p>
	<p>MFSA 2015-68 OS X crash reports may contain entered key
	press information</p>
	<p>MFSA 2015-69 Privilege escalation through internal
	workers</p>
	<p>MFSA 2015-70 NSS accepts export-length DHE keys with
	regular DHE cipher suites</p>
	<p>MFSA 2015-71 NSS incorrectly permits skipping of
	ServerKeyExchange</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2721</cvename>
	<cvename>CVE-2015-2722</cvename>
	<cvename>CVE-2015-2724</cvename>
	<cvename>CVE-2015-2725</cvename>
	<cvename>CVE-2015-2726</cvename>
	<cvename>CVE-2015-2727</cvename>
	<cvename>CVE-2015-2728</cvename>
	<cvename>CVE-2015-2729</cvename>
	<cvename>CVE-2015-2730</cvename>
	<cvename>CVE-2015-2731</cvename>
	<cvename>CVE-2015-2733</cvename>
	<cvename>CVE-2015-2734</cvename>
	<cvename>CVE-2015-2735</cvename>
	<cvename>CVE-2015-2736</cvename>
	<cvename>CVE-2015-2737</cvename>
	<cvename>CVE-2015-2738</cvename>
	<cvename>CVE-2015-2739</cvename>
	<cvename>CVE-2015-2740</cvename>
	<cvename>CVE-2015-2741</cvename>
	<cvename>CVE-2015-2742</cvename>
	<cvename>CVE-2015-2743</cvename>
	<cvename>CVE-2015-4000</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-59/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-60/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-61/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-62/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-63/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-64/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-65/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-66/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-67/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-68/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-69/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-70/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-71/</url>
	</references>
	<dates>
	<discovery>2015-07-02</discovery>
	<entry>2015-07-16</entry>
	<modified>2015-09-22</modified>
	</dates>
	</vuln>

	<vuln vid="d3216606-2b47-11e5-a668-080027ef73ec">
	<topic>PolarSSL -- Security Fix Backports</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><lt>1.2.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Paul Bakker reports:</p>
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released">
	<p>PolarSSL 1.2.14 fixes one remotely-triggerable issues that was
	found by the Codenomicon Defensics tool, one potential remote crash
	and countermeasures against the "Lucky 13 strikes back" cache-based
	attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released</url>
	</references>
	<dates>
	<discovery>2015-06-26</discovery>
	<entry>2015-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="ca139c7f-2a8c-11e5-a4a5-002590263bf5">
	<topic>libwmf -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libwmf</name>
	<range><lt>0.2.8.4_14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941">
	<p>Multiple buffer overflows in the gd graphics library (libgd) 2.0.21
	and earlier may allow remote attackers to execute arbitrary code via
	malformed image files that trigger the overflows due to improper
	calls to the gdMalloc function, a different set of vulnerabilities
	than CVE-2004-0990.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455">
	<p>Buffer overflow in the gdImageStringFTEx function in gdft.c in GD
	Graphics Library 2.0.33 and earlier allows remote attackers to cause
	a denial of service (application crash) and possibly execute
	arbitrary code via a crafted string with a JIS encoded font.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">
	<p>The gdPngReadData function in libgd 2.0.34 allows user-assisted
	attackers to cause a denial of service (CPU consumption) via a
	crafted PNG image with truncated data, which causes an infinite loop
	in the png_read_info function in libpng.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472">
	<p>Integer overflow in gdImageCreateTrueColor function in the GD
	Graphics Library (libgd) before 2.0.35 allows user-assisted remote
	attackers to have unspecified attack vectors and impact.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473">
	<p>The gdImageCreateXbm function in the GD Graphics Library (libgd)
	before 2.0.35 allows user-assisted remote attackers to cause a
	denial of service (crash) via unspecified vectors involving a
	gdImageCreate failure.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477">
	<p>The (a) imagearc and (b) imagefilledarc functions in GD Graphics
	Library (libgd) before 2.0.35 allow attackers to cause a denial of
	service (CPU consumption) via a large (1) start or (2) end angle
	degree value.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
	<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before
	5.3.1, and the GD Graphics Library 2.x, does not properly verify a
	certain colorsTotal structure member, which might allow remote
	attackers to conduct buffer overflow or buffer over-read attacks via
	a crafted GD file, a different vulnerability than CVE-2009-3293.
	NOTE: some of these details are obtained from third party
	information.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848">
	<p>Heap-based buffer overflow in libwmf 0.2.8.4 allows remote
	attackers to cause a denial of service (crash) or possibly execute
	arbitrary code via a crafted BMP image.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695">
	<p>meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial
	of service (out-of-bounds read) via a crafted WMF file.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696">
	<p>Use-after-free vulnerability in libwmf 0.2.8.4 allows remote
	attackers to cause a denial of service (crash) via a crafted WMF
	file to the (1) wmf2gd or (2) wmf2eps command.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588">
	<p>Heap-based buffer overflow in the DecodeImage function in libwmf
	0.2.8.4 allows remote attackers to cause a denial of service (crash)
	or possibly execute arbitrary code via a crafted "run-length count"
	in an image in a WMF file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>11663</bid>
	<bid>22289</bid>
	<bid>24089</bid>
	<bid>24651</bid>
	<bid>36712</bid>
	<freebsdpr>ports/201513</freebsdpr>
	<cvename>CVE-2004-0941</cvename>
	<cvename>CVE-2007-0455</cvename>
	<cvename>CVE-2007-2756</cvename>
	<cvename>CVE-2007-3472</cvename>
	<cvename>CVE-2007-3473</cvename>
	<cvename>CVE-2007-3477</cvename>
	<cvename>CVE-2009-3546</cvename>
	<cvename>CVE-2015-0848</cvename>
	<cvename>CVE-2015-4695</cvename>
	<cvename>CVE-2015-4696</cvename>
	<cvename>CVE-2015-4588</cvename>
	</references>
	<dates>
	<discovery>2004-10-12</discovery>
	<entry>2015-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="a12494c1-2af4-11e5-86ff-14dae9d210b8">
	<topic>apache24 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jim Jagielski reports:</p>
	<blockquote cite="https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E">
	<p>CVE-2015-3183 (cve.mitre.org)
	core: Fix chunk header parsing defect.
	Remove apr_brigade_flatten(), buffering and duplicated code from
	the HTTP_IN filter, parse chunks in a single pass with zero copy.
	Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
	authorized characters.</p>
	<p>CVE-2015-3185 (cve.mitre.org)
	Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
	with new ap_some_authn_required and ap_force_authn hook.</p>
	<p>CVE-2015-0253 (cve.mitre.org)
	core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
	with the INCLUDES filter active, introduced in 2.4.11. PR 57531.</p>
	<p>CVE-2015-0228 (cve.mitre.org)
	mod_lua: A maliciously crafted websockets PING after a script
	calls r:wsupgrade() can cause a child process crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E</mlist>
	<cvename>CVE-2015-3183</cvename>
	<cvename>CVE-2015-3185</cvename>
	<cvename>CVE-2015-0253</cvename>
	<cvename>CVE-2015-0228</cvename>
	</references>
	<dates>
	<discovery>2015-02-04</discovery>
	<entry>2015-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="8d2d6bbd-2a02-11e5-a0af-bcaec565249c">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.491</lt></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.491</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-18.html">
	<p>Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have
	been identified. Successful exploitation could cause a crash
	and potentially allow an attacker to take control of the
	affected system. Adobe is aware of reports that exploits
	targeting these vulnerabilities have been published publicly.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5122</cvename>
	<cvename>CVE-2015-5123</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-18.html</url>
	</references>
	<dates>
	<discovery>2015-07-10</discovery>
	<entry>2015-07-14</entry>
	<modified>2015-07-16</modified>
	</dates>
	</vuln>

	<vuln vid="3d39e927-29a2-11e5-86ff-14dae9d210b8">
	<topic>php -- use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>php56-sqlite3</name>
	<range><lt>5.6.11</lt></range>
	</package>
	<package>
	<name>php55-sqlite3</name>
	<range><lt>5.5.27</lt></range>
	</package>
	<package>
	<name>php5-sqlite3</name>
	<range><lt>5.4.43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Symeon Paraschoudis reports:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=69972">
	<p>Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=69972</url>
	</references>
	<dates>
	<discovery>2015-06-30</discovery>
	<entry>2015-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="af7fbd91-29a1-11e5-86ff-14dae9d210b8">
	<topic>php -- use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>php56</name>
	<range><lt>5.6.11</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><lt>5.5.27</lt></range>
	</package>
	<package>
	<name>php5</name>
	<range><lt>5.4.43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Symeon Paraschoudis reports:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=69970">
	<p>Use-after-free vulnerability in spl_recursive_it_move_forward_ex()</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=69970</url>
	</references>
	<dates>
	<discovery>2015-06-30</discovery>
	<entry>2015-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="5a1d5d74-29a0-11e5-86ff-14dae9d210b8">
	<topic>php -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>php56</name>
	<range><lt>5.6.11</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><lt>5.5.27</lt></range>
	</package>
	<package>
	<name>php5</name>
	<range><lt>5.4.43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cmb reports:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=69768">
	<p>When delayed variable substitution is enabled (can be set in the
	Registry, for instance), !ENV! works similar to %ENV%, and the
	value of the environment variable ENV will be subsituted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=69768</url>
	</references>
	<dates>
	<discovery>2015-06-07</discovery>
	<entry>2015-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="36bd352d-299b-11e5-86ff-14dae9d210b8">
	<topic>mysql -- SSL Downgrade</topic>
	<affects>
	<package>
	<name>php56-mysql</name>
	<name>php56-mysqli</name>
	<range><lt>5.6.11</lt></range>
	</package>
	<package>
	<name>php55-mysql</name>
	<name>php55-mysqli</name>
	<range><lt>5.5.27</lt></range>
	</package>
	<package>
	<name>php5-mysql</name>
	<name>php5-mysqli</name>
	<range><lt>5.4.43</lt></range>
	</package>
	<package>
	<name>mariadb55-client</name>
	<range><lt>5.5.44</lt></range>
	</package>
	<package>
	<name>mariadb100-client</name>
	<range><lt>10.0.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Duo Security reports:</p>
	<blockquote cite="https://www.duosecurity.com/blog/backronym-mysql-vulnerability">
	<p>Researchers have identified a serious vulnerability in some
	versions of Oracle’s MySQL database product that allows an attacker to
	strip SSL/TLS connections of their security wrapping transparently.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=69669</url>
	<url>https://www.duosecurity.com/blog/backronym-mysql-vulnerability</url>
	<url>http://www.ocert.org/advisories/ocert-2015-003.html</url>
	<url>https://mariadb.atlassian.net/browse/MDEV-7937</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/</url>
	<url>https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/</url>
	<cvename>CVE-2015-3152</cvename>
	</references>
	<dates>
	<discovery>2015-03-20</discovery>
	<entry>2015-07-13</entry>
	<modified>2015-07-18</modified>
	</dates>
	</vuln>

	<vuln vid="81326883-2905-11e5-a4a5-002590263bf5">
	<topic>devel/ipython -- CSRF possible remote execution vulnerability</topic>
	<affects>
	<package>
	<name>ipython</name>
	<range><ge>0.12</ge><lt>3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kyle Kelley reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/92">
	<p>Summary: POST requests exposed via the IPython REST API are
	vulnerable to cross-site request forgery (CSRF). Web pages on
	different domains can make non-AJAX POST requests to known IPython
	URLs, and IPython will honor them. The user's browser will
	automatically send IPython cookies along with the requests. The
	response is blocked by the Same-Origin Policy, but the request
	isn't.</p>
	<p>API paths with issues:</p>
	<ul>
	<li>POST /api/contents/<path>/<file></li>
	<li>POST /api/contents/<path>/<file>/checkpoints</li>
	<li>POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id></li>
	<li>POST /api/kernels</li>
	<li>POST /api/kernels/<kernel_id>/<action></li>
	<li>POST /api/sessions</li>
	<li>POST /api/clusters/<cluster_id>/<action></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5607</cvename>
	<url>http://seclists.org/oss-sec/2015/q3/92</url>
	<url>http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1</url>
	</references>
	<dates>
	<discovery>2015-07-12</discovery>
	<entry>2015-07-13</entry>
	<modified>2015-07-22</modified>
	</dates>
	</vuln>

	<vuln vid="379788f3-2900-11e5-a4a5-002590263bf5">
	<topic>freeradius -- insufficient CRL application vulnerability</topic>
	<affects>
	<package>
	<name>freeradius2</name>
	<range><lt>2.2.8</lt></range>
	</package>
	<package>
	<name>freeradius3</name>
	<range><lt>3.0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-008.html">
	<p>The FreeRADIUS server relies on OpenSSL to perform certificate
	validation, including Certificate Revocation List (CRL) checks. The
	FreeRADIUS usage of OpenSSL, in CRL application, limits the checks
	to leaf certificates, therefore not detecting revocation of
	intermediate CA certificates.</p>
	<p>An unexpired client certificate, issued by an intermediate CA with
	a revoked certificate, is therefore accepted by FreeRADIUS.</p>
	<p>Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
	certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL
	for CRL checks on the complete trust chain.</p>
	<p>The FreeRADIUS project advises that the recommended configuration
	is to use self-signed CAs for all EAP-TLS methods.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4680</cvename>
	<freebsdpr>ports/201058</freebsdpr>
	<freebsdpr>ports/201059</freebsdpr>
	<url>http://www.ocert.org/advisories/ocert-2015-008.html</url>
	<url>http://freeradius.org/security.html</url>
	</references>
	<dates>
	<discovery>2015-06-22</discovery>
	<entry>2015-07-13</entry>
	</dates>
	</vuln>

	<vuln vid="f1deed23-27ec-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- xl command line config handling stack overflow</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>4.1</ge><lt>4.5.0_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-137.html">
	<p>The xl command line utility mishandles long configuration values
	when passed as command line arguments, with a buffer overrun.</p>
	<p>A semi-trusted guest administrator or controller, who is intended
	to be able to partially control the configuration settings for a
	domain, can escalate their privileges to that of the whole host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3259</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-137.html</url>
	</references>
	<dates>
	<discovery>2015-07-07</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="8c31b288-27ec-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- vulnerability in the iret hypercall handler</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>3.1</ge><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-136.html">
	<p>A buggy loop in Xen's compat_iret() function iterates the wrong way
	around a 32-bit index. Any 32-bit PV guest kernel can trigger this
	vulnerability by attempting a hypercall_iret with EFLAGS.VM set.</p>
	<p>Given the use of __get/put_user(), and that the virtual addresses
	in question are contained within the lower canonical half, the guest
	cannot clobber any hypervisor data. Instead, Xen will take up to
	2^33 pagefaults, in sequence, effectively hanging the host.</p>
	<p>Malicious guest administrators can cause a denial of service
	affecting the whole system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4164</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-136.html</url>
	</references>
	<dates>
	<discovery>2015-06-11</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="80e846ff-27eb-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.2</ge><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-134.html">
	<p>With the introduction of version 2 grant table operations, a
	version check became necessary for most grant table related
	hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a
	check. As a result, the subsequent code behaved as if version 2 was
	in use, when a guest issued this hypercall without a prior
	GNTTABOP_setup_table or GNTTABOP_set_version.</p>
	<p>The effect is a possible NULL pointer dereferences. However, this
	cannot be exploited to elevate privileges of the attacking domain,
	as the maximum memory address that can be wrongly accessed this way
	is bounded to far below the start of hypervisor memory.</p>
	<p>Malicious or buggy guest domain kernels can mount a denial of
	service attack which, if successful, can affect the whole system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4163</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-134.html</url>
	</references>
	<dates>
	<discovery>2015-06-11</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="ce658051-27ea-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.0</ge><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-132.html">
	<p>The handler for XEN_DOMCTL_gettscinfo failed to initialize a
	padding field subsequently copied to guest memory.</p>
	<p>A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is
	being addressed here regardless of that operation being declared
	unsafe for disaggregation by XSA-77.</p>
	<p>Malicious or buggy stub domain kernels or tool stacks otherwise
	living outside of Domain0 may be able to read sensitive data
	relating to the hypervisor or other guests not under the control of
	that domain.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3340</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-132.html</url>
	</references>
	<dates>
	<discovery>2015-04-20</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="3d657340-27ea-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- Unmediated PCI register access in qemu</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-131.html">
	<p>Qemu allows guests to not only read, but also write all parts of
	the PCI config space (but not extended config space) of passed
	through PCI devices not explicitly dealt with for (partial)
	emulation purposes.</p>
	<p>Since the effect depends on the specific purpose of the the config
	space field, it's not possible to give a general statement about the
	exact impact on the host or other guests. Privilege escalation,
	host crash (Denial of Service), and leaked information all cannot be
	excluded.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4106</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-131.html</url>
	</references>
	<dates>
	<discovery>2015-06-02</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="cbe1a0f9-27e9-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- Guest triggerable qemu MSI-X pass-through error messages</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-130.html">
	<p>Device model code dealing with guest PCI MSI-X interrupt management
	activities logs messages on certain (supposedly) invalid guest
	operations.</p>
	<p>A buggy or malicious guest repeatedly invoking such operations may
	result in the host disk to fill up, possibly leading to a Denial of
	Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4105</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-130.html</url>
	</references>
	<dates>
	<discovery>2015-06-02</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="4db8a0f4-27e9-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- PCI MSI mask bits inadvertently exposed to guests</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-129.html">
	<p>The mask bits optionally available in the PCI MSI capability
	structure are used by the hypervisor to occasionally suppress
	interrupt delivery. Unprivileged guests were, however, nevertheless
	allowed direct control of these bits.</p>
	<p>Interrupts may be observed by Xen at unexpected times, which may
	lead to a host crash and therefore a Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4104</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-129.html</url>
	</references>
	<dates>
	<discovery>2015-06-02</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="af38cfec-27e7-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- Potential unintended writes to host MSI message data field via qemu</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-128.html">
	<p>Logic is in place to avoid writes to certain host config space
	fields when the guest must nevertheless be able to access their
	virtual counterparts. A bug in how this logic deals with accesses
	spanning multiple fields allows the guest to write to the host MSI
	message data field.</p>
	<p>While generally the writes write back the values previously read,
	their value in config space may have got changed by the host between
	the qemu read and write. In such a case host side interrupt handling
	could become confused, possibly losing interrupts or allowing
	spurious interrupt injection into other guests.</p>
	<p>Certain untrusted guest administrators may be able to confuse host
	side interrupt handling, leading to a Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4103</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-128.html</url>
	</references>
	<dates>
	<discovery>2015-06-02</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="103a47d5-27e7-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- Certain domctl operations may be abused to lock up the host</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.3</ge><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-127.html">
	<p>XSA-77 put the majority of the domctl operations on a list
	excepting them from having security advisories issued for them if
	any effects their use might have could hamper security. Subsequently
	some of them got declared disaggregation safe, but for a small
	subset this was not really correct: Their (mis-)use may result in
	host lockups.</p>
	<p>As a result, the potential security benefits of toolstack
	disaggregation are not always fully realised.</p>
	<p>Domains deliberately given partial management control may be able
	to deny service to the entire host.</p>
	<p>As a result, in a system designed to enhance security by radically
	disaggregating the management, the security may be reduced. But,
	the security will be no worse than a non-disaggregated design.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2751</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-127.html</url>
	</references>
	<dates>
	<discovery>2015-03-31</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="79f401cd-27e6-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- Unmediated PCI command register access in qemu</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-126.html">
	<p>HVM guests are currently permitted to modify the memory and I/O
	decode bits in the PCI command register of devices passed through to
	them. Unless the device is an SR-IOV virtual function, after
	disabling one or both of these bits subsequent accesses to the MMIO
	or I/O port ranges would - on PCI Express devices - lead to
	Unsupported Request responses. The treatment of such errors is
	platform specific.</p>
	<p>Furthermore (at least) devices under control of the Linux pciback
	driver in the host are handed to guests with the aforementioned bits
	turned off. This means that such accesses can similarly lead to
	Unsupported Request responses until these flags are set as needed by
	the guest.</p>
	<p>In the event that the platform surfaces aforementioned UR responses
	as Non-Maskable Interrupts, and either the OS is configured to treat
	NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to
	treat these errors as fatal, the host would crash, leading to a
	Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2756</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-126.html</url>
	</references>
	<dates>
	<discovery>2015-03-31</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="d40c66cb-27e4-11e5-a4a5-002590263bf5">
	<topic>xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-125.html">
	<p>The XEN_DOMCTL_memory_mapping hypercall allows long running
	operations without implementing preemption.</p>
	<p>This hypercall is used by the device model as part of the emulation
	associated with configuration of PCI devices passed through to HVM
	guests and is therefore indirectly exposed to those guests.</p>
	<p>This can cause a physical CPU to become busy for a significant
	period, leading to a host denial of service in some cases.</p>
	<p>If a host denial of service is not triggered then it may instead be
	possible to deny service to the domain running the device model,
	e.g. domain 0.</p>
	<p>This hypercall is also exposed more generally to all toolstacks.
	However the uses of it in libxl based toolstacks are not believed
	to open up any avenue of attack from an untrusted guest. Other
	toolstacks may be vulnerable however.</p>
	<p>The vulnerability is exposed via HVM guests which have a PCI device
	assigned to them. A malicious HVM guest in such a configuration can
	mount a denial of service attack affecting the whole system via its
	associated device model (qemu-dm).</p>
	<p>A guest is able to trigger this hypercall via operations which it
	is legitimately expected to perform, therefore running the device
	model as a stub domain does not offer protection against the host
	denial of service issue. However it does offer some protection
	against secondary issues such as denial of service against dom0.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2752</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-125.html</url>
	</references>
	<dates>
	<discovery>2015-03-31</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="83a28417-27e3-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-123.html">
	<p>Instructions with register operands ignore eventual segment
	overrides encoded for them. Due to an insufficiently conditional
	assignment such a bogus segment override can, however, corrupt a
	pointer used subsequently to store the result of the instruction.</p>
	<p>A malicious guest might be able to read sensitive data relating to
	other guests, or to cause denial of service on the host. Arbitrary
	code execution, and therefore privilege escalation, cannot be
	excluded.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2151</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-123.html</url>
	</references>
	<dates>
	<discovery>2015-03-10</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="ef9d041e-27e2-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- Information leak through version information hypercall</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-122.html">
	<p>The code handling certain sub-operations of the
	HYPERVISOR_xen_version hypercall fails to fully initialize all
	fields of structures subsequently copied back to guest memory. Due
	to this hypervisor stack contents are copied into the destination of
	the operation, thus becoming visible to the guest.</p>
	<p>A malicious guest might be able to read sensitive data relating to
	other guests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2045</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-122.html</url>
	</references>
	<dates>
	<discovery>2015-03-05</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="5023f559-27e2-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- Information leak via internal x86 system device emulation</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-121.html">
	<p>Emulation routines in the hypervisor dealing with certain system
	devices check whether the access size by the guest is a supported
	one. When the access size is unsupported these routines failed to
	set the data to be returned to the guest for read accesses, so that
	hypervisor stack contents are copied into the destination of the
	operation, thus becoming visible to the guest.</p>
	<p>A malicious HVM guest might be able to read sensitive data relating
	to other guests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2044</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-121.html</url>
	</references>
	<dates>
	<discovery>2015-03-05</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="0d732fd1-27e0-11e5-a4a5-002590263bf5">
	<topic>xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends</topic>
	<affects>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-119.html">
	<p>When instantiating an emulated VGA device for an x86 HVM guest qemu
	will by default enable a backend to expose that device, either SDL
	or VNC depending on the version of qemu and the build time
	configuration.</p>
	<p>The libxl toolstack library does not explicitly disable these
	default backends when they are not enabled, leading to an unexpected
	backend running.</p>
	<p>If either SDL or VNC is explicitly enabled in the guest
	configuration then only the expected backends will be enabled.</p>
	<p>This affects qemu-xen and qemu-xen-traditional differently.</p>
	<p>If qemu-xen was compiled with SDL support then this would result in
	an SDL window being opened if $DISPLAY is valid, or a failure to
	start the guest if not.</p>
	<p>If qemu-xen was compiled without SDL support then qemu would
	instead start a VNC server listening on ::1 (IPv6 localhost) or
	127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC
	password will not be configured even if one is present in the guest
	configuration.</p>
	<p>qemu-xen-traditional will never start a vnc backend unless
	explicitly configured. However by default it will start an SDL
	backend if it was built with SDL support and $DISPLAY is valid.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2152</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-119.html</url>
	</references>
	<dates>
	<discovery>2015-03-13</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="912cb7f7-27df-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.4</ge><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-118.html">
	<p>On ARM systems the code which deals with virtualizing the GIC
	distributor would, under various circumstances, log messages on a
	guest accessible code path without appropriate rate limiting.</p>
	<p>A malicious guest could cause repeated logging to the hypervisor
	console, leading to a Denial of Service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1563</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-118.html</url>
	</references>
	<dates>
	<discovery>2015-01-29</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="785c86b1-27d6-11e5-a4a5-002590263bf5">
	<topic>xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated</topic>
	<affects>
	<package>
	<name>xen-kernel</name>
	<range><ge>4.5</ge><lt>4.5.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Xen Project reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-117.html">
	<p>When decoding a guest write to a specific register in the virtual
	interrupt controller Xen would treat an invalid value as a critical
	error and crash the host.</p>
	<p>By writing an invalid value to the GICD.SGIR register a guest can
	crash the host, resulting in a Denial of Service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0268</cvename>
	<url>http://xenbits.xen.org/xsa/advisory-117.html</url>
	</references>
	<dates>
	<discovery>2015-02-12</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="7313b0e3-27b4-11e5-a15a-50af736ef1c0">
	<topic>pivotx -- Multiple unrestricted file upload vulnerabilities</topic>
	<affects>
	<package>
	<name>pivotx</name>
	<range><lt>2.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pivotx reports:</p>
	<blockquote cite="http://pivotx.net/page/security">
	<p>Multiple unrestricted file upload vulnerabilities in fileupload.php
	in PivotX before 2.3.9 allow remote authenticated users to execute
	arbitrary PHP code by uploading a file with a (1) .php or (2) .php#
	extension, and then accessing it via unspecified vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0341</cvename>
	</references>
	<dates>
	<discovery>2014-04-15</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="14d846d6-27b3-11e5-a15a-50af736ef1c0">
	<topic>pivotx -- cross-site scripting (XSS) vulnerability</topic>
	<affects>
	<package>
	<name>pivotx</name>
	<range><lt>2.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>pivotx reports:</p>
	<blockquote cite="http://pivotx.net/page/security">
	<p>cross-site scripting (XSS) vulnerability in the nickname (and
	possibly the email) field. Mitigated by the fact that an attacker
	must have a PivotX account.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0341</cvename>
	</references>
	<dates>
	<discovery>2014-04-15</discovery>
	<entry>2015-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="c93c9395-25e1-11e5-a4a5-002590263bf5">
	<topic>wpa_supplicant -- WPS_NFC option payload length validation vulnerability</topic>
	<affects>
	<package>
	<name>wpa_supplicant</name>
	<range><lt>2.4_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jouni Malinen reports:</p>
	<blockquote cite="http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt">
	<p>Incomplete WPS and P2P NFC NDEF record payload length
	validation. (2015-5)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-8041</cvename>
	<url>http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt</url>
	</references>
	<dates>
	<discovery>2015-07-08</discovery>
	<entry>2015-07-09</entry>
	<modified>2015-11-10</modified>
	</dates>
	</vuln>

	<vuln vid="075952fe-267e-11e5-9d03-3c970e169bc2">
	<topic>openssl -- alternate chains certificate forgery vulnerability</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.2_2</ge><lt>1.0.2_4</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.2b</ge><lt>1.0.2d</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20150709.txt">
	<p>During certificate verification, OpenSSL (starting from version
	1.0.1n and 1.0.2b) will attempt to find an alternative certificate
	chain if the first attempt to build such a chain fails. An error
	in the implementation of this logic can mean that an attacker could
	cause certain checks on untrusted certificates to be bypassed,
	such as the CA flag, enabling them to use a valid leaf certificate
	to act as a CA and "issue" an invalid certificate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1793</cvename>
	<url>https://www.openssl.org/news/secadv_20150709.txt</url>
	</references>
	<dates>
	<discovery>2015-07-09</discovery>
	<entry>2015-07-09</entry>
	</dates>
	</vuln>

	<vuln vid="37ed8e9c-2651-11e5-86ff-14dae9d210b8">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
	</package>
	<package>
	<name>py27-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
	</package>
	<package>
	<name>py27-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><le>20150531,1</le></range>
	</package>
	<package>
	<name>py32-django-devel</name>
	<range><le>20150531,1</le></range>
	</package>
	<package>
	<name>py33-django-devel</name>
	<range><le>20150531,1</le></range>
	</package>
	<package>
	<name>py34-django-devel</name>
	<range><le>20150531,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Graham reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/jul/08/security-releases/">
	<p>In accordance with our security release policy, the Django
	team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3.
	These releases are now available on PyPI and our download page. These
	releases address several security issues detailed below. We encourage
	all users of Django to upgrade as soon as possible. The Django master
	branch has also been updated.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2015/jul/08/security-releases/</url>
	<url>https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680</url>
	<url>https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44</url>
	<url>https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e</url>
	<cvename>CVE-2015-5143</cvename>
	<cvename>CVE-2015-5144</cvename>
	<cvename>CVE-2015-5145</cvename>
	</references>
	<dates>
	<discovery>2015-06-10</discovery>
	<entry>2015-07-09</entry>
	</dates>
	</vuln>

	<vuln vid="348bfa69-25a2-11e5-ade1-0011d823eebd">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.481</lt></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.481</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-16.html">
	<p>
	Adobe has released security updates for Adobe Flash Player. These
	updates address critical vulnerabilities that could potentially
	allow an attacker to take control of the affected system. Adobe is
	aware of a report that an exploit targeting CVE-2015-5119 has been
	publicly published.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-16.html</url>
	<cvename>CVE-2015-5119</cvename>
	</references>
	<dates>
	<discovery>2015-07-07</discovery>
	<entry>2015-07-08</entry>
	</dates>
	</vuln>

	<vuln vid="c93533a3-24f1-11e5-8b74-3c970e169bc2">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind910</name>
	<range><lt>9.10.2P2</lt></range>
	</package>
	<package>
	<name>bind99</name>
	<range><lt>9.9.7P1</lt></range>
	</package>
	<package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_19</lt></range>
	<range><ge>8.4</ge><lt>8.4_33</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01267/">
	<p>A very uncommon combination of zone data has been found
	that triggers a bug in BIND, with the result that named
	will exit with a "REQUIRE" failure in name.c when validating
	the data returned in answer to a recursive query.</p>
	<p>A recursive resolver that is performing DNSSEC validation
	can be deliberately terminated by any attacker who can
	cause a query to be performed against a maliciously
	constructed zone. This will result in a denial of
	service to clients who rely on that resolver.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:11.bind</freebsdsa>
	<cvename>CVE-2015-4620</cvename>
	<url>https://kb.isc.org/article/AA-01267/</url>
	</references>
	<dates>
	<discovery>2015-07-07</discovery>
	<entry>2015-07-07</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="cbfa8bd7-24b6-11e5-86ff-14dae9d210b8">
	<topic>haproxy -- information leak vulnerability</topic>
	<affects>
	<package>
	<name>haproxy</name>
	<range><ge>1.5.0</ge><lt>1.5.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>HAProxy reports:</p>
	<blockquote cite="http://www.haproxy.org/news.html">
	<p>A vulnerability was found when HTTP pipelining is used. In
	some cases, a client might be able to cause a buffer alignment issue and
	retrieve uninitialized memory contents that exhibit data from a past
	request or session. I want to address sincere congratulations to Charlie
	Smurthwaite of aTech Media for the really detailed traces he provided
	which made it possible to find the cause of this bug. Every user of
	1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev
	snapshot to fix this issue, or use the backport of the fix provided by
	their operating system vendors. CVE-2015-3281 was assigned to this bug.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.haproxy.org/news.html</url>
	<url>http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4</url>
	<mlist>http://seclists.org/oss-sec/2015/q3/61</mlist>
	<cvename>CVE-2015-3281</cvename>
	</references>
	<dates>
	<discovery>2015-07-02</discovery>
	<entry>2015-07-07</entry>
	</dates>
	</vuln>

	<vuln vid="038a5808-24b3-11e5-b0c8-bf4d8935d4fa">
	<topic>roundcube -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
	<range><lt>1.0.6,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Roundcube reports:</p>
	<blockquote cite="https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/">
	<p>We just published updates to both stable versions 1.0 and
	1.1 after fixing many minor bugs and adding some security improvements
	to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes
	from the more recent version to ensure proper long term support
	especially in regards of security and compatibility.<br/>
	<br/>
	The security-related fixes in particular are:<br/>
	<br/>
	* XSS vulnerability in _mbox argument<br/>
	* security improvement in contact photo handling<br/>
	* potential info disclosure from temp directory</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5381</cvename>
	<cvename>CVE-2015-5383</cvename>
	<mlist>http://openwall.com/lists/oss-security/2015/07/06/10</mlist>
	<url>https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/</url>
	</references>
	<dates>
	<discovery>2015-05-30</discovery>
	<entry>2015-07-07</entry>
	</dates>
	</vuln>

	<vuln vid="543b5939-2067-11e5-a4a5-002590263bf5">
	<topic>turnserver -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>turnserver</name>
	<range><lt>4.4.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oleg Moskalenko reports:</p>
	<blockquote cite="http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog">
	<p>SQL injection security hole fixed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog</url>
	<mlist>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J</mlist>
	</references>
	<dates>
	<discovery>2015-06-20</discovery>
	<entry>2015-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="150d1538-23fa-11e5-a4a5-002590263bf5">
	<topic>squid -- Improper Protection of Alternate Path with CONNECT requests</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>3.5.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2015:2 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_2.txt">
	<p>Squid configured with cache_peer and operating on explicit proxy
	traffic does not correctly handle CONNECT method peer responses.</p>
	<p>The bug is important because it allows remote clients to bypass
	security in an explicit gateway proxy.</p>
	<p>However, the bug is exploitable only if you have configured
	cache_peer to receive CONNECT requests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.squid-cache.org/Advisories/SQUID-2015_2.txt</url>
	<cvename>CVE-2015-5400</cvename>
	</references>
	<dates>
	<discovery>2015-07-06</discovery>
	<entry>2015-07-06</entry>
	<modified>2015-07-17</modified>
	</dates>
	</vuln>

	<vuln vid="b6da24da-23f7-11e5-a4a5-002590263bf5">
	<topic>squid -- client-first SSL-bump does not correctly validate X509 server certificate</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.5</ge><lt>3.5.4</lt></range>
	<range><ge>3.4</ge><lt>3.4.13</lt></range>
	</package>
	<package>
	<name>squid33</name>
	<range><ge>3.3</ge><lt>3.3.14</lt></range>
	</package>
	<package>
	<name>squid32</name>
	<range><ge>3.2</ge><lt>3.2.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2015:1 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_1.txt">
	<p>Squid configured with client-first SSL-bump does not correctly
	validate X509 server certificate domain / hostname fields.</p>
	<p>The bug is important because it allows remote servers to bypass
	client certificate validation. Some attackers may also be able
	to use valid certificates for one domain signed by a global
	Certificate Authority to abuse an unrelated domain.</p>
	<p>However, the bug is exploitable only if you have configured
	Squid to perform SSL Bumping with the "client-first" or "bump"
	mode of operation.</p>
	<p>Sites that do not use SSL-Bump are not vulnerable.</p>
	<p>All Squid built without SSL support are not vulnerable to the
	problem.</p>
	</blockquote>
	<p>The FreeBSD port does not use SSL by default and is not vulnerable
	in the default configuration.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3455</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2015_1.txt</url>
	</references>
	<dates>
	<discovery>2015-05-01</discovery>
	<entry>2015-07-06</entry>
	</dates>
	</vuln>

	<vuln vid="72fccfdf-2061-11e5-a4a5-002590263bf5">
	<topic>ansible -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>1.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansible, Inc. reports:</p>
	<blockquote cite="http://www.ansible.com/security">
	<p>Ensure that hostnames match certificate names when using HTTPS -
	resolved in Ansible 1.9.2</p>
	<p>Improper symlink handling in zone, jail, and chroot connection
	plugins could lead to escape from confined environment - resolved
	in Ansible 1.9.2</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3908</cvename>
	<cvename>CVE-2015-6240</cvename>
	<url>http://www.ansible.com/security</url>
	<url>https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md</url>
	</references>
	<dates>
	<discovery>2015-06-25</discovery>
	<entry>2015-07-02</entry>
	<modified>2015-08-18</modified>
	</dates>
	</vuln>

	<vuln vid="e308c61a-2060-11e5-a4a5-002590263bf5">
	<topic>ansible -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansible, Inc. reports:</p>
	<blockquote cite="http://www.ansible.com/security">
	<p>Arbitrary execution from data from compromised remote hosts or
	local data when using a legacy Ansible syntax - resolved in
	Ansible 1.7</p>
	<p>ansible-galaxy command when used on local tarballs (and not
	galaxy.ansible.com) can install a malformed tarball if so provided
	- resolved in Ansible 1.7</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.ansible.com/security</url>
	<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
	</references>
	<dates>
	<discovery>2014-08-06</discovery>
	<entry>2015-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="9dae9d62-205f-11e5-a4a5-002590263bf5">
	<topic>ansible -- code execution from compromised remote host data or untrusted local data</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>1.6.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansible, Inc. reports:</p>
	<blockquote cite="http://www.ansible.com/security">
	<p>Arbitrary execution from data from compromised remote hosts or
	untrusted local data - resolved in Ansible 1.6.7</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4966</cvename>
	<bid>68794</bid>
	<url>http://www.ansible.com/security</url>
	<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
	</references>
	<dates>
	<discovery>2014-07-21</discovery>
	<entry>2015-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="2c493ac8-205e-11e5-a4a5-002590263bf5">
	<topic>ansible -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>1.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansible, Inc. reports:</p>
	<blockquote cite="http://www.ansible.com/security">
	<p>Incomplete Fix Remote Code Execution Vulnerability - Fixed in
	Ansible 1.6.4</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4678</cvename>
	<bid>68335</bid>
	<url>http://www.ansible.com/security</url>
	<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
	</references>
	<dates>
	<discovery>2014-06-25</discovery>
	<entry>2015-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="a6a9f9d5-205c-11e5-a4a5-002590263bf5">
	<topic>ansible -- local symlink exploits</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>1.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4259">
	<p>runner/connection_plugins/ssh.py in Ansible before 1.2.3, when
	using ControlPersist, allows local users to redirect a ssh session
	via a symlink attack on a socket file with a predictable name in
	/tmp/.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4260">
	<p>lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3,
	when playbook does not run due to an error, allows local users to
	overwrite arbitrary files via a symlink attack on a retry file with
	a predictable name in /var/tmp/ansible/.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4259</cvename>
	<cvename>CVE-2013-4260</cvename>
	<url>http://www.ansible.com/security</url>
	<url>https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg</url>
	</references>
	<dates>
	<discovery>2013-08-21</discovery>
	<entry>2015-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="a478421e-2059-11e5-a4a5-002590263bf5">
	<topic>ansible -- enable host key checking in paramiko connection type</topic>
	<affects>
	<package>
	<name>ansible</name>
	<range><lt>1.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansible changelog reports:</p>
	<blockquote cite="https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md">
	<p>Host key checking is on by default. Disable it if you like by
	adding host_key_checking=False in the [default] section of
	/etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting
	ANSIBLE_HOST_KEY_CHECKING=False.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2233</cvename>
	<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
	<url>http://www.ansible.com/security</url>
	<url>https://github.com/ansible/ansible/issues/857</url>
	</references>
	<dates>
	<discovery>2012-08-13</discovery>
	<entry>2015-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="d7b9a28d-238c-11e5-86ff-14dae9d210b8">
	<topic>bitcoin -- denial of service</topic>
	<affects>
	<package>
	<name>bitcoin</name>
	<range><lt>0.10.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gregory Maxwell reports:</p>
	<blockquote cite="http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core">
	<p>On July 7th I will be making public details of several
	serious denial of service vulnerabilities which have fixed in recent
	versions of Bitcoin Core, including including CVE-2015-3641.

	I strongly recommend anyone running production nodes exposed to inbound
	connections from the internet upgrade to 0.10.2 as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3641</cvename>
	<url>http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core</url>
	<url>https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures</url>
	</references>
	<dates>
	<discovery>2015-06-27</discovery>
	<entry>2015-07-06</entry>
	</dates>
	</vuln>

	<vuln vid="864e6f75-2372-11e5-86ff-14dae9d210b8">
	<topic>node, iojs, and v8 -- denial of service</topic>
	<affects>
	<package>
	<name>node</name>
	<range><lt>0.12.6</lt></range>
	</package>
	<package>
	<name>node-devel</name>
	<range><lt>0.12.6</lt></range>
	</package>
	<package>
	<name>iojs</name>
	<range><lt>2.3.3</lt></range>
	</package>
	<package>
	<name>v8</name>
	<range><le>3.18.5</le></range>
	</package>
	<package>
	<name>v8-devel</name>
	<range><le>3.27.7_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>node reports:</p>
	<blockquote cite="http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/">
	<p>This release of Node.js fixes a bug that triggers an
	out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to
	String conversions. This is an important security update as this bug can
	be used to cause a denial of service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/</url>
	<url>https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6</url>
	<url>https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676</url>
	<url>https://codereview.chromium.org/1226493003</url>
	<cvename>CVE-2015-5380</cvename>
	</references>
	<dates>
	<discovery>2015-07-03</discovery>
	<entry>2015-07-06</entry>
	<modified>2015-07-10</modified>
	</dates>
	</vuln>

	<vuln vid="bf1d9331-21b6-11e5-86ff-14dae9d210b8">
	<topic>cups-filters -- texttopdf integer overflow</topic>
	<affects>
	<package>
	<name>cups-filters</name>
	<range><lt>1.0.71</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Cornelius from Red Hat reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/03/2">
	<p>An integer overflow flaw leading to a heap-based buffer overflow was
	discovered in the way the texttopdf utility of cups-filter processed
	print jobs with a specially crafted line size. An attacker being able
	to submit print jobs could exploit this flaw to crash texttopdf or,
	possibly, execute arbitrary code with the privileges of the 'lp' user.</p>
	</blockquote>
	<p>Tim Waugh reports:</p>
	<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365">
	<p>The Page allocation is moved into textcommon.c, where it does all the
	necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds
	for CVE-2015-3259 due to integer overflows for the calloc() call
	initializing Page[0] and the memset() call in texttopdf.c's
	WritePage() function zeroing the entire array.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3279</cvename>
	<url>https://access.redhat.com/security/cve/CVE-2015-3279</url>
	<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365</url>
	<mlist>http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html</mlist>
	</references>
	<dates>
	<discovery>2015-07-03</discovery>
	<entry>2015-07-03</entry>
	<modified>2015-07-07</modified>
	</dates>
	</vuln>

	<vuln vid="9c7177ff-1fe1-11e5-9a01-bcaec565249c">
	<topic>libxml2 -- Enforce the reader to run in constant memory</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.9.2_3</lt></range>
	</package>
	<package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_5</lt></range>
	</package>
	<package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel Veilland reports:</p>
	<blockquote cite="https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9">
	<p>Enforce the reader to run in constant memory. One of the
	operation on the reader could resolve entities leading to
	the classic expansion issue. Make sure the buffer used for
	xmlreader operation is bounded. Introduce a new allocation
	type for the buffers for this effect.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1819</cvename>
	<url>https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9</url>
	</references>
	<dates>
	<discovery>2015-04-14</discovery>
	<entry>2015-07-01</entry>
	<modified>2016-01-31</modified>
	</dates>
	</vuln>

	<vuln vid="2a8b7d21-1ecc-11e5-a4a5-002590263bf5">
	<topic>wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension</topic>
	<affects>
	<package>
	<name>wesnoth</name>
	<range><lt>1.12.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ignacio R. Morelle reports:</p>
	<blockquote cite="http://forums.wesnoth.org/viewtopic.php?t=42776">
	<p>As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release
	announcements, a security vulnerability targeting add-on authors
	was found (bug #23504) which allowed a malicious user to obtain
	add-on server passphrases from the client's .pbl files and transmit
	them over the network, or store them in saved game files intended
	to be shared by the victim. This vulnerability affects all existing
	releases up to and including versions 1.12.2 and 1.13.0.
	Additionally, version 1.12.3 included only a partial fix that failed
	to guard users against attempts to read from .pbl files with an
	uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070
	have been assigned to the vulnerability affecting .pbl files with a
	lowercase extension, and .pbl files with an uppercase or mixed-case
	extension, respectively.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-5069</cvename>
	<cvename>CVE-2015-5070</cvename>
	<url>http://forums.wesnoth.org/viewtopic.php?t=42776</url>
	<url>http://forums.wesnoth.org/viewtopic.php?t=42775</url>
	</references>
	<dates>
	<discovery>2015-06-28</discovery>
	<entry>2015-07-01</entry>
	</dates>
	</vuln>

	<vuln vid="b19da422-1e02-11e5-b43d-002590263bf5">
	<topic>cups-filters -- buffer overflow in texttopdf size allocation</topic>
	<affects>
	<package>
	<name>cups-filters</name>
	<range><lt>1.0.70</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Cornelius from Red Hat reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/26/4">
	<p>A heap-based buffer overflow was discovered in the way the
	texttopdf utility of cups-filters processed print jobs with a
	specially crafted line size. An attacker being able to submit
	print jobs could exploit this flaw to crash texttopdf or,
	possibly, execute arbitrary code.</p>
	</blockquote>
	<p>Till Kamppeter reports:</p>
	<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363">
	<p>texttopdf: Fixed buffer overflow on size allocation of texttopdf
	when working with extremely small line sizes, which causes the size
	calculation to result in 0 (CVE-2015-3258, thanks to Stefan
	Cornelius from Red Hat for the patch).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3258</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/4</mlist>
	<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363</url>
	</references>
	<dates>
	<discovery>2015-06-26</discovery>
	<entry>2015-06-29</entry>
	</dates>
	</vuln>

	<vuln vid="0d0f3050-1f69-11e5-9ba9-d050996490d0">
	<topic>ntp -- control message remote Denial of Service vulnerability</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p3</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><lt>4.3.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ntp.org reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">
	<p>Under limited and specific circumstances an attacker can send a
	crafted packet to cause a vulnerable ntpd instance to crash.
	This requires each of the following to be true:</p>
	<ul>
	<li>ntpd set up to allow for remote configuration (not
	allowed by default), and</li>
	<li>knowledge of the configuration password, and</li>
	<li>access to a computer entrusted to perform remote
	configuration.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bugs.ntp.org/show_bug.cgi?id=2853</url>
	<url>https://www.kb.cert.org/vuls/id/668167</url>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi</url>
	</references>
	<dates>
	<discovery>2015-06-29</discovery>
	<entry>2015-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="acd5d037-1c33-11e5-be9c-6805ca1d3bb1">
	<topic>qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209)</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.11.1_20</lt></range>
	<range><ge>0.12</ge><lt>2.3.0_2</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<range><lt>2.3.50.g20150618_1</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><lt>4.5.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The QEMU security team reports:</p>
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-135.html">
	<p>A guest which has access to an emulated PCNET network
	device (e.g. with "model=pcnet" in their VIF configuration)
	can exploit this vulnerability to take over the qemu
	process elevating its privilege to that of the qemu
	process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://xenbits.xen.org/xsa/advisory-135.html</url>
	<cvename>CVE-2015-3209</cvename>
	</references>
	<dates>
	<discovery>2015-04-10</discovery>
	<entry>2015-06-26</entry>
	<modified>2015-07-11</modified>
	</dates>
	</vuln>

	<vuln vid="23232028-1ba4-11e5-b43d-002590263bf5">
	<topic>elasticsearch -- security fix for shared file-system repositories</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><ge>1.0.0</ge><lt>1.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: All Elasticsearch versions from 1.0.0 to
	1.5.2 are vulnerable to an attack that uses Elasticsearch to modify
	files read and executed by certain other applications.</p>
	<p>Remediation Summary: Users should upgrade to 1.6.0. Alternately,
	ensure that other applications are not present on the system, or
	that Elasticsearch cannot write into areas where these applications
	would read.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4165</cvename>
	<freebsdpr>ports/201008</freebsdpr>
	<url>https://www.elastic.co/community/security</url>
	<url>https://www.elastic.co/blog/elasticsearch-1-6-0-released</url>
	</references>
	<dates>
	<discovery>2015-06-09</discovery>
	<entry>2015-06-26</entry>
	</dates>
	</vuln>

	<vuln vid="a71e7440-1ba3-11e5-b43d-002590263bf5">
	<topic>elasticsearch -- directory traversal attack with site plugins</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><lt>1.4.5</lt></range>
	<range><ge>1.5.0</ge><lt>1.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: All Elasticsearch versions prior to 1.5.2
	and 1.4.5 are vulnerable to a directory traversal attack that allows
	an attacker to retrieve files from the server running Elasticsearch
	when one or more site plugins are installed, or when Windows is the
	server OS.</p>
	<p>Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users
	that do not want to upgrade can address the vulnerability by
	disabling site plugins. See the CVE description for additional
	options.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3337</cvename>
	<bid>74353</bid>
	<url>https://www.elastic.co/community/security</url>
	<url>https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released</url>
	<url>https://www.exploit-db.com/exploits/37054/</url>
	<url>https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html</url>
	<url>http://www.securityfocus.com/archive/1/535385</url>
	</references>
	<dates>
	<discovery>2015-04-27</discovery>
	<entry>2015-06-26</entry>
	</dates>
	</vuln>

	<vuln vid="026759e0-1ba3-11e5-b43d-002590263bf5">
	<topic>elasticsearch -- remote OS command execution via Groovy scripting engine</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><ge>1.3.0</ge><lt>1.3.8</lt></range>
	<range><ge>1.4.0</ge><lt>1.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and
	1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that
	were introduced in 1.3.0. The vulnerability allows an attacker to
	construct Groovy scripts that escape the sandbox and execute shell
	commands as the user running the Elasticsearch Java VM.</p>
	<p>Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users
	that do not want to upgrade can address the vulnerability by setting
	script.groovy.sandbox.enabled to false in elasticsearch.yml and
	restarting the node.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1427</cvename>
	<bid>72585</bid>
	<url>https://www.elastic.co/community/security</url>
	<url>https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released</url>
	<url>http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded</url>
	<url>https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html</url>
	<url>https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html</url>
	</references>
	<dates>
	<discovery>2015-02-11</discovery>
	<entry>2015-06-26</entry>
	</dates>
	</vuln>

	<vuln vid="5951fb49-1ba2-11e5-b43d-002590263bf5">
	<topic>elasticsearch -- cross site scripting vulnerability in the CORS functionality</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><lt>1.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: Elasticsearch versions 1.3.x and prior have
	a default configuration for CORS that allows an attacker to craft
	links that could cause a user's browser to send requests to
	Elasticsearch instances on their local network. These requests could
	cause data loss or compromise.</p>
	<p>Remediation Summary: Users should either set "http.cors.enabled" to
	false, or set "http.cors.allow-origin" to the value of the server
	that should be allowed access, such as localhost or a server hosting
	Kibana. Disabling CORS entirely with the former setting is more
	secure, but may not be suitable for all use cases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-6439</cvename>
	<bid>70233</bid>
	<url>https://www.elastic.co/community/security</url>
	<url>https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released</url>
	<url>https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html</url>
	<url>http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded</url>
	</references>
	<dates>
	<discovery>2014-10-01</discovery>
	<entry>2015-06-26</entry>
	</dates>
	</vuln>

	<vuln vid="43ac9d42-1b9a-11e5-b43d-002590263bf5">
	<topic>elasticsearch and logstash -- remote OS command execution via dynamic scripting</topic>
	<affects>
	<package>
	<name>elasticsearch</name>
	<range><lt>1.2.0</lt></range>
	</package>
	<package>
	<name>logstash</name>
	<range><lt>1.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/community/security">
	<p>Vulnerability Summary: In Elasticsearch versions 1.1.x and prior,
	dynamic scripting is enabled by default. This could allow an
	attacker to execute OS commands.</p>
	<p>Remediation Summary: Disable dynamic scripting.</p>
	</blockquote>
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
	<p>Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is
	vulnerable to CVE-2014-3120. These binaries are used in
	Elasticsearch output specifically when using the node protocol.
	Since a node client joins the Elasticsearch cluster, the attackers
	could use scripts to execute commands on the host OS using the node
	client's URL endpoint. With 1.4.3 release, we are packaging Logstash
	with Elasticsearch 1.5.2 binaries which by default disables the
	ability to run scripts. This also affects users who are using the
	configuration option embedded=>true in the Elasticsearch output
	which starts a local embedded Elasticsearch cluster. This is
	typically used in development environment and proof of concept
	deployments. Regardless of this vulnerability, we strongly recommend
	not using embedded in production.</p>
	<p>Note that users of transport and http protocol are not vulnerable
	to this attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3120</cvename>
	<bid>67731</bid>
	<url>https://www.elastic.co/community/security</url>
	<url>https://www.elastic.co/blog/elasticsearch-1-2-0-released</url>
	<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
	<url>https://www.exploit-db.com/exploits/33370/</url>
	<url>http://bouk.co/blog/elasticsearch-rce/</url>
	<url>http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce</url>
	<url>https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch</url>
	</references>
	<dates>
	<discovery>2014-05-22</discovery>
	<entry>2015-06-26</entry>
	</dates>
	</vuln>

	<vuln vid="24bde04f-1a10-11e5-b43d-002590263bf5">
	<topic>logstash -- Directory traversal vulnerability in the file output plugin</topic>
	<affects>
	<package>
	<name>logstash</name>
	<range><lt>1.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
	<p>An attacker could use the File output plugin with dynamic field
	references in the path option to traverse paths outside of Logstash
	directory. This technique could also be used to overwrite any files
	which can be accessed with permissions associated with Logstash
	user. This release sandboxes the paths which can be traversed using
	the configuration. We have also disallowed use of dynamic field
	references if the path options is pointing to an absolute path.</p>
	<p>We have added this vulnerability to our CVE page and are working
	on filling out the CVE. We would like to thank Colin Coghill for
	reporting the issue and working with us on the resolution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4152</cvename>
	<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
	<url>https://www.elastic.co/community/security</url>
	</references>
	<dates>
	<discovery>2015-06-09</discovery>
	<entry>2015-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="2184ccad-1a10-11e5-b43d-002590263bf5">
	<topic>logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs</topic>
	<affects>
	<package>
	<name>logstash</name>
	<range><lt>1.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-2">
	<p>The vulnerability impacts deployments that use the either the
	zabbix or the nagios_nsca outputs. In these cases, an attacker
	with an ability to send crafted events to any source of data for
	Logstash could execute operating system commands with the
	permissions of the Logstash process.</p>
	<p>Deployments that do not use the zabbix or the nagios_nsca outputs
	are not vulnerable and do not need to upgrade for this reason.</p>
	<p>We have added this vulnerability to our CVE page and are working
	on filling out the CVE.</p>
	<p>We would like to thank Jan Karwowski and Danila Borisiuk for
	reporting the issue and working with us on the resolution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4326</cvename>
	<url>https://www.elastic.co/blog/logstash-1-4-2</url>
	<url>https://www.elastic.co/community/security</url>
	</references>
	<dates>
	<discovery>2014-06-24</discovery>
	<entry>2015-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="ad4d3871-1a0d-11e5-b43d-002590263bf5">
	<topic>logstash-forwarder and logstash -- susceptibility to POODLE vulnerability</topic>
	<affects>
	<package>
	<name>logstash-forwarder</name>
	<range><lt>0.4.0.20150507</lt></range>
	</package>
	<package>
	<name>logstash</name>
	<range><lt>1.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elastic reports:</p>
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
	<p>The combination of Logstash Forwarder and Lumberjack input (and
	output) was vulnerable to the POODLE attack in SSLv3 protocol. We
	have disabled SSLv3 for this combination and set the minimum version
	to be TLSv1.0. We have added this vulnerability to our CVE page and
	are working on filling out the CVE.</p>
	<p>Thanks to Tray Torrance, Marc Chadwick, and David Arena for
	reporting this.</p>
	</blockquote>
	<blockquote cite="https://www.elastic.co/blog/logstash-forwarder-0-4-0-released">
	<p>SSLv3 is no longer supported; TLS 1.0+ is required (compatible
	with Logstash 1.4.2+).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<!-- POODLE CVE pending -->
	<freebsdpr>ports/201065</freebsdpr>
	<freebsdpr>ports/201065</freebsdpr>
	<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
	<url>https://www.elastic.co/blog/logstash-forwarder-0-4-0-released</url>
	</references>
	<dates>
	<discovery>2015-06-09</discovery>
	<entry>2015-06-24</entry>
	<modified>2015-06-24</modified>
	</dates>
	</vuln>

	<vuln vid="d02f6b01-1a3f-11e5-8bd6-c485083ca99c">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-14.html">
	<p>
	Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh and Linux. These updates address a critical
	vulnerability (CVE-2015-3113) that could potentially allow an
	attacker to take control of the affected system.
	</p>
	<p>
	Adobe is aware of reports that CVE-2015-3113 is being actively
	exploited in the wild via limited, targeted attacks. Systems running
	Internet Explorer for Windows 7 and below, as well as Firefox on
	Windows XP, are known targets.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-14.html</url>
	<cvename>CVE-2015-3113</cvename>
	</references>
	<dates>
	<discovery>2015-06-23</discovery>
	<entry>2015-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="f5225b23-192d-11e5-a1cf-002590263bf5">
	<topic>rubygem-bson -- DoS and possible injection</topic>
	<affects>
	<package>
	<name>rubygem-bson</name>
	<range><lt>3.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Phill MV reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/06/1">
	<p>By submitting a specially crafted string to a service relying on
	the bson rubygem, an attacker may trigger denials of service or even
	inject data into victim's MongoDB instances.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4412</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2015/06/06/1</mlist>
	<url>http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html</url>
	<url>https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999</url>
	</references>
	<dates>
	<discovery>2015-06-04</discovery>
	<entry>2015-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="cdff0af2-1492-11e5-a1cf-002590263bf5">
	<topic>php5 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5-dom</name>
	<name>php5-ftp</name>
	<name>php5-gd</name>
	<name>php5-pgsql</name>
	<range><lt>5.4.42</lt></range>
	</package>
	<package>
	<name>php55-dom</name>
	<name>php55-ftp</name>
	<name>php55-gd</name>
	<name>php55-pgsql</name>
	<range><lt>5.5.26</lt></range>
	</package>
	<package>
	<name>php56-dom</name>
	<name>php56-ftp</name>
	<name>php56-gd</name>
	<name>php56-psql</name>
	<range><lt>5.6.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	<p>DOM and GD:</p>
	<ul>
	<li>Fixed bug #69719 (Incorrect handling of paths with NULs).</li>
	</ul>
	<p>FTP:</p>
	<ul>
	<li>Improved fix for bug #69545 (Integer overflow in ftp_genlist()
	resulting in heap overflow). (CVE-2015-4643)</li>
	</ul>
	<p>Postgres:</p>
	<ul>
	<li>Fixed bug #69667 (segfault in php_pgsql_meta_data).
	(CVE-2015-4644)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4643</cvename>
	<cvename>CVE-2015-4644</cvename>
	<url>http://www.php.net/ChangeLog-5.php#5.4.42</url>
	<url>http://www.php.net/ChangeLog-5.php#5.5.26</url>
	<url>http://www.php.net/ChangeLog-5.php#5.6.10</url>
	<mlist>http://openwall.com/lists/oss-security/2015/06/18/3</mlist>
	</references>
	<dates>
	<discovery>2015-06-11</discovery>
	<entry>2015-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="a4460ac7-192c-11e5-9c01-bcaec55be5e5">
	<topic>devel/ipython -- remote execution</topic>
	<affects>
	<package>
	<name>ipython</name>
	<range><lt>3.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kyle Kelley reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/779">
	<p>Summary: JSON error responses from the IPython notebook REST API
	contained URL parameters and were incorrectly reported as text/html
	instead of application/json. The error messages included some of these
	URL params, resulting in a cross site scripting attack. This affects
	users on Mozilla Firefox but not Chromium/Google Chrome.</p>
	<p>API paths with issues:</p>
	<ul>
	<li>/api/contents (3.0-3.1)</li>
	<li>/api/notebooks (2.0-2.4, 3.0-3.1)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4706</cvename>
	<cvename>CVE-2015-4707</cvename>
	<url>http://seclists.org/oss-sec/2015/q2/779</url>
	</references>
	<dates>
	<discovery>2015-06-22</discovery>
	<entry>2015-06-22</entry>
	</dates>
	</vuln>

	<vuln vid="d46ed7b8-1912-11e5-9fdf-00262d5ed8ee">
	<topic>www/chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>43.0.2357.130</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-npapi</name>
	<range><lt>43.0.2357.130</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-pulse</name>
	<range><lt>43.0.2357.130</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html">
	<p>4 security fixes in this release:</p>
	<ul>
	<li>[464922] High CVE-2015-1266: Scheme validation error in WebUI.
	Credit to anonymous.</li>
	<li>[494640] High CVE-2015-1268: Cross-origin bypass in Blink.
	Credit to Mariusz Mlynski.</li>
	<li>[497507] Medium CVE-2015-1267: Cross-origin bypass in Blink.
	Credit to anonymous.</li>
	<li>[461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP
	preload list. Credit to Mike Ruddy.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1266</cvename>
	<cvename>CVE-2015-1267</cvename>
	<cvename>CVE-2015-1268</cvename>
	<cvename>CVE-2015-1269</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html</url>
	</references>
	<dates>
	<discovery>2015-06-22</discovery>
	<entry>2015-06-22</entry>
	</dates>
	</vuln>

	<vuln vid="0f154810-16e4-11e5-a1cf-002590263bf5">
	<topic>rubygem-paperclip -- validation bypass vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-paperclip</name>
	<range><lt>4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jon Yurek reports:</p>
	<blockquote cite="https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57">
	<p>Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.</p>
	<p>There is an issue where if an HTML file is uploaded with a .html
	extension, but the content type is listed as being `image/jpeg`,
	this will bypass a validation checking for images. But it will also
	pass the spoof check, because a file named .html and containing
	actual HTML passes the spoof check.</p>
	<p>This change makes it so that we also check the supplied content
	type. So even if the file contains HTML and ends with .html, it
	doesn't match the content type of `image/jpeg` and so it fails.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2963</cvename>
	<url>https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57</url>
	<url>https://robots.thoughtbot.com/paperclip-security-release</url>
	<url>http://jvn.jp/en/jp/JVN83881261/index.html</url>
	</references>
	<dates>
	<discovery>2015-06-05</discovery>
	<entry>2015-06-22</entry>
	</dates>
	</vuln>

	<vuln vid="0da404ad-1891-11e5-a1cf-002590263bf5">
	<topic>chicken -- Potential buffer overrun in string-translate*</topic>
	<affects>
	<package>
	<name>chicken</name>
	<range><lt>4.10.0.r2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>chicken developer Peter Bex reports:</p>
	<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html">
	<p>Using gcc's Address Sanitizer, it was discovered that the string-translate*
	procedure from the data-structures unit can scan beyond the input string's
	length up to the length of the source strings in the map that's passed to
	string-translate*. This issue was fixed in master 8a46020, and it will
	make its way into CHICKEN 4.10.</p>
	<p>This bug is present in all released versions of CHICKEN.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4556</cvename>
	<freebsdpr>ports/200980</freebsdpr>
	<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html</mlist>
	<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html</mlist>
	<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html</mlist>
	</references>
	<dates>
	<discovery>2015-06-15</discovery>
	<entry>2015-06-22</entry>
	<modified>2015-07-31</modified>
	</dates>
	</vuln>

	<vuln vid="e7b7f2b5-177a-11e5-ad33-f8d111029e6a">
	<topic>chicken -- buffer overrun in substring-index[-ci]</topic>
	<affects>
	<package>
	<name>chicken</name>
	<range><lt>4.10.0.r1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>chicken developer Moritz Heidkamp reports:</p>
	<blockquote cite="http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html">
	<p>The substring-index[-ci] procedures of the data-structures unit are
	vulnerable to a buffer overrun attack when passed an integer greater
	than zero as the optional START argument.</p>
	<p>As a work-around you can switch to SRFI 13's
	string-contains procedure which also returns the substring's index in
	case it is found.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9651</cvename>
	<mlist>http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html</mlist>
	<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt</mlist>
	</references>
	<dates>
	<discovery>2015-01-12</discovery>
	<entry>2015-06-22</entry>
	<modified>2015-06-23</modified>
	</dates>
	</vuln>

	<vuln vid="a3929112-181b-11e5-a1cf-002590263bf5">
	<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.8d</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cacti Group, Inc. reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8d.php">
	<p>Important Security Fixes</p>
	<ul>
	<li>Multiple XSS and SQL injection vulnerabilities</li>
	</ul>
	<p>Changelog</p>
	<ul>
	<li>bug: Fixed SQL injection VN: JVN#78187936 /
	TN:JPCERT#98968540</li>
	<li>bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting
	Vulnerability Notification</li>
	<li>bug#0002571: SQL Injection and Location header injection from
	cdef id CVE-2015-4342</li>
	<li>bug#0002572: SQL injection in graph template</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4342</cvename>
	<freebsdpr>ports/200963</freebsdpr>
	<url>http://www.cacti.net/release_notes_0_8_8d.php</url>
	<mlist>http://seclists.org/fulldisclosure/2015/Jun/19</mlist>
	</references>
	<dates>
	<discovery>2015-06-09</discovery>
	<entry>2015-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="a0e74731-181b-11e5-a1cf-002590263bf5">
	<topic>cacti -- multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.8c</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cacti Group, Inc. reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8c.php">
	<p>Important Security Fixes</p>
	<ul>
	<li>CVE-2013-5588 - XSS issue via installer or device editing</li>
	<li>CVE-2013-5589 - SQL injection vulnerability in device editing</li>
	<li>CVE-2014-2326 - XSS issue via CDEF editing</li>
	<li>CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability</li>
	<li>CVE-2014-2328 - Remote Command Execution Vulnerability in graph export</li>
	<li>CVE-2014-4002 - XSS issues in multiple files</li>
	<li>CVE-2014-5025 - XSS issue via data source editing</li>
	<li>CVE-2014-5026 - XSS issues in multiple files</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5588</cvename>
	<cvename>CVE-2013-5589</cvename>
	<cvename>CVE-2014-2326</cvename>
	<cvename>CVE-2014-2327</cvename>
	<cvename>CVE-2014-2328</cvename>
	<cvename>CVE-2014-4002</cvename>
	<cvename>CVE-2014-5025</cvename>
	<cvename>CVE-2014-5026</cvename>
	<freebsdpr>ports/198586</freebsdpr>
	<mlist>http://sourceforge.net/p/cacti/mailman/message/33072838/</mlist>
	<url>http://www.cacti.net/release_notes_0_8_8c.php</url>
	</references>
	<dates>
	<discovery>2014-11-23</discovery>
	<entry>2015-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="968d1e74-1740-11e5-a643-40a8f0757fb4">
	<topic>p5-Dancer -- possible to abuse session cookie values</topic>
	<affects>
	<package>
	<name>p5-Dancer</name>
	<range><lt>1.3138</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Russell Jenkins reports:</p>
	<blockquote cite="INSERT URL HERE">
	<p>It was possible to abuse session cookie values so that
	file-based session stores such as Dancer::Session::YAML or
	Dancer2::Session::YAML would attempt to read/write from
	any file on the filesystem with the same extension the
	file-based store uses, such as '*.yml' for the YAML
	stores.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html</url>
	</references>
	<dates>
	<discovery>2015-06-12</discovery>
	<entry>2015-06-20</entry>
	</dates>
	</vuln>

	<vuln vid="d605edb1-1616-11e5-a000-d050996490d0">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.36</lt></range>
	</package>
	<package>
	<name>drupal7</name>
	<range><lt>7.38</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal development team reports:</p>
	<blockquote cite="https://www.drupal.org/SA-CORE-2015-002">
	<h3>Impersonation (OpenID module - Drupal 6 and 7 - Critical)</h3>
	<p>A vulnerability was found in the OpenID module that allows
	a malicious user to log in as other users on the site,
	including administrators, and hijack their accounts.</p>
	<p>This vulnerability is mitigated by the fact that the victim
	must have an account with an associated OpenID identity from
	a particular set of OpenID providers (including, but not
	limited to, Verisign, LiveJournal, or StackExchange).</p>
	<h3>Open redirect (Field UI module - Drupal 7 - Less critical)</h3>
	<p>The Field UI module uses a "destinations" query string parameter
	in URLs to redirect users to new destinations after completing
	an action on a few administration pages. Under certain
	circumstances, malicious users can use this parameter to
	construct a URL that will trick users into being redirected
	to a 3rd party website, thereby exposing the users to potential
	social engineering attacks.</p>
	<p>This vulnerability is mitigated by the fact that only sites
	with the Field UI module enabled are affected.</p>
	<p>Drupal 6 core is not affected, but see the similar advisory
	for the Drupal 6 contributed CCK module:
	<a href="https://www.drupal.org/node/2507753">SA-CONTRIB-2015-126</a></p>
	<h3>Open redirect (Overlay module - Drupal 7 - Less critical)</h3>
	<p>The Overlay module displays administrative pages as a layer
	over the current page (using JavaScript), rather than replacing
	the page in the browser window. The Overlay module does not
	sufficiently validate URLs prior to displaying their contents,
	leading to an open redirect vulnerability.</p>
	<p>This vulnerability is mitigated by the fact that it can only
	be used against site users who have the "Access the administrative
	overlay" permission, and that the Overlay module must be enabled.</p>
	<h3>Information disclosure (Render cache system - Drupal 7
	- Less critical)</h3>
	<p>On sites utilizing Drupal 7's render cache system to cache
	content on the site by user role, private content viewed by
	user 1 may be included in the cache and exposed to non-privileged
	users.</p>
	<p>This vulnerability is mitigated by the fact that render caching
	is not used in Drupal 7 core itself (it requires custom code or
	the contributed <a href="https://www.drupal.org/project/render_cache">Render
	Cache</a> module to enable) and that it only affects sites that
	have user 1 browsing the live site. Exposure is also limited if an
	administrative role has been assigned to the user 1 account (which
	is done, for example, by the Standard install profile that ships
	with Drupal core).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3231</cvename>
	<cvename>CVE-2015-3232</cvename>
	<cvename>CVE-2015-3233</cvename>
	<cvename>CVE-2015-3234</cvename>
	<url>https://www.drupal.org/SA-CORE-2015-002</url>
	</references>
	<dates>
	<discovery>2015-06-17</discovery>
	<entry>2015-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="2438d4af-1538-11e5-a106-3c970e169bc2">
	<topic>cURL -- Multiple Vulnerability</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.40</ge><lt>7.43</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150617A.html">
	<p>libcurl can wrongly send HTTP credentials when re-using
	connections.</p>
	<p>libcurl allows applications to set credentials for the
	upcoming transfer with HTTP Basic authentication, like
	with CURLOPT_USERPWD for example. Name and password.
	Just like all other libcurl options the credentials
	are sticky and are kept associated with the "handle"
	until something is made to change the situation.</p>
	<p>Further, libcurl offers a curl_easy_reset() function
	that resets a handle back to its pristine state in
	terms of all settable options. A reset is of course
	also supposed to clear the credentials. A reset is
	typically used to clear up the handle and prepare
	it for a new, possibly unrelated, transfer.</p>
	<p>Within such a handle, libcurl can also store a
	set of previous connections in case a second transfer
	is requested to a host name for which an existing
	connection is already kept alive.</p>
	<p>With this flaw present, using the handle even
	after a reset would make libcurl accidentally use
	those credentials in a subsequent request if done
	to the same host name and connection as was
	previously accessed.</p>
	<p>An example case would be first requesting a password
	protected resource from one section of a web site, and
	then do a second request of a public resource from a
	completely different part of the site without
	authentication. This flaw would then inadvertently
	leak the credentials in the second request.</p>
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150617B.html">
	<p>libcurl can get tricked by a malicious SMB server to
	send off data it did not intend to.</p>
	<p>In libcurl's state machine function handling the SMB
	protocol (smb_request_state()), two length and offset
	values are extracted from data that has arrived over
	the network, and those values are subsequently used
	to figure out what data range to send back.</p>
	<p>The values are used and trusted without boundary
	checks and are just assumed to be valid. This allows
	carefully handcrafted packages to trick libcurl
	into responding and sending off data that was not
	intended. Or just crash if the values cause libcurl
	to access invalid memory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3236</cvename>
	<cvename>CVE-2015-3237</cvename>
	<url>http://curl.haxx.se/docs/adv_20150617A.html</url>
	<url>http://curl.haxx.se/docs/adv_20150617B.html</url>
	</references>
	<dates>
	<discovery>2015-06-17</discovery>
	<entry>2015-06-17</entry>
	</dates>
	</vuln>

	<vuln vid="eb8a8978-8dd5-49ce-87f4-49667b2166dd">
	<topic>rubygem-rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.22</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport4</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>rubygem-jquery-rails</name>
	<range><lt>3.1.3</lt></range>
	</package>
	<package>
	<name>rubygem-jquery-rails4</name>
	<range><lt>4.0.4</lt></range>
	</package>
	<package>
	<name>rubygem-rack</name>
	<range><lt>1.4.6</lt></range>
	</package>
	<package>
	<name>rubygem-rack15</name>
	<range><lt>1.5.4</lt></range>
	</package>
	<package>
	<name>rubygem-rack16</name>
	<range><lt>1.6.2</lt></range>
	</package>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.22</lt></range>
	</package>
	<package>
	<name>rubygem-rails4</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>rubygem-web-console</name>
	<range><lt>2.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails blog:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/">
	<p>Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web
	console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1840</cvename>
	<cvename>CVE-2015-3224</cvename>
	<cvename>CVE-2015-3225</cvename>
	<cvename>CVE-2015-3226</cvename>
	<cvename>CVE-2015-3227</cvename>
	<url>http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/</url>
	</references>
	<dates>
	<discovery>2015-06-16</discovery>
	<entry>2015-06-17</entry>
	</dates>
	</vuln>

	<vuln vid="c67069dc-0986-11e5-bb90-002590263bf5">
	<topic>testdisk -- buffer overflow with malicious disk image</topic>
	<affects>
	<package>
	<name>testdisk</name>
	<range><lt>7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CGSecurity TestDisk Changelog reports:</p>
	<blockquote cite="http://www.cgsecurity.org/wiki/TestDisk_7.0_Release">
	<p>Various fix including security fix, thanks to:</p>
	<ul>
	<li><p>Coverity scan (Static Analysis of source code)</p></li>
	<li><p>afl-fuzz (security-oriented fuzzer).</p></li>
	<li><p>Denis Andzakovic from Security Assessment for reporting an
	exploitable Stack Buffer Overflow.</p></li>
	</ul>
	</blockquote>
	<p>Denis Andzakovic reports:</p>
	<blockquote cite="http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf">
	<p>A buffer overflow is triggered within the software when a malicious
	disk image is attempted to be recovered. This may be leveraged by an
	attacker to crash TestDisk and gain control of program execution. An
	attacker would have to coerce the victim to run TestDisk against
	their malicious image.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.cgsecurity.org/wiki/TestDisk_7.0_Release</url>
	<url>http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf</url>
	</references>
	<dates>
	<discovery>2015-04-30</discovery>
	<entry>2015-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="25e0593d-13c0-11e5-9afb-3c970e169bc2">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><lt>6.0.44</lt></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.55</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.9</lt></range>
	</package>
	<package>
	<name>hadoop2</name>
	<range><le>2.6.0</le></range>
	</package>
	<package>
	<name>oozie</name>
	<range><le>4.1.0</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Software Foundation reports:</p>
	<blockquote cite="https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44">
	<p>Low: Denial of Service CVE-2014-0230</p>
	<p>When a response for a request with a request body is
	returned to the user agent before the request body is
	fully read, by default Tomcat swallows the remaining
	request body so that the next request on the connection
	may be processed. There was no limit to the size of
	request body that Tomcat would swallow. This permitted
	a limited Denial of Service as Tomcat would never close
	the connection and a processing thread would remain
	allocated to the connection.</p>
	<p>Moderate: Security Manager bypass CVE-2014-7810</p>
	<p>Malicious web applications could use expression
	language to bypass the protections of a Security
	Manager as expressions were evaluated within a
	privileged code section.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0230</cvename>
	<cvename>CVE-2014-7810</cvename>
	<url>https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44</url>
	</references>
	<dates>
	<discovery>2015-05-12</discovery>
	<entry>2015-06-16</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="c470db07-1098-11e5-b6a8-002590263bf5">
	<topic>security/ossec-hids-* -- root escalation via syscheck feature</topic>
	<affects>
	<package>
	<name>ossec-hids-server</name>
	<name>ossec-hids-client</name>
	<name>ossec-hids-local</name>
	<range><ge>2.7</ge><lt>2.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OSSEC reports:</p>
	<blockquote cite="http://www.ossec.net/?p=1198">
	<p>The CVE-2015-3222 vulnerability, which allows for root escalation
	via sys check has been fixed in OSSEC 2.8.2. This issue does not
	affect agents.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3222</cvename>
	<freebsdpr>ports/200801</freebsdpr>
	<url>http://www.ossec.net/?p=1198</url>
	<url>https://github.com/ossec/ossec-hids/releases/tag/2.8.2</url>
	</references>
	<dates>
	<discovery>2015-06-11</discovery>
	<entry>2015-06-12</entry>
	</dates>
	</vuln>

	<vuln vid="8305e215-1080-11e5-8ba2-000c2980a9f3">
	<topic>openssl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.2_2</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.2b</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_6</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><lt>2.1.7</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_12</lt></range>
	<range><ge>9.3</ge><lt>9.3_16</lt></range>
	<range><ge>8.4</ge><lt>8.4_30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL team reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20150611.txt">
	<ul>
	<li>Missing DHE man-in-the-middle protection (Logjam)
	(CVE-2015-4000)</li>
	<li>Malformed ECParameters causes infinite loop (CVE-2015-1788)</li>
	<li>Exploitable out-of-bounds read in X509_cmp_time
	(CVE-2015-1789)</li>
	<li>PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)</li>
	<li>CMS verify infinite loop with unknown hash function
	(CVE-2015-1792)</li>
	<li>Race condition handling NewSessionTicket (CVE-2015-1791)</li>
	<li>Invalid free in DTLS (CVE-2014-8176)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8176</cvename>
	<cvename>CVE-2015-1788</cvename>
	<cvename>CVE-2015-1789</cvename>
	<cvename>CVE-2015-1790</cvename>
	<cvename>CVE-2015-1791</cvename>
	<cvename>CVE-2015-1792</cvename>
	<cvename>CVE-2015-4000</cvename>
	<freebsdsa>SA-15:10.openssl</freebsdsa>
	<url>https://www.openssl.org/news/secadv_20150611.txt</url>
	</references>
	<dates>
	<discovery>2015-06-11</discovery>
	<entry>2015-06-11</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="1e63db88-1050-11e5-a4df-c485083ca99c">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-11.html">
	<p>
	Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh and Linux. These updates address vulnerabilities
	that could potentially allow an attacker to take control of the
	affected system.
	</p>
	<p>
	These updates resolve a vulnerability (CVE-2015-3096) that could be
	exploited to bypass the fix for CVE-2014-5333.
	</p>
	<p>
	These updates improve memory address randomization of the Flash heap
	for the Window 7 64-bit platform (CVE-2015-3097).
	</p>
	<p>
	These updates resolve vulnerabilities that could be exploited to
	bypass the same-origin-policy and lead to information disclosure
	(CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
	</p>
	<p>
	These updates resolve a stack overflow vulnerability that could lead
	to code execution (CVE-2015-3100).
	</p>
	<p>
	These updates resolve a permission issue in the Flash broker for
	Internet Explorer that could be exploited to perform privilege
	escalation from low to medium integrity level (CVE-2015-3101).
	</p>
	<p>
	These updates resolve an integer overflow vulnerability that could
	lead to code execution (CVE-2015-3104).
	</p>
	<p>
	These updates resolve a memory corruption vulnerability that could
	lead to code execution (CVE-2015-3105).
	</p>
	<p>
	These updates resolve use-after-free vulnerabilities that could lead
	to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
	</p>
	<p>
	These updates resolve a memory leak vulnerability that could be used
	to bypass ASLR (CVE-2015-3108).
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-11.html</url>
	<cvename>CVE-2015-3096</cvename>
	<cvename>CVE-2015-3097</cvename>
	<cvename>CVE-2015-3098</cvename>
	<cvename>CVE-2015-3099</cvename>
	<cvename>CVE-2015-3100</cvename>
	<cvename>CVE-2015-3101</cvename>
	<cvename>CVE-2015-3102</cvename>
	<cvename>CVE-2015-3103</cvename>
	<cvename>CVE-2015-3104</cvename>
	<cvename>CVE-2015-3105</cvename>
	<cvename>CVE-2015-3106</cvename>
	<cvename>CVE-2015-3107</cvename>
	<cvename>CVE-2015-3108</cvename>
	</references>
	<dates>
	<discovery>2015-06-09</discovery>
	<entry>2015-06-11</entry>
	</dates>
	</vuln>

	<vuln vid="10a6d0aa-0b1c-11e5-bb90-002590263bf5">
	<topic>libzmq4 -- V3 protocol handler vulnerable to downgrade attacks</topic>
	<affects>
	<package>
	<name>libzmq4</name>
	<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pieter Hintjens reports:</p>
	<blockquote cite="https://github.com/zeromq/libzmq/issues/1273">
	<p>It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by
	sending a ZMTP v2 or earlier header. The library accepts such
	connections without applying its security mechanism.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9721</cvename>
	<url>https://github.com/zeromq/libzmq/issues/1273</url>
	<mlist>http://www.openwall.com/lists/oss-security/2015/05/07/8</mlist>
	<freebsdpr>ports/200502</freebsdpr>
	</references>
	<dates>
	<discovery>2014-12-04</discovery>
	<entry>2015-06-10</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="8fbd4187-0f18-11e5-b6a8-002590263bf5">
	<topic>pgbouncer -- remote denial of service</topic>
	<affects>
	<package>
	<name>pgbouncer</name>
	<range><lt>1.5.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PgBouncer reports:</p>
	<blockquote cite="https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/">
	<p>Fix remote crash - invalid packet order causes lookup of NULL pointer. Not
	exploitable, just DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4054</cvename>
	<url>https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/</url>
	<mlist>http://www.openwall.com/lists/oss-security/2015/05/21/2</mlist>
	<freebsdpr>ports/200507</freebsdpr>
	</references>
	<dates>
	<discovery>2015-04-08</discovery>
	<entry>2015-06-10</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="a40ec970-0efa-11e5-90e4-d050996490d0">
	<topic>cups -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>2.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CUPS development team reports:</p>
	<blockquote cite="https://cups.org/blog.php?L1082">
	<p>The new release addresses two security vulnerabilities,
	add localizations for German and Russian, and includes
	several general bug fixes. Changes include:</p>
	<p>Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159
	exploiting the dynamic linker (STR #4609)</p>
	<p>Security: The scheduler could hang with malformed
	gzip data (STR #4602)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1158</cvename>
	<cvename>CVE-2015-1159</cvename>
	<url>https://cups.org/blog.php?L1082</url>
	<url>https://www.kb.cert.org/vuls/id/810572</url>
	</references>
	<dates>
	<discovery>2015-06-09</discovery>
	<entry>2015-06-09</entry>
	</dates>
	</vuln>

	<vuln vid="55363e65-0e71-11e5-8027-00167671dd1d">
	<topic>strongswan -- Denial-of-service and potential remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><ge>5.2.2</ge><lt>5.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>StrongSwan Project reports</p>
	<blockquote cite="https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html">
	<p>A denial-of-service and potential remote code execution vulnerability
	triggered by crafted IKE messages was discovered in strongSwan. Versions
	5.2.2 and 5.3.0 are affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3991</cvename>
	<url>https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html</url>
	</references>
	<dates>
	<discovery>2015-05-15</discovery>
	<entry>2015-06-09</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="10d14955-0e45-11e5-b6a8-002590263bf5">
	<topic>strongswan -- Information Leak Vulnerability</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><ge>4.3.0</ge><lt>5.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>strongSwan Project reports:</p>
	<blockquote cite="http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html">
	<p>An information leak vulnerability was fixed that, in certain IKEv2
	setups, allowed rogue servers with a valid certificate accepted by
	the client to trick it into disclosing user credentials (even plain
	passwords if the client accepts EAP-GTC). This was caused because
	constraints against the server's authentication were enforced too
	late. All versions since 4.3.0 are affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4171</cvename>
	<url>http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html</url>
	</references>
	<dates>
	<discovery>2015-06-08</discovery>
	<entry>2015-06-09</entry>
	</dates>
	</vuln>

	<vuln vid="838fa84a-0e25-11e5-90e4-d050996490d0">
	<topic>redis -- EVAL Lua Sandbox Escape</topic>
	<affects>
	<package>
	<name>redis</name>
	<name>redis-devel</name>
	<range><ge>2.6.0</ge><lt>2.8.21</lt></range>
	<range><ge>3.0</ge><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ben Murphy reports:</p>
	<blockquote cite="http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/">
	<p>It is possible to break out of the Lua sandbox in
	Redis and execute arbitrary code.</p>
	<p>This shouldn’t pose a threat to users under the
	trusted Redis security model where only trusted
	users can connect to the database. However, in real
	deployments there could be databases that can be
	accessed by untrusted users. The main deployments
	that are vulnerable are developers machines, places
	where redis servers can be reached via SSRF attacks
	and cloud hosting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4335</cvename>
	<url>http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/</url>
	</references>
	<dates>
	<discovery>2015-06-04</discovery>
	<entry>2015-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="bd1ab7a5-0e01-11e5-9976-a0f3c100ae18">
	<topic>tidy -- heap-buffer-overflow</topic>
	<affects>
	<package>
	<name>tidy4</name>
	<range><le>20000804_3</le></range>
	</package>
	<package>
	<name>tidy-devel</name>
	<range><le>090315.c_2</le></range>
	</package>
	<package>
	<name>tidy-lib</name>
	<range><le>090315.c_2</le></range>
	</package>
	<package>
	<name>tidy-html5</name>
	<range><lt>4.9.31</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Geoff McLane reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/633">
	<p>tidy is affected by a write out of bounds when processing malformed html files.</p>
	<p>This issue could be abused on server side applications that use php-tidy extension with user input.</p>
	<p>The issue was confirmed, analyzed, and fixed by the tidy5 maintainer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/htacg/tidy-html5/issues/217</url>
	<url>http://seclists.org/oss-sec/2015/q2/633</url>
	<url>http://seclists.org/oss-sec/2015/q3/116</url>
	<cvename>CVE-2015-5522</cvename>
	<cvename>CVE-2015-5523</cvename>
	</references>
	<dates>
	<discovery>2015-06-03</discovery>
	<entry>2015-06-08</entry>
	<modified>2015-07-15</modified>
	</dates>
	</vuln>

	<vuln vid="e69af246-0ae2-11e5-90e4-d050996490d0">
	<topic>pcre -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><lt>8.37_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Venustech ADLAB reports:</p>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1636">
	<p>PCRE library is prone to a vulnerability which leads
	to Heap Overflow. During the compilation of a malformed
	regular expression, more data is written on the malloced
	block than the expected size output by compile_regex.</p>
	</blockquote>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1638">
	<p>PCRE library is prone to a vulnerability which leads to
	Stack Overflow. Without enough bound checking inside
	match(), the stack memory could be overflowed via a
	crafted regular expression.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3210</cvename>
	<cvename>CVE-2015-3217</cvename>
	<url>https://bugs.exim.org/show_bug.cgi?id=1636</url>
	<url>https://bugs.exim.org/show_bug.cgi?id=1638</url>
	</references>
	<dates>
	<discovery>2015-05-29</discovery>
	<entry>2015-06-04</entry>
	<modified>2015-06-07</modified>
	</dates>
	</vuln>

	<vuln vid="bbc0db92-084c-11e5-bb90-002590263bf5">
	<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>hostapd</name>
	<range><lt>2.4_1</lt></range>
	</package>
	<package>
	<name>wpa_supplicant</name>
	<range><lt>2.4_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jouni Malinen reports:</p>
	<blockquote cite="http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt">
	<p>WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2
	- CVE-2015-4141)</p>
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt">
	<p>Integer underflow in AP mode WMM Action frame processing. (2015-3 -
	CVE-2015-4142)</p>
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt">
	<p>EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143,
	CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt</url>
	<url>http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt</url>
	<url>http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt</url>
	<cvename>CVE-2015-4141</cvename>
	<cvename>CVE-2015-4142</cvename>
	<cvename>CVE-2015-4143</cvename>
	<cvename>CVE-2015-4144</cvename>
	<cvename>CVE-2015-4145</cvename>
	<cvename>CVE-2015-4146</cvename>
	<mlist>http://openwall.com/lists/oss-security/2015/05/31/6</mlist>
	</references>
	<dates>
	<discovery>2015-05-04</discovery>
	<entry>2015-06-01</entry>
	</dates>
	</vuln>

	<vuln vid="65b14d39-d01f-419c-b0b8-5df60b929973">
	<topic>ffmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<name>ffmpeg0</name>
	<range><lt>0.7.17,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Please reference CVE/URL list for details</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5150</cvename>
	<cvename>CVE-2014-4609</cvename>
	<cvename>CVE-2014-8541</cvename>
	<cvename>CVE-2014-8542</cvename>
	<cvename>CVE-2014-8543</cvename>
	<cvename>CVE-2014-8545</cvename>
	<cvename>CVE-2014-8547</cvename>
	<cvename>CVE-2014-8548</cvename>
	<cvename>CVE-2014-9316</cvename>
	<cvename>CVE-2014-9317</cvename>
	<cvename>CVE-2014-9603</cvename>
	<cvename>CVE-2015-1872</cvename>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e</url>
	<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7</url>
	<url>https://ffmpeg.org/security.html</url>
	</references>
	<dates>
	<discovery>2015-03-12</discovery>
	<entry>2015-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="022255be-0895-11e5-a242-5404a68ad561">
	<topic>avidemux26 -- multiple vulnerabilities in bundled FFmpeg</topic>
	<affects>
	<package>
	<name>avidemux2</name>
	<range><lt>2.6.8</lt></range>
	</package>
	<package>
	<name>avidemux26</name>
	<range><lt>2.6.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mageia project reports:</p>
	<blockquote cite="http://advisories.mageia.org/MGASA-2015-0233.html">
	<p>Avidemux is built with a bundled set of FFmpeg libraries.
	The bundled FFmpeg version has been updated from 1.2.10
	to 1.2.12 to fix these security issues and other bugs
	fixed upstream in FFmpeg.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9316</cvename>
	<cvename>CVE-2014-9317</cvename>
	<cvename>CVE-2014-9603</cvename>
	<cvename>CVE-2014-9604</cvename>
	<cvename>CVE-2015-1872</cvename>
	<cvename>CVE-2015-3417</cvename>
	<freebsdpr>ports/200507</freebsdpr>
	<url>http://advisories.mageia.org/MGASA-2015-0233.html</url>
	</references>
	<dates>
	<discovery>2015-05-18</discovery>
	<entry>2015-06-01</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="ffe2d86c-07d9-11e5-9a28-001e67150279">
	<topic>rest-client -- plaintext password disclosure</topic>
	<affects>
	<package>
	<name>rubygem-rest-client</name>
	<range><lt>1.6.7_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The open sourced vulnerability database reports:</p>
	<blockquote cite="http://osvdb.org/show/osvdb/117461">
	<p>REST Client for Ruby contains a flaw that is due to the application
	logging password information in plaintext. This may allow a local
	attacker to gain access to password information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3448</cvename>
	<freebsdpr>ports/200504</freebsdpr>
	<url>https://github.com/rest-client/rest-client/issues/349</url>
	<url>http://osvdb.org/show/osvdb/117461</url>
	</references>
	<dates>
	<discovery>2015-01-12</discovery>
	<entry>2015-05-31</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="83a7a720-07d8-11e5-9a28-001e67150279">
	<topic>rest-client -- session fixation vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-rest-client</name>
	<range><lt>1.6.7_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andy Brody reports:</p>
	<blockquote cite="https://github.com/rest-client/rest-client/issues/369">
	<p>When Ruby rest-client processes an HTTP redirection response,
	it blindly passes along the values from any Set-Cookie headers to the
	redirection target, regardless of domain, path, or expiration.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1820</cvename>
	<freebsdpr>ports/200504</freebsdpr>
	<url>https://github.com/rest-client/rest-client/issues/369</url>
	</references>
	<dates>
	<discovery>2015-03-24</discovery>
	<entry>2015-05-31</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="cfb12f02-06e1-11e5-8fda-002590263bf5">
	<topic>cabextract -- directory traversal with UTF-8 symbols in filenames</topic>
	<affects>
	<package>
	<name>cabextract</name>
	<range><lt>1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cabextract ChangeLog reports:</p>
	<blockquote cite="http://www.cabextract.org.uk/#changes">
	<p>It was possible for cabinet files to extract to absolute file
	locations, and it was possible on Cygwin to get around cabextract's
	absolute and relative path protections by using backslashes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.cabextract.org.uk/#changes</url>
	<mlist>http://www.openwall.com/lists/oss-security/2015/02/18/3</mlist>
	<cvename>CVE-2015-2060</cvename>
	</references>
	<dates>
	<discovery>2015-02-18</discovery>
	<entry>2015-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="cc7548ef-06e1-11e5-8fda-002590263bf5">
	<topic>libmspack -- frame_end overflow which could cause infinite loop</topic>
	<affects>
	<package>
	<name>libmspack</name>
	<range><lt>0.5</lt></range>
	</package>
	<package>
	<name>cabextract</name>
	<range><lt>1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a denial of service vulnerability in libmspack. The
	libmspack code is built into cabextract, so it is also
	vulnerable.</p>
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556">
	<p>Integer overflow in the qtmd_decompress function in libmspack 0.4
	allows remote attackers to cause a denial of service (hang) via a
	crafted CAB file, which triggers an infinite loop.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9556</cvename>
	<url>https://bugs.debian.org/773041</url>
	<mlist>http://www.openwall.com/lists/oss-security/2015/01/07/2</mlist>
	</references>
	<dates>
	<discovery>2014-12-11</discovery>
	<entry>2015-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="48504af7-07ad-11e5-879c-00e0814cab4e">
	<topic>django -- Fixed session flushing in the cached_db backend</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20150531,1</lt></range>
	</package>
	<package>
	<name>py32-django-devel</name>
	<range><lt>20150531,1</lt></range>
	</package>
	<package>
	<name>py33-django-devel</name>
	<range><lt>20150531,1</lt></range>
	</package>
	<package>
	<name>py34-django-devel</name>
	<range><lt>20150531,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/may/20/security-release/">
	<p>A change to session.flush() in the cached_db session backend in
	Django 1.8 mistakenly sets the session key to an empty string
	rather than None. An empty string is treated as a valid session key
	and the session cookie is set accordingly. Any users with an empty
	string in their session cookie will use the same session store.
	session.flush() is called by django.contrib.auth.logout() and, more
	seriously, by django.contrib.auth.login() when a user switches accounts.
	If a user is logged in and logs in again to a different account
	(without logging out) the session is flushed to avoid reuse.
	After the session is flushed (and its session key becomes '') the
	account details are set on the session and the session is saved.
	Any users with an empty string in their session cookie will now be
	logged into that account.</p>
	<p>Thanks to Sam Cooke for reporting the issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2015/may/20/security-release/</url>
	<cvename>CVE-2015-3982</cvename>
	</references>
	<dates>
	<discovery>2015-05-20</discovery>
	<entry>2015-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="9471ec47-05a2-11e5-8fda-002590263bf5">
	<topic>proxychains-ng -- current path as the first directory for the library search path</topic>
	<affects>
	<package>
	<name>proxychains-ng</name>
	<range><lt>4.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mamoru TASAKA reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/430">
	<p>proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so
	and execvp() the arbitrary command user has specified.
	proxychains4 sets the current directory as the first path
	to search libproxychains4.so</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://openwall.com/lists/oss-security/2015/05/12/6</mlist>
	<mlist>http://seclists.org/oss-sec/2015/q2/430</mlist>
	<cvename>CVE-2015-3887</cvename>
	</references>
	<dates>
	<discovery>2015-05-11</discovery>
	<entry>2015-05-29</entry>
	</dates>
	</vuln>

	<vuln vid="a13500d0-0570-11e5-aab1-d050996490d0">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>1.12.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark development team reports:</p>
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html">
	<p>The following vulnerabilities have been fixed.</p>
	<ul>
	<li><p>wnpa-sec-2015-12</p>
	<p>The LBMR dissector could go into an infinite loop.
	(Bug 11036) CVE-2015-3808, CVE-2015-3809</p></li>
	<li><p>wnpa-sec-2015-13</p>
	<p>The WebSocket dissector could recurse excessively.
	(Bug 10989) CVE-2015-3810</p></li>
	<li><p>wnpa-sec-2015-14</p>
	<p>The WCP dissector could crash while decompressing data.
	(Bug 10978) CVE-2015-3811</p></li>
	<li><p>wnpa-sec-2015-15</p>
	<p>The X11 dissector could leak memory. (Bug 11088)
	CVE-2015-3812</p></li>
	<li><p>wnpa-sec-2015-16</p>
	<p>The packet reassembly code could leak memory.
	(Bug 11129) CVE-2015-3813</p></li>
	<li><p>wnpa-sec-2015-17</p>
	<p>The IEEE 802.11 dissector could go into an infinite loop.
	(Bug 11110) CVE-2015-3814</p></li>
	<li><p>wnpa-sec-2015-18</p>
	<p>The Android Logcat file parser could crash. Discovered by
	Hanno Böck. (Bug 11188) CVE-2015-3815</p></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3808</cvename>
	<cvename>CVE-2015-3809</cvename>
	<cvename>CVE-2015-3810</cvename>
	<cvename>CVE-2015-3811</cvename>
	<cvename>CVE-2015-3812</cvename>
	<cvename>CVE-2015-3813</cvename>
	<cvename>CVE-2015-3814</cvename>
	<cvename>CVE-2015-3815</cvename>
	<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-12.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-13.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-14.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-15.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-16.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-17.html</url>
	<url>https://www.wireshark.org/security/wnpa-sec-2015-18.html</url>
	</references>
	<dates>
	<discovery>2015-05-12</discovery>
	<entry>2015-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="406636fe-055d-11e5-aab1-d050996490d0">
	<topic>krb5 -- requires_preauth bypass in PKINIT-enabled KDC</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><lt>1.13.2</lt></range>
	</package>
	<package>
	<name>krb5-112</name>
	<range><lt>1.12.3_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MIT reports:</p>
	<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160">
	<p>In MIT krb5 1.12 and later, when the KDC is configured
	with PKINIT support, an unauthenticated remote attacker
	can bypass the requires_preauth flag on a client principal
	and obtain a ciphertext encrypted in the principal's
	long-term key. This ciphertext could be used to conduct
	an off-line dictionary attack against the user's password.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2694</cvename>
	<url>http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160</url>
	</references>
	<dates>
	<discovery>2015-05-25</discovery>
	<entry>2015-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="27f742f6-03f4-11e5-aab1-d050996490d0">
	<topic>cURL -- sensitive HTTP server headers also sent to proxies</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.42.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150429.html">
	<p>libcurl provides applications a way to set custom HTTP
	headers to be sent to the server by using CURLOPT_HTTPHEADER.
	A similar option is available for the curl command-line
	tool with the '--header' option.</p>
	<p>When the connection passes through an HTTP proxy the
	same set of headers is sent to the proxy as well by default.
	While this is by design, it has not necessarily been clear
	nor understood by application programmers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3153</cvename>
	<url>http://curl.haxx.se/docs/adv_20150429.html</url>
	</references>
	<dates>
	<discovery>2015-04-29</discovery>
	<entry>2015-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="6294f75f-03f2-11e5-aab1-d050996490d0">
	<topic>cURL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.42.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422A.html">
	<p>libcurl keeps a pool of its last few connections around
	after use to facilitate easy, convenient, and completely
	transparent connection re-use for applications.</p>
	<p>When doing HTTP requests NTLM authenticated, the entire
	connection becomes authenticated and not just the
	specific HTTP request which is otherwise how HTTP works.
	This makes NTLM special and a subject for special
	treatment in the code. With NTLM, once the connection is
	authenticated, no further authentication is necessary until
	the connection gets closed.</p>
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422B.html">
	<p>When doing HTTP requests Negotiate authenticated, the
	entire connection may become authenticated and not just
	the specific HTTP request which is otherwise how HTTP
	works, as Negotiate can basically use NTLM under the hood.
	curl was not adhering to this fact but would assume that
	such requests would also be authenticated per request.</p>
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422C.html">
	<p>libcurl supports HTTP "cookies" as documented in RFC 6265.
	Together with each individual cookie there are several
	different properties, but for this vulnerability we
	focus on the associated "path" element. It tells
	information about for which path on a given host the
	cookies is valid.</p>
	<p>The internal libcurl function called sanitize_cookie_path()
	that cleans up the path element as given to it from a
	remote site or when read from a file, did not properly
	validate the input. If given a path that consisted of a
	single double-quote, libcurl would index a newly
	allocated memory area with index -1 and assign a zero
	to it, thus destroying heap memory it wasn't supposed to.</p>
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422D.html">
	<p>There is a private function in libcurl called fix_hostname()
	that removes a trailing dot from the host name if there is
	one. The function is called after the host name has been
	extracted from the URL libcurl has been told to act on.</p>
	<p>If a URL is given with a zero-length host name, like in
	"http://:80" or just ":80", fix_hostname() will index the
	host name pointer with a -1 offset (as it blindly assumes
	a non-zero length) and both read and assign that address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://curl.haxx.se/docs/adv_20150422A.html</url>
	<url>http://curl.haxx.se/docs/adv_20150422B.html</url>
	<url>http://curl.haxx.se/docs/adv_20150422C.html</url>
	<url>http://curl.haxx.se/docs/adv_20150422D.html</url>
	<cvename>CVE-2014-3143</cvename>
	<cvename>CVE-2014-3144</cvename>
	<cvename>CVE-2014-3145</cvename>
	<cvename>CVE-2014-3148</cvename>
	</references>
	<dates>
	<discovery>2015-04-22</discovery>
	<entry>2015-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="607f4d44-0158-11e5-8fda-002590263bf5">
	<topic>cassandra -- remote execution of arbitrary code</topic>
	<affects>
	<package>
	<name>cassandra</name>
	<range><ge>1.2.0</ge><le>1.2.19</le></range>
	</package>
	<package>
	<name>cassandra2</name>
	<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
	<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jake Luciani reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/">
	<p>Under its default configuration, Cassandra binds an unauthenticated
	JMX/RMI interface to all network interfaces. As RMI is an API for the
	transport and remote execution of serialized Java, anyone with access
	to this interface can execute arbitrary code as the running user.</p>
	<p>Mitigation:</p>
	<p>1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade
	to a supported version of Cassandra, or manually configure encryption
	and authentication of JMX,
	(see https://wiki.apache.org/cassandra/JmxSecurity).</p>
	<p>2.0.x users should upgrade to 2.0.14</p>
	<p>2.1.x users should upgrade to 2.1.4</p>
	<p>Alternately, users of any version not wishing to upgrade can
	reconfigure JMX/RMI to enable encryption and authentication according
	to https://wiki.apache.org/cassandra/JmxSecurityor
	http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html</p>
	<p>Credit:</p>
	<p>This issue was discovered by Georgi Geshev of MWR InfoSecurity</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/</url>
	<cvename>CVE-2015-0225</cvename>
	</references>
	<dates>
	<discovery>2015-04-01</discovery>
	<entry>2015-05-24</entry>
	</dates>
	</vuln>

	<vuln vid="865863af-fb5e-11e4-8fda-002590263bf5">
	<topic>py-salt -- potential shell injection vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-salt</name>
	<range><lt>2015.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Colton Myers reports:</p>
	<blockquote cite="http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html">
	<p>In order to fix potential shell injection vulnerabilities in salt
	modules, a change has been made to the various cmd module functions.
	These functions now default to python_shell=False, which means that
	the commands will not be sent to an actual shell.</p>
	<p>The largest side effect of this change is that "shellisms", such as
	pipes, will not work by default. The modules shipped with salt have
	been audited to fix any issues that might have arisen from this
	change. Additionally, the cmd state module has been unaffected, and
	use of cmd.run in jinja is also unaffected. cmd.run calls on the
	CLI will also allow shellisms.</p>
	<p>However, custom execution modules which use shellisms in cmd calls
	will break, unless you pass python_shell=True to these calls.</p>
	<p>As a temporary workaround, you can set cmd_safe: False in your
	minion and master configs. This will revert the default, but is
	also less secure, as it will allow shell injection vulnerabilities
	to be written in custom code. We recommend you only set this
	setting for as long as it takes to resolve these issues in your
	custom code, then remove the override.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html</url>
	</references>
	<dates>
	<discovery>2015-05-11</discovery>
	<entry>2015-05-24</entry>
	</dates>
	</vuln>

	<vuln vid="384fc0b2-0144-11e5-8fda-002590263bf5">
	<topic>davmail -- fix potential CVE-2014-3566 vulnerability (POODLE)</topic>
	<affects>
	<package>
	<name>davmail</name>
	<range><lt>4.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mickaël Guessant reports:</p>
	<blockquote cite="http://sourceforge.net/p/davmail/mailman/message/33279118/">
	<p>DavMail 4.6.0 released</p>
	<p>Enhancements: Fix potential CVE-2014-3566 vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/p/davmail/mailman/message/33279118/</url>
	<url>http://sourceforge.net/p/davmail/code/2322/</url>
	<cvename>CVE-2014-3566</cvename>
	</references>
	<dates>
	<discovery>2014-10-27</discovery>
	<entry>2015-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="7927165a-0126-11e5-9d98-080027ef73ec">
	<topic>dnsmasq -- remotely exploitable buffer overflow in release candidate</topic>
	<affects>
	<package>
	<name>dnsmasq-devel</name>
	<range><ge>2.73rc6</ge><lt>2.73rc8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Kelley reports:</p>
	<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html">
	<p>Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a
	remotely exploitable buffer overflow in those trees. I just tagged
	2.[73]rc8, which includes the fix.
	</p>
	</blockquote>
	<p>(Corrections from second URL.)</p>
	</body>
	</description>
	<references>
	<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html</url>
	<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html</url>
	</references>
	<dates>
	<discovery>2015-05-15</discovery>
	<entry>2015-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="37569eb7-0125-11e5-9d98-080027ef73ec">
	<topic>dnsmasq -- data exposure and denial of service</topic>
	<affects>
	<package>
	<name>dnsmasq</name>
	<range><lt>2.72_1</lt></range>
	</package>
	<package>
	<name>dnsmasq-devel</name>
	<range><lt>2.73rc4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:
	</p>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294"><p>The tcp_request function in Dnsmasq before 2.73rc4
	does not properly handle the return value of the setup_reply function,
	which allows remote attackers to read process memory and cause a
	denial of service (out-of-bounds read and crash) via a malformed DNS
	request."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html</url>
	<cvename>CVE-2015-3294</cvename>
	<url>http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8</url>
	</references>
	<dates>
	<discovery>2015-04-07</discovery>
	<entry>2015-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="4a88e3ed-00d3-11e5-a072-d050996490d0">
	<topic>pcre -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><lt>8.37</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PCRE development team reports:</p>
	<blockquote cite="http://www.pcre.org/original/changelog.txt">
	<p>A pattern such as "((?2){0,1999}())?", which has a group
	containing a forward reference repeated a large (but limited)
	number of times within a repeated outer group that has a zero
	minimum quantifier, caused incorrect code to be compiled,
	leading to the error "internal error: previously-checked
	referenced subpattern not found" when an incorrect memory
	address was read. This bug was reported as "heap overflow",
	discovered by Kai Lu of Fortinet's FortiGuard Labs and given
	the CVE number CVE-2015-2325.</p>
	<p>A pattern such as "((?+1)(\1))/" containing a forward
	reference subroutine call within a group that also contained
	a recursive back reference caused incorrect code to be
	compiled. This bug was reported as "heap overflow",
	discovered by Kai Lu of Fortinet's FortiGuard Labs,
	and given the CVE number CVE-2015-2326.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2325</cvename>
	<cvename>CVE-2015-2326</cvename>
	<url>http://www.pcre.org/original/changelog.txt</url>
	</references>
	<dates>
	<discovery>2015-04-28</discovery>
	<entry>2015-05-22</entry>
	<modified>2015-06-07</modified>
	</dates>
	</vuln>

	<vuln vid="31de2e13-00d2-11e5-a072-d050996490d0">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.4.41</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><lt>5.5.25</lt></range>
	</package>
	<package>
	<name>php56</name>
	<range><lt>5.6.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP development team reports:</p>
	<blockquote cite="https://php.net/ChangeLog-5.php#5.6.9">
	<p>Fixed bug #69364 (PHP Multipart/form-data remote DoS
	Vulnerability). (CVE-2015-4024)</p>
	<p>Fixed bug #69418 (CVE-2006-7243 fix regressions in
	5.4+). (CVE-2015-4025)</p>
	<p>Fixed bug #69545 (Integer overflow in ftp_genlist()
	resulting in heap overflow). (CVE-2015-4022)</p>
	<p>Fixed bug #68598 (pcntl_exec() should not allow null
	char). (CVE-2015-4026)</p>
	<p>Fixed bug #69453 (Memory Corruption in phar_parse_tarfile
	when entry filename starts with null). (CVE-2015-4021)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-4021</cvename>
	<cvename>CVE-2015-4022</cvename>
	<cvename>CVE-2015-4024</cvename>
	<cvename>CVE-2015-4025</cvename>
	<cvename>CVE-2015-4026</cvename>
	<url>https://php.net/ChangeLog-5.php#5.6.9</url>
	</references>
	<dates>
	<discovery>2015-05-14</discovery>
	<entry>2015-05-22</entry>
	</dates>
	</vuln>

	<vuln vid="fc38cd83-00b3-11e5-8ebd-0026551a22dc">
	<topic>PostgreSQL -- minor security problems.</topic>
	<affects>
	<package>
	<name>postgresql90-server</name>
	<range><ge>9.0.0</ge><lt>9.0.20</lt></range>
	</package>
	<package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.16</lt></range>
	</package>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.11</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.7</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1587/">
	<p>
	This update fixes three security vulnerabilities reported in
	PostgreSQL over the past few months. Nether of these issues is seen as
	particularly urgent. However, users should examine them in case their
	installations are vulnerable:.
	</p>
	<ul>
	<li>CVE-2015-3165 Double "free" after authentication timeout.</li>
	<li>CVE-2015-3166 Unanticipated errors from the standard library.</li>
	<li>CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3165</cvename>
	<cvename>CVE-2015-3166</cvename>
	<cvename>CVE-2015-3167</cvename>
	</references>
	<dates>
	<discovery>2015-04-10</discovery>
	<entry>2015-05-22</entry>
	</dates>
	</vuln>

	<vuln vid="d0034536-ff24-11e4-a072-d050996490d0">
	<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<range><lt>1.3.5_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ProFTPd development team reports:</p>
	<blockquote cite="http://bugs.proftpd.org/show_bug.cgi?id=4169">
	<p>Vadim Melihow reported a critical issue with proftpd
	installations that use the mod_copy module's SITE CPFR/SITE
	CPTO commands; mod_copy allows these commands to be used by
	unauthenticated clients.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3306</cvename>
	<url>http://bugs.proftpd.org/show_bug.cgi?id=4169</url>
	</references>
	<dates>
	<discovery>2015-04-15</discovery>
	<entry>2015-05-20</entry>
	</dates>
	</vuln>

	<vuln vid="35431f79-fe3e-11e4-ba63-000c292ee6b8">
	<topic>ipsec-tools -- Memory leak leading to denial of service</topic>
	<affects>
	<package>
	<name>ipsec-tools</name>
	<range><lt>0.8.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Javantea reports:</p>
	<blockquote cite="https://www.altsci.com/ipsec/">
	<p>It is a null dereference crash, leading to denial of
	service against the IKE daemon.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.altsci.com/ipsec/</url>
	</references>
	<dates>
	<discovery>2015-05-18</discovery>
	<entry>2015-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="a9d456b4-fe4c-11e4-ad15-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>43.0.2357.65</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-npapi</name>
	<range><lt>43.0.2357.65</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-pulse</name>
	<range><lt>43.0.2357.65</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html">
	<p>37 security fixes in this release, including:</p>
	<ul>
	<li>[474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit
	to anonymous.</li>
	<li>[464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit
	to anonymous.</li>
	<li>[444927] High CVE-2015-1254: Cross-origin bypass in Editing.
	Credit to armin@rawsec.net.</li>
	<li>[473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit
	to Khalil Zhani.</li>
	<li>[478549] High CVE-2015-1256: Use-after-free in SVG. Credit to
	Atte Kettunen of OUSPG.</li>
	<li>[481015] High CVE-2015-1251: Use-after-free in Speech. Credit
	to SkyLined working with HP's Zero Day Initiative.</li>
	<li>[468519] Medium CVE-2015-1257: Container-overflow in SVG.
	Credit to miaubiz.</li>
	<li>[450939] Medium CVE-2015-1258: Negative-size parameter in
	libvpx. Credit to cloudfuzzer</li>
	<li>[468167] Medium CVE-2015-1259: Uninitialized value in PDFium.
	Credit to Atte Kettunen of OUSPG</li>
	<li>[474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit
	to Khalil Zhani.</li>
	<li>[466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho
	Nurminen.</li>
	<li>[476647] Medium CVE-2015-1262: Uninitialized value in Blink.
	Credit to miaubiz.</li>
	<li>[479162] Low CVE-2015-1263: Insecure download of spellcheck
	dictionary. Credit to Mike Ruddy.</li>
	<li>[481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
	Credit to K0r3Ph1L.</li>
	<li>[489518] CVE-2015-1265: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.3
	branch (currently 4.3.61.21).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html</url>
	<cvename>CVE-2015-1251</cvename>
	<cvename>CVE-2015-1252</cvename>
	<cvename>CVE-2015-1253</cvename>
	<cvename>CVE-2015-1254</cvename>
	<cvename>CVE-2015-1255</cvename>
	<cvename>CVE-2015-1256</cvename>
	<cvename>CVE-2015-1257</cvename>
	<cvename>CVE-2015-1258</cvename>
	<cvename>CVE-2015-1259</cvename>
	<cvename>CVE-2015-1260</cvename>
	<cvename>CVE-2015-1261</cvename>
	<cvename>CVE-2015-1262</cvename>
	<cvename>CVE-2015-1263</cvename>
	<cvename>CVE-2015-1264</cvename>
	<cvename>CVE-2015-1265</cvename>
	</references>
	<dates>
	<discovery>2015-05-19</discovery>
	<entry>2015-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="3d0428b2-fdfb-11e4-894f-d050996490d0">
	<topic>clamav -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.98.7</lt></range>
	</package>
	<package>
	<name>clamav-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ClamAV project reports:</p>
	<blockquote cite="http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html">
	<p>ClamAV 0.98.7 is here! This release contains new
	scanning features and bug fixes.</p>
	<p>Fix infinite loop condition on crafted y0da cryptor file.
	Identified and patch suggested by Sebastian Andrzej Siewior.
	CVE-2015-2221.</p>
	<p>Fix crash on crafted petite packed file. Reported and patch
	supplied by Sebastian Andrzej Siewior. CVE-2015-2222.</p>
	<p>Fix an infinite loop condition on a crafted "xz" archive
	file. This was reported by Dimitri Kirchner and Goulven
	Guiheux. CVE-2015-2668.</p>
	<p>Apply upstream patch for possible heap overflow in Henry
	Spencer's regex library. CVE-2015-2305.</p>
	<p>Fix crash in upx decoder with crafted file. Discovered and
	patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2170</cvename>
	<cvename>CVE-2015-2221</cvename>
	<cvename>CVE-2015-2222</cvename>
	<cvename>CVE-2015-2305</cvename>
	<cvename>CVE-2015-2668</cvename>
	<url>http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html</url>
	</references>
	<dates>
	<discovery>2015-04-29</discovery>
	<entry>2015-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="a0089e18-fc9e-11e4-bc58-001e67150279">
	<topic>rubygems -- request hijacking vulnerability</topic>
	<affects>
	<package>
	<name>ruby20-gems</name>
	<range><lt>2.4.7</lt></range>
	</package>
	<package>
	<name>ruby21-gems</name>
	<range><lt>2.4.7</lt></range>
	</package>
	<package>
	<name>ruby22-gems</name>
	<range><lt>2.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jonathan Claudius reports:</p>
	<blockquote cite="http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html">
	<p>RubyGems provides the ability of a domain to direct clients to a
	separate host that is used to fetch gems and make API calls against.
	This mechanism is implemented via DNS, specifically a SRV record
	_rubygems._tcp under the original requested domain.</p>
	<p>RubyGems did not validate the hostname returned in the SRV record
	before sending requests to it. This left clients open to a DNS
	hijack attack, whereby an attacker could return a SRV of their
	choosing and get the client to use it.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/200264</freebsdpr>
	<cvename>CVE-2015-3900</cvename>
	<url>http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html</url>
	</references>
	<dates>
	<discovery>2015-05-14</discovery>
	<entry>2015-05-17</entry>
	</dates>
	</vuln>

	<vuln vid="2780e442-fc59-11e4-b18b-6805ca1d3bb1">
	<topic>qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.11.1_19</lt></range>
	<range><ge>0.12</ge><lt>2.3.0_1</lt></range>
	</package>
	<package>
	<name>qemu-sbruno</name>
	<range><lt>2.3.50.g20150501_1</lt></range>
	</package>
	<package>
	<name>virtualbox-ose</name>
	<range><lt>4.3.28</lt></range>
	</package>
	<package>
	<name>xen-tools</name>
	<range><ge>4.5.0</ge><lt>4.5.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason Geffner, CrowdStrike Senior Security Researcher reports:</p>
	<blockquote cite="http://venom.crowdstrike.com/">
	<p>VENOM, CVE-2015-3456, is a security vulnerability in
	the virtual floppy drive code used by many computer
	virtualization platforms. This vulnerability may allow
	an attacker to escape from the confines of an affected
	virtual machine (VM) guest and potentially obtain
	code-execution access to the host. Absent mitigation,
	this VM escape could open access to the host system and
	all other VMs running on that host, potentially giving
	adversaries significant elevated access to the host's
	local network and adjacent systems.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3456</cvename>
	<freebsdpr>ports/200255</freebsdpr>
	<freebsdpr>ports/200256</freebsdpr>
	<freebsdpr>ports/200257</freebsdpr>
	<url>http://venom.crowdstrike.com/</url>
	<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-133.html</url>
	</references>
	<dates>
	<discovery>2015-04-29</discovery>
	<entry>2015-05-17</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="49d9c28c-fbad-11e4-b0fb-00269ee29e57">
	<topic>Quassel IRC -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>quassel</name>
	<range><lt>0.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Quassel IRC developers report:</p>
	<blockquote cite="http://www.quassel-irc.org/node/127">
	<p>Restarting a PostgreSQL database while Quassel Core is running
	would not properly re-initialize the database session inside Quassel,
	bringing back an old security issue (CVE-2013-4422).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283</url>
	<cvename>CVE-2015-3427</cvename>
	</references>
	<dates>
	<discovery>2015-04-23</discovery>
	<entry>2015-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="c368155a-fa83-11e4-bc58-001e67150279">
	<topic>rubygem-redcarpet -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-redcarpet</name>
	<range><lt>3.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel LeCheminant reports:</p>
	<blockquote cite="https://hackerone.com/reports/46916">
	<p>When markdown is being presented as HTML, there seems to be a
	strange interaction between _ and @ that lets an attacker insert
	malicious tags.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://openwall.com/lists/oss-security/2015/04/07/11</mlist>
	<url>https://hackerone.com/reports/46916</url>
	<url>http://danlec.com/blog/bug-in-sundown-and-redcarpet</url>
	</references>
	<dates>
	<discovery>2015-04-07</discovery>
	<entry>2015-05-14</entry>
	</dates>
	</vuln>

	<vuln vid="57325ecf-facc-11e4-968f-b888e347c638">
	<topic>dcraw -- integer overflow condition</topic>
	<affects>
	<package>
	<name>cinepaint</name>
	<!-- no known fixed version -->
	<range><ge>0.22.0</ge></range>
	</package>
	<package>
	<name>darktable</name>
	<range><lt>1.6.7</lt></range>
	</package>
	<package>
	<name>dcraw</name>
	<range><ge>7.00</ge><lt>9.26</lt></range>
	</package>
	<package>
	<name>dcraw-m</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>exact-image</name>
	<range><lt>0.9.1</lt></range>
	</package>
	<package>
	<name>flphoto</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>freeimage</name>
	<range><ge>3.13.0</ge><lt>3.16.0_1</lt></range>
	</package>
	<package>
	<name>kodi</name>
	<range><lt>14.2_1</lt></range>
	</package>
	<package>
	<name>libraw</name>
	<range><lt>0.16.1</lt></range>
	</package>
	<package>
	<name>lightzone</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>netpbm</name>
	<range><lt>10.35.96</lt></range>
	</package>
	<package>
	<name>opengtl</name>
	<!-- no known fixed version -->
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>rawstudio</name>
	<range><lt>2.0_11</lt></range>
	</package>
	<package>
	<name>ufraw</name>
	<range><lt>0.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ocert reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-006.html">
	<p>The dcraw tool, as well as several other projects re-using its
	code, suffers from an integer overflow condition which lead to a
	buffer overflow.</p>
	<p>The vulnerability concerns the 'len' variable, parsed without
	validation from opened images, used in the ljpeg_start()
	function.</p>
	<p>A maliciously crafted raw image file can be used to trigger the
	vulnerability, causing a Denial of Service condition.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3885</cvename>
	<url>http://www.ocert.org/advisories/ocert-2015-006.html</url>
	<url>https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e</url>
	<url>https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5</url>
	<url>https://sourceforge.net/p/netpbm/code/2512/</url>
	</references>
	<dates>
	<discovery>2015-04-24</discovery>
	<entry>2015-05-15</entry>
	<modified>2016-01-08</modified>
	</dates>
	</vuln>

	<vuln vid="c6e31869-f99f-11e4-9f91-6805ca0b3d42">
	<topic>phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.4.0</ge><lt>4.4.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php">
	<p>XSRF/CSRF vulnerability in phpMyAdmin setup.</p>
	<p>By deceiving a user to click on a crafted URL, it is
	possible to alter the configuration file being generated
	with phpMyAdmin setup.</p>
	<p>This vulnerability only affects the configuration file
	generation process and does not affect the effective
	configuration file. Moreover, the configuration file being
	generated is at risk only during the period when it's
	writable.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php">
	<p> Vulnerability allowing man-in-the-middle attack on API
	call to GitHub.</p>
	<p>A vulnerability in the API call to GitHub can be
	exploited to perform a man-in-the-middle attack.</p>
	<p>We consider this vulnerability to be serious.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php</url>
	<cvename>CVE-2015-3902</cvename>
	<cvename>CVE-2015-3903</cvename>
	</references>
	<dates>
	<discovery>2015-05-13</discovery>
	<entry>2015-05-13</entry>
	</dates>
	</vuln>

	<vuln vid="e206df57-f97b-11e4-b799-c485083ca99c">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.457</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.457</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-09.html">
	<p>
	Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh and Linux. These updates address vulnerabilities
	that could potentially allow an attacker to take control of the
	affected system. Adobe recommends users update their product
	installations to the latest versions.
	</p>
	<p>
	These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090,
	CVE-2015-3093).
	</p>
	<p>
	These updates resolve a heap overflow vulnerability that could lead
	to code execution (CVE-2015-3088).
	</p>
	<p>
	These updates resolve a time-of-check time-of-use (TOCTOU) race
	condition that could be exploited to bypass Protected Mode in
	Internet Explorer (CVE-2015-3081).
	</p>
	<p>
	These updates resolve validation bypass issues that could be
	exploited to write arbitrary data to the file system under user
	permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
	</p>
	<p>
	These updates resolve an integer overflow vulnerability that could
	lead to code execution (CVE-2015-3087).
	</p>
	<p>
	These updates resolve a type confusion vulnerability that could lead
	to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
	</p>
	<p>
	These updates resolve a use-after-free vulnerability that could lead
	to code execution (CVE-2015-3080).
	</p>
	<p>
	These updates resolve memory leak vulnerabilities that could be used
	to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
	</p>
	<p>
	These updates resolve a security bypass vulnerability that could lead
	to information disclosure (CVE-2015-3079), and provide additional
	hardening to protect against CVE-2015-3044.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3044</cvename>
	<cvename>CVE-2015-3077</cvename>
	<cvename>CVE-2015-3078</cvename>
	<cvename>CVE-2015-3079</cvename>
	<cvename>CVE-2015-3080</cvename>
	<cvename>CVE-2015-3081</cvename>
	<cvename>CVE-2015-3082</cvename>
	<cvename>CVE-2015-3083</cvename>
	<cvename>CVE-2015-3084</cvename>
	<cvename>CVE-2015-3085</cvename>
	<cvename>CVE-2015-3086</cvename>
	<cvename>CVE-2015-3087</cvename>
	<cvename>CVE-2015-3088</cvename>
	<cvename>CVE-2015-3089</cvename>
	<cvename>CVE-2015-3090</cvename>
	<cvename>CVE-2015-3091</cvename>
	<cvename>CVE-2015-3092</cvename>
	<cvename>CVE-2015-3093</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-09.html</url>
	</references>
	<dates>
	<discovery>2015-05-12</discovery>
	<entry>2015-05-13</entry>
	</dates>
	</vuln>

	<vuln vid="d9b43004-f5fd-4807-b1d7-dbf66455b244">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>38.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>38.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.35</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.35</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.7.0,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.7.0</lt></range>
	<range><ge>32.0</ge><lt>38.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.7.0</lt></range>
	<range><ge>32.0</ge><lt>38.0</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.7.0</lt></range>
	<range><ge>32.0</ge><lt>38.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	<p>MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0
	/ rv:31.7)</p>
	<p>MFSA-2015-47 Buffer overflow parsing H.264 video with
	Linux Gstreamer</p>
	<p>MFSA-2015-48 Buffer overflow with SVG content and CSS</p>
	<p>MFSA-2015-49 Referrer policy ignored when links opened by
	middle-click and context menu</p>
	<p>MFSA-2015-50 Out-of-bounds read and write in asm.js validation</p>
	<p>MFSA-2015-51 Use-after-free during text processing with
	vertical text enabled</p>
	<p>MFSA-2015-52 Sensitive URL encoded information written to
	Android logcat</p>
	<p>MFSA-2015-53 Use-after-free due to Media Decoder Thread creation
	during shutdown</p>
	<p>MFSA-2015-54 Buffer overflow when parsing compressed XML</p>
	<p>MFSA-2015-55 Buffer overflow and out-of-bounds read while
	parsing MP4 video metadata</p>
	<p>MFSA-2015-56 Untrusted site hosting trusted page can
	intercept webchannel responses</p>
	<p>MFSA-2015-57 Privilege escalation through IPC channel messages</p>
	<p>MFSA-2015-58 Mozilla Windows updater can be run outside
	of application directory</p>
	<p>MFSA 2015-93 Integer overflows in libstagefright while processing
	MP4 video metadata</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3079</cvename>
	<cvename>CVE-2015-0797</cvename>
	<cvename>CVE-2015-0833</cvename>
	<cvename>CVE-2015-2708</cvename>
	<cvename>CVE-2015-2709</cvename>
	<cvename>CVE-2015-2710</cvename>
	<cvename>CVE-2015-2711</cvename>
	<cvename>CVE-2015-2712</cvename>
	<cvename>CVE-2015-2713</cvename>
	<cvename>CVE-2015-2714</cvename>
	<cvename>CVE-2015-2715</cvename>
	<cvename>CVE-2015-2716</cvename>
	<cvename>CVE-2015-2717</cvename>
	<cvename>CVE-2015-2718</cvename>
	<cvename>CVE-2015-2720</cvename>
	<cvename>CVE-2015-4496</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-46/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-47/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-48/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-49/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-50/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-51/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-52/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-53/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-54/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-55/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-56/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-57/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-58/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-93/</url>
	</references>
	<dates>
	<discovery>2015-05-12</discovery>
	<entry>2015-05-12</entry>
	<modified>2015-08-28</modified>
	</dates>
	</vuln>

	<vuln vid="fe910ed6-f88d-11e4-9ae3-0050562a4d7b">
	<topic>suricata -- TLS/DER Parser Bug (DoS)</topic>
	<affects>
	<package>
	<name>suricata</name>
	<range><lt>2.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OISF Development Team reports:</p>
	<blockquote cite="https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2015-May/003406.html">
	<p>The OISF development team is pleased to announce Suricata 2.0.8.
	This release fixes a number of issues in the 2.0 series.</p>

	<p>The most important issue is a bug in the DER parser which is used to
	decode SSL/TLS certificates could crash Suricata. This issue was
	reported by Kostya Kortchinsky of the Google Security Team and was fixed
	by Pierre Chifflier of ANSSI.</p>

	<p>Those processing large numbers of (untrusted) pcap files need to update
	as a malformed pcap could crash Suricata. Again, credits go to Kostya
	Kortchinsky.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0971</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971</url>
	<url>https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7</url>
	</references>
	<dates>
	<discovery>2015-05-06</discovery>
	<entry>2015-05-12</entry>
	</dates>
	</vuln>

	<vuln vid="0b040e24-f751-11e4-b24d-5453ed2e2b49">
	<topic>libssh -- null pointer dereference</topic>
	<affects>
	<package>
	<name>libssh</name>
	<range><lt>0.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andreas Schneider reports:</p>
	<blockquote cite="https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/">
	<p>libssh versions 0.5.1 and above have a logical error in the
	handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A
	detected error did not set the session into the error state
	correctly and further processed the packet which leads to a null
	pointer dereference. This is the packet after the initial key
	exchange and doesn’t require authentication.</p>
	<p>This could be used for a Denial of Service (DoS) attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3146</cvename>
	<url>https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release</url>
	</references>
	<dates>
	<discovery>2015-04-30</discovery>
	<entry>2015-05-10</entry>
	</dates>
	</vuln>

	<vuln vid="b13af778-f4fc-11e4-a95d-ac9e174be3af">
	<topic>Vulnerability in HWP document filter</topic>
	<affects>
	<package>
	<name>libreoffice</name>
	<range><lt>4.3.7</lt></range>
	</package>
	<package>
	<name>apache-openoffice</name>
	<range><lt>4.1.1_9</lt></range>
	</package>
	<package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1677190,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1774">
	<p>The HWP filter in LibreOffice before 4.3.7 and 4.4.x before
	4.4.2 and Apache OpenOffice before 4.1.2 allows remote
	attackers to cause a denial of service (crash) or possibly
	execute arbitrary code via a crafted HWP document, which
	triggers an out-of-bounds write.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1774</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2015-1774.html</url>
	<url>https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/</url>
	</references>
	<dates>
	<discovery>2015-04-27</discovery>
	<entry>2015-05-07</entry>
	</dates>
	</vuln>

	<vuln vid="d86890da-f498-11e4-99aa-bcaec565249c">
	<topic>wordpress -- 2 cross-site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.2.2,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>4.2.2</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samuel Sidler reports:</p>
	<blockquote cite="https://wordpress.org/news/2015/05/wordpress-4-2-2/">
	<p>The Genericons icon font package, which is used in a number of
	popular themes and plugins, contained an HTML file vulnerable to
	a cross-site scripting attack. All affected themes and plugins
	hosted on WordPress.org (including the Twenty Fifteen default
	theme) have been updated today by the WordPress security team
	to address this issue by removing this nonessential file. To
	help protect other Genericons usage, WordPress 4.2.2
	proactively scans the wp-content directory for this HTML
	file and removes it. Reported by Robert Abela of Netsparker.</p>

	<p>WordPress versions 4.2 and earlier are affected by a critical
	cross-site scripting vulnerability, which could enable anonymous
	users to compromise a site. WordPress 4.2.2 includes a
	comprehensive fix for this issue.</p>

	<p>The release also includes hardening for a potential cross-site
	scripting vulnerability when using the visual editor. This issue
	was reported by Mahadev Subedi.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2015/05/wordpress-4-2-2/</url>
	</references>
	<dates>
	<discovery>2015-05-07</discovery>
	<entry>2015-05-07</entry>
	<modified>2015-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="ba4f9b19-ed9d-11e4-9118-bcaec565249c">
	<topic>wordpress -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.2.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>4.2.1</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>4.2.1</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>4.2.1</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>4.2.1</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gary Pendergast reports:</p>
	<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-2-1/">
	<p>WordPress 4.2.1 is now available. This is a critical security
	release for all previous versions and we strongly encourage you
	to update your sites immediately.</p>
	<p>A few hours ago, the WordPress team was made aware of a
	cross-site scripting vulnerability, which could enable commenters
	to compromise a site. The vulnerability was discovered by Jouko
	Pynnöne.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2015/04/wordpress-4-2-1/</url>
	</references>
	<dates>
	<discovery>2015-04-27</discovery>
	<entry>2015-05-07</entry>
	<modified>2015-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="64e6006e-f009-11e4-98c6-000c292ee6b8">
	<topic>powerdns -- Label decompression bug can cause crashes or CPU spikes</topic>
	<affects>
	<package>
	<name>powerdns</name>
	<range><lt>3.4.5</lt></range>
	</package>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>3.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PowerDNS project reports:</p>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/">
	<p>A bug was discovered in our label decompression code, making it
	possible for names to refer to themselves, thus causing a loop during
	decompression. On some platforms, this bug can be abused to cause
	crashes. On all platforms, this bug can be abused to cause
	service-affecting CPU spikes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1868</cvename>
	<cvename>CVE-2015-5470</cvename>
	<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/</url>
	<mlist>http://www.openwall.com/lists/oss-security/2015/07/10/8</mlist>
	</references>
	<dates>
	<discovery>2015-04-23</discovery>
	<entry>2015-05-01</entry>
	<modified>2015-07-12</modified>
	</dates>
	</vuln>

	<vuln vid="210f80b9-ede4-11e4-81c4-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>42.0.2311.135</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-npapi</name>
	<range><lt>42.0.2311.135</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-pulse</name>
	<range><lt>42.0.2311.135</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html">
	<p>5 security fixes in this release, including:</p>
	<ul>
	<li>[453279] High CVE-2015-1243: Use-after-free in DOM. Credit to
	Saif El-Sherei.</li>
	<li>[481777] CVE-2015-1250: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1243</cvename>
	<cvename>CVE-2015-1250</cvename>
	<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html</url>
	</references>
	<dates>
	<discovery>2015-04-28</discovery>
	<entry>2015-04-28</entry>
	</dates>
	</vuln>

	<vuln vid="b57f690e-ecc9-11e4-876c-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>42.0.2311.90</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-npapi</name>
	<range><lt>42.0.2311.90</lt></range>
	</package>
	<package>
	<!-- pcbsd -->
	<name>chromium-pulse</name>
	<range><lt>42.0.2311.90</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html">
	<p>45 new security fixes, including:</p>
	<ul>
	<li>[456518] High CVE-2015-1235: Cross-origin-bypass in HTML
	parser. Credit to anonymous.</li>
	<li>[313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink.
	Credit to Amitay Dobo.</li>
	<li>[461191] High CVE-2015-1237: Use-after-free in IPC. Credit to
	Khalil Zhani.</li>
	<li>[445808] High CVE-2015-1238: Out-of-bounds write in Skia.
	Credit to cloudfuzzer.</li>
	<li>[463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL.
	Credit to w3bd3vil.</li>
	<li>[418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip
	Moon and Matt Weston of Sandfield Information Systems.</li>
	<li>[460917] High CVE-2015-1242: Type confusion in V8. Credit to
	fcole@onshape.com.</li>
	<li>[455215] Medium CVE-2015-1244: HSTS bypass in WebSockets.
	Credit to Mike Ruddy.</li>
	<li>[444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit
	to Khalil Zhani.</li>
	<li>[437399] Medium CVE-2015-1246: Out-of-bounds read in Blink.
	Credit to Atte Kettunen of OUSPG.</li>
	<li>[429838] Medium CVE-2015-1247: Scheme issues in OpenSearch.
	Credit to Jann Horn.</li>
	<li>[380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to
	Vittorio Gambaletta (VittGam).</li>
	<li>[476786] CVE-2015-1249: Various fixes from internal audits,
	fuzzing and other initiatives. Multiple vulnerabilities in V8
	fixed at the tip of the 4.2 branch (currently 4.2.77.14).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html</url>
	<cvename>CVE-2015-1235</cvename>
	<cvename>CVE-2015-1236</cvename>
	<cvename>CVE-2015-1237</cvename>
	<cvename>CVE-2015-1238</cvename>
	<cvename>CVE-2015-1240</cvename>
	<cvename>CVE-2015-1241</cvename>
	<cvename>CVE-2015-1242</cvename>
	<cvename>CVE-2015-1244</cvename>
	<cvename>CVE-2015-1245</cvename>
	<cvename>CVE-2015-1246</cvename>
	<cvename>CVE-2015-1247</cvename>
	<cvename>CVE-2015-1248</cvename>
	<cvename>CVE-2015-1249</cvename>
	</references>
	<dates>
	<discovery>2015-04-14</discovery>
	<entry>2015-04-27</entry>
	</dates>
	</vuln>

	<vuln vid="cb9d2fcd-eb47-11e4-b03e-002590263bf5">
	<topic>wpa_supplicant -- P2P SSID processing vulnerability</topic>
	<affects>
	<package>
	<name>wpa_supplicant</name>
	<range><lt>2.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jouni Malinen reports:</p>
	<blockquote cite="http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt">
	<p>A vulnerability was found in how wpa_supplicant uses SSID information
	parsed from management frames that create or update P2P peer entries
	(e.g., Probe Response frame or number of P2P Public Action frames). SSID
	field has valid length range of 0-32 octets. However, it is transmitted
	in an element that has a 8-bit length field and potential maximum
	payload length of 255 octets. wpa_supplicant was not sufficiently
	verifying the payload length on one of the code paths using the SSID
	received from a peer device.</p>
	<p>This can result in copying arbitrary data from an attacker to a fixed
	length buffer of 32 bytes (i.e., a possible overflow of up to 223
	bytes). The SSID buffer is within struct p2p_device that is allocated
	from heap. The overflow can override couple of variables in the struct,
	including a pointer that gets freed. In addition about 150 bytes (the
	exact length depending on architecture) can be written beyond the end of
	the heap allocation.</p>
	<p>This could result in corrupted state in heap, unexpected program
	behavior due to corrupted P2P peer device information, denial of service
	due to wpa_supplicant process crash, exposure of memory contents during
	GO Negotiation, and potentially arbitrary code execution.</p>
	<p>Vulnerable versions/configurations</p>
	<p>wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled
	(which is not compiled by default).</p>
	<p>Attacker (or a system controlled by the attacker) needs to be within
	radio range of the vulnerable system to send a suitably constructed
	management frame that triggers a P2P peer device information to be
	created or updated.</p>
	<p>The vulnerability is easiest to exploit while the device has started an
	active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control
	interface command in progress). However, it may be possible, though
	significantly more difficult, to trigger this even without any active
	P2P operation in progress.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1863</cvename>
	<url>http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt</url>
	</references>
	<dates>
	<discovery>2015-04-22</discovery>
	<entry>2015-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="1e232a0c-eb57-11e4-b595-4061861086c1">
	<topic>Several vulnerabilities found in PHP</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.4.40</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><lt>5.5.24</lt></range>
	</package>
	<package>
	<name>php56</name>
	<range><lt>5.6.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/archive/2015.php#id2015-04-16-2">
	<p>The PHP development team announces the immediate
	availability of PHP 5.4.40. 14 security-related
	bugs were fixed in this release, including
	CVE-2014-9709, CVE-2015-2301, CVE-2015-2783,
	CVE-2015-1352. All PHP 5.4 users are encouraged to
	upgrade to this version.</p>
	<p>The PHP development team announces the immediate
	availability of PHP 5.5.24. Several bugs have been
	fixed, some of them being security related, like
	CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users
	are encouraged to upgrade to this version.</p>
	<p>The PHP development team announces the immediate
	availability of PHP 5.6.8. Several bugs have been
	fixed, some of them being security related, like
	CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users
	are encouraged to upgrade to this version.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/archive/2015.php#id2015-04-16-2</url>
	<cvename>CVE-2014-9709</cvename>
	<cvename>CVE-2015-2301</cvename>
	<cvename>CVE-2015-2783</cvename>
	<cvename>CVE-2015-1351</cvename>
	<cvename>CVE-2015-1352</cvename>
	<freebsdpr>ports/199585</freebsdpr>
	</references>
	<dates>
	<discovery>2015-04-16</discovery>
	<entry>2015-04-25</entry>
	<modified>2015-05-22</modified>
	</dates>
	</vuln>

	<vuln vid="505904d3-ea95-11e4-beaf-bcaec565249c">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>4.1.2</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gary Pendergast reports:</p>
	<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-1-2/">
	<p>WordPress 4.1.2 is now available. This is a critical security
	release for all previous versions and we strongly encourage you
	to update your sites immediately.</p>
	<p>WordPress versions 4.1.1 and earlier are affected by a critical
	cross-site scripting vulnerability, which could enable anonymous
	users to compromise a site. This was reported by Cedric Van
	Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew
	Nacin of the WordPress security team.</p>
	<p>We also fixed three other security issues:</p>
	<ul>
	<li>In WordPress 4.1 and higher, files with invalid or unsafe
	names could be uploaded. Discovered by Michael Kapfer and
	Sebastian Kraemer of HSASec.</li>
	<li>In WordPress 3.9 and higher, a very limited cross-site
	scripting vulnerability could be used as part of a social
	engineering attack. Discovered by Jakub Zoczek.</li>
	<li>Some plugins were vulnerable to an SQL injection
	vulnerability. Discovered by Ben Bidner of the WordPress
	security team.</li>
	</ul>
	<p>We also made four hardening changes, discovered by J.D. Grimes,
	Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and
	Jeff Bowen.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wordpress.org/news/2015/04/wordpress-4-1-2/</url>
	</references>
	<dates>
	<discovery>2015-04-21</discovery>
	<entry>2015-04-24</entry>
	<modified>2015-04-24</modified>
	</dates>
	</vuln>

	<vuln vid="82595123-e8b8-11e4-a008-047d7b492d07">
	<topic>libtasn1 -- stack-based buffer overflow in asn1_der_decoding</topic>
	<affects>
	<package>
	<name>libtasn1</name>
	<range><lt>4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://www.debian.org/security/2015/dsa-3220.en.html">
	<p>Hanno Boeck discovered a stack-based buffer overflow in
	the asn1_der_decoding function in Libtasn1, a library to
	manage ASN.1 structures. A remote attacker could take advantage
	of this flaw to cause an application using the Libtasn1 library
	to crash, or potentially to execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2806</cvename>
	<url>https://www.debian.org/security/2015/dsa-3220.en.html</url>
	</references>
	<dates>
	<discovery>2015-04-11</discovery>
	<entry>2015-04-22</entry>
	</dates>
	</vuln>

	<vuln vid="738fc80d-5f13-4ccb-aa9a-7965699e5a10">
	<topic>mozilla -- use-after-free</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>37.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>37.0.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	<p>MFSA 2015-45 Memory corruption during failed plugin
	initialization</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-2706</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/</url>
	</references>
	<dates>
	<discovery>2015-04-20</discovery>
	<entry>2015-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="dec3164f-3121-45ef-af18-bb113ac5082f">
	<topic>sqlite -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>sqlite3</name>
	<range><lt>3.8.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3414">
	<p>SQLite before 3.8.9 does not properly implement the
	dequoting of collation-sequence names, which allows
	context-dependent attackers to cause a denial of service
	(uninitialized memory access and application crash) or
	possibly have unspecified other impact via a crafted
	COLLATE clause, as demonstrated by COLLATE"""""""" at the
	end of a SELECT statement.</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3415">
	<p>The sqlite3VdbeExec function in vdbe.c in SQLite before
	3.8.9 does not properly implement comparison operators,
	which allows context-dependent attackers to cause a denial
	of service (invalid free operation) or possibly have
	unspecified other impact via a crafted CHECK clause, as
	demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
	</p>
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3416">
	<p>The sqlite3VXPrintf function in printf.c in SQLite before
	3.8.9 does not properly handle precision and width values
	during floating-point conversions, which allows
	context-dependent attackers to cause a denial of service
	(integer overflow and stack-based buffer overflow) or
	possibly have unspecified other impact via large integers
	in a crafted printf function call in a SELECT statement.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-3414</cvename>
	<cvename>CVE-2015-3415</cvename>
	<cvename>CVE-2015-3416</cvename>
	<url>https://www.sqlite.org/src/info/eddc05e7bb31fae7</url>
	<url>https://www.sqlite.org/src/info/02e3c88fbf6abdcf</url>
	<url>https://www.sqlite.org/src/info/c494171f77dc2e5e</url>
	<mlist>http://seclists.org/fulldisclosure/2015/Apr/31</mlist>
	</references>
	<dates>
	<discovery>2015-04-14</discovery>
	<entry>2015-04-18</entry>
	<modified>2015-05-08</modified>
	</dates>
	</vuln>

	<vuln vid="c4571ca8-053d-44c9-ab3c-89b1372ad0a5">
	<topic>chrony -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chrony</name>
	<range><lt>1.31.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chrony News reports:</p>
	<blockquote cite="http://chrony.tuxfamily.org/News.html">
	<p>CVE-2015-1853: DoS attack on authenticated symmetric NTP
	associations</p>
	<p>CVE-2015-1821: Heap-based buffer overflow in access
	configuration</p>
	<p>CVE-2015-1822: Use of uninitialized pointer in command
	processing</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://chrony.tuxfamily.org/News.html</url>
	<cvename>CVE-2015-1821</cvename>
	<cvename>CVE-2015-1822</cvename>
	<cvename>CVE-2015-1853</cvename>
	</references>
	<dates>
	<discovery>2015-02-17</discovery>
	<entry>2015-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="e426eda9-dae1-11e4-8107-94de806b0af9">
	<topic>Dulwich -- Remote code execution</topic>
	<affects>
	<package>
	<name>py27-dulwich</name>
	<range><lt>0.9.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0838">
	<p>Buffer overflow in the C implementation of the apply_delta
	function in _pack.c in Dulwich before 0.9.9 allows remote
	attackers to execute arbitrary code via a crafted pack file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0838</cvename>
	</references>
	<dates>
	<discovery>2015-01-07</discovery>
	<entry>2015-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="3364d497-e4e6-11e4-a265-c485083ca99c">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.451</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.451</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html">
	<p>
	Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh and Linux. These updates address vulnerabilities
	that could potentially allow an attacker to take control of the
	affected system. Adobe is aware of a report that an exploit for
	CVE-2015-3043 exists in the wild, and recommends users update their
	product installations to the latest versions.
	</p>
	<ul>
	<li>
	These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
	CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
	CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
	</li>
	<li>
	These updates resolve a type confusion vulnerability that could lead
	to code execution (CVE-2015-0356).
	</li>
	<li>
	These updates resolve a buffer overflow vulnerability that could
	lead to code execution (CVE-2015-0348).
	</li>
	<li>
	These updates resolve use-after-free vulnerabilities that could lead
	to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
	CVE-2015-3039).
	</li>
	<li>
	These updates resolve double-free vulnerabilities that could lead to
	code execution (CVE-2015-0346, CVE-2015-0359).
	</li>
	<li>
	These updates resolve memory leak vulnerabilities that could be used
	to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
	</li>
	<li>
	These updates resolve a security bypass vulnerability that could
	lead to information disclosure (CVE-2015-3044).
	</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-06.html</url>
	<cvename>CVE-2015-3038</cvename>
	<cvename>CVE-2015-3039</cvename>
	<cvename>CVE-2015-3040</cvename>
	<cvename>CVE-2015-3041</cvename>
	<cvename>CVE-2015-3042</cvename>
	<cvename>CVE-2015-3043</cvename>
	<cvename>CVE-2015-3044</cvename>
	<cvename>CVE-2015-0346</cvename>
	<cvename>CVE-2015-0347</cvename>
	<cvename>CVE-2015-0348</cvename>
	<cvename>CVE-2015-0349</cvename>
	<cvename>CVE-2015-0350</cvename>
	<cvename>CVE-2015-0351</cvename>
	<cvename>CVE-2015-0352</cvename>
	<cvename>CVE-2015-0353</cvename>
	<cvename>CVE-2015-0354</cvename>
	<cvename>CVE-2015-0355</cvename>
	<cvename>CVE-2015-0356</cvename>
	<cvename>CVE-2015-0357</cvename>
	<cvename>CVE-2015-0358</cvename>
	<cvename>CVE-2015-0359</cvename>
	<cvename>CVE-2015-0360</cvename>
	</references>
	<dates>
	<discovery>2015-04-14</discovery>
	<entry>2015-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="ba326a36-5f02-452d-a215-31e7b06d5edf">
	<topic>Wesnoth -- Remote information disclosure</topic>
	<affects>
	<package>
	<name>wesnoth</name>
	<name>wesnoth-devel</name>
	<range><ge>1.7.0</ge><lt>1.12.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0844">
	<p>The WML/Lua API in Battle for Wesnoth 1.7.x through
	1.11.x and 1.12.x before 1.12.2 allows remote attackers to
	read arbitrary files via a crafted (1) campaign or (2) map
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0844</cvename>
	</references>
	<dates>
	<discovery>2015-04-11</discovery>
	<entry>2015-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="5713bfda-e27d-11e4-b2ce-5453ed2e2b49">
	<topic>qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling</topic>
	<affects>
	<package>
	<name>qt4-imageformats</name>
	<range><lt>4.8.6_3</lt></range>
	</package>
	<package>
	<name>qt4-gui</name>
	<range><lt>4.8.6_5</lt></range>
	</package>
	<package>
	<name>qt5-gui</name>
	<range><lt>5.4.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Richard J. Moore reports:</p>
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-April/000067.html">
	<p>Due to two recent vulnerabilities identified in the built-in image
	format handling code, it was decided that this area required further
	testing to determine if further issues remained. Fuzzing using
	afl-fuzz located a number of issues in the handling of BMP, ICO and
	GIF files. The issues exposed included denial of service and buffer
	overflows leading to heap corruption. It is possible the latter could
	be used to perform remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist>http://lists.qt-project.org/pipermail/announce/2015-April/000067.html</mlist>
	<cvename>CVE-2015-1858</cvename>
	<cvename>CVE-2015-1859</cvename>
	<cvename>CVE-2015-1860</cvename>
	</references>
	<dates>
	<discovery>2015-04-12</discovery>
	<entry>2015-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="d4379f59-3e9b-49eb-933b-61de4d0b0fdb">
	<topic>Ruby -- OpenSSL Hostname Verification Vulnerability</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby20</name>
	<range><ge>2.0,1</ge><lt>2.0.0.645,1</lt></range>
	</package>
	<package>
	<name>ruby</name>
	<name>ruby21</name>
	<range><ge>2.1,1</ge><lt>2.1.6,1</lt></range>
	</package>
	<package>
	<name>ruby</name>
	<name>ruby22</name>
	<range><ge>2.2,1</ge><lt>2.2.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Developers report:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/">
	<p>After reviewing RFC 6125 and RFC 5280, we found multiple violations
	of matching hostnames and particularly wildcard certificates.</p>
	<p>Ruby’s OpenSSL extension will now provide a string-based matching
	algorithm which follows more strict behavior, as recommended by
	these RFCs. In particular, matching of more than one wildcard per
	subject/SAN is no-longer allowed. As well, comparison of these
	values are now case-insensitive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/</url>
	<cvename>CVE-2015-1855</cvename>
	</references>
	<dates>
	<discovery>2015-04-13</discovery>
	<entry>2015-04-14</entry>
	<modified>2015-09-23</modified>
	</dates>
	</vuln>

	<vuln vid="a5f160fa-deee-11e4-99f8-080027ef73ec">
	<topic>mailman -- path traversal vulnerability</topic>
	<affects>
	<package>
	<name>mailman</name>
	<range><lt>2.1.20</lt></range>
	</package>
	<package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.20</lt></range>
	</package>
	<package>
	<name>ja-mailman</name>
	<range><lt>2.1.14.j7_2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Sapiro reports:</p>
	<blockquote cite="https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html">
	<p>A path traversal vulnerability has been discovered and fixed. This
	vulnerability is only exploitable by a local user on a Mailman
	server where the suggested Exim transport, the Postfix
	postfix_to_mailman.py transport or some other programmatic MTA
	delivery not using aliases is employed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html</url>
	<url>https://bugs.launchpad.net/mailman/+bug/1437145</url>
	<cvename>CVE-2015-2775</cvename>
	</references>
	<dates>
	<discovery>2015-03-27</discovery>
	<entry>2015-04-09</entry>
	<modified>2015-06-17</modified>
	</dates>
	</vuln>

	<vuln vid="5fee3f02-de37-11e4-b7c3-001999f8d30b">
	<topic>asterisk -- TLS Certificate Common name NULL byte exploit</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><lt>1.8.32.3</lt></range>
	</package>
	<package>
	<name>asterisk11</name>
	<range><lt>11.17.1</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>When Asterisk registers to a SIP TLS device and and
	verifies the server, Asterisk will accept signed certificates
	that match a common name other than the one Asterisk is
	expecting if the signed certificate has a common name
	containing a null byte after the portion of the common
	name that Asterisk expected. For example, if Asterisk is
	trying to register to www.domain.com, Asterisk will accept
	certificates of the form
	www.domain.com\x00www.someotherdomain.com</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2015-003.html</url>
	<cvename>CVE-2015-3008</cvename>
	</references>
	<dates>
	<discovery>2015-04-04</discovery>
	<entry>2015-04-08</entry>
	</dates>
	</vuln>

	<vuln vid="ebd84c96-dd7e-11e4-854e-3c970e169bc2">
	<topic>ntp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.8p2</lt></range>
	</package>
	<package>
	<name>ntp-devel</name>
	<range><lt>4.3.14</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_13</lt></range>
	<range><ge>8.4</ge><lt>8.4_27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ntp.org reports:</p>
	<blockquote cite="http://archive.ntp.org/ntp4/ChangeLog-stable">
	<ul>
	<li>[Sec 2779] ntpd accepts unauthenticated packets
	with symmetric key crypto.</li>
	<li>[Sec 2781] Authentication doesn't protect symmetric
	associations against DoS attacks.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:07.ntp</freebsdsa>
	<cvename>CVE-2015-1798</cvename>
	<cvename>CVE-2015-1799</cvename>
	<url>http://archive.ntp.org/ntp4/ChangeLog-stable</url>
	</references>
	<dates>
	<discovery>2015-04-07</discovery>
	<entry>2015-04-07</entry>
	</dates>
	</vuln>

	<vuln vid="b8321d76-24e7-4b72-a01d-d12c4445d826">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>37.0.1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>37.0.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	<p>MFSA 2015-44 Certificate verification bypass through the
	HTTP/2 Alt-Svc header</p>
	<p>MFSA 2015-43 Loading privileged content through Reader
	mode</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0798</cvename>
	<cvename>CVE-2015-0799</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-43/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-44/</url>
	<url>https://www.mozilla.org/security/advisories/</url>
	</references>
	<dates>
	<discovery>2015-04-03</discovery>
	<entry>2015-04-04</entry>
	</dates>
	</vuln>

	<vuln vid="2f75141c-da1d-11e4-8d32-5404a68ad561">
	<topic>Several vulnerabilities in libav</topic>
	<affects>
	<package>
	<name>libav</name>
	<range><lt>11.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The libav project reports:</p>
	<blockquote cite="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3">
	<p>utvideodec: Handle slice_height being zero (CVE-2014-9604)</p>
	<p>tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3</url>
	<cvename>CVE-2014-8544</cvename>
	<cvename>CVE-2014-9604</cvename>
	</references>
	<dates>
	<discovery>2015-03-24</discovery>
	<entry>2015-04-03</entry>
	</dates>
	</vuln>

	<vuln vid="742563d4-d776-11e4-b595-4061861086c1">
	<topic>Several vulnerabilities found in PHP</topic>
	<affects>
	<package>
	<name>php53</name>
	<range><le>5.3.29_5</le></range>
	</package>
	<package>
	<name>php5</name>
	<range><lt>5.4.39</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><lt>5.5.23</lt></range>
	</package>
	<package>
	<name>php56</name>
	<range><lt>5.6.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP project reports:</p>
	<blockquote cite="http://php.net/archive/2015.php#id2015-03-20-2">
	<p>The PHP development team announces the immediate
	availability of PHP 5.6.7. Several bugs have been
	fixed as well as CVE-2015-0231, CVE-2015-2305 and
	CVE-2015-2331. All PHP 5.6 users are encouraged to
	upgrade to this version.</p>
	<p>The PHP development team announces the immediate
	availability of PHP 5.5.23. Several bugs have been
	fixed as well as CVE-2015-0231, CVE-2015-2305 and
	CVE-2015-2331. All PHP 5.5 users are encouraged
	to upgrade to this version.</p>
	<p>The PHP development team announces the immediate
	availability of PHP 5.4.39. Six security-related
	bugs were fixed in this release, including
	CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331.
	All PHP 5.4 users are encouraged to upgrade to
	this version.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php.net/archive/2015.php#id2015-03-20-2</url>
	<cvename>CVE-2015-0231</cvename>
	<cvename>CVE-2015-2305</cvename>
	<cvename>CVE-2015-2311</cvename>
	<freebsdpr>ports/198739</freebsdpr>
	</references>
	<dates>
	<discovery>2015-03-19</discovery>
	<entry>2015-04-01</entry>
	</dates>
	</vuln>

	<vuln vid="8e887b71-d769-11e4-b1c2-20cf30e32f6d">
	<topic>subversion -- DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>mod_dav_svn</name>
	<range><ge>1.5.0</ge><lt>1.7.20</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
	</package>
	<package>
	<name>subversion16</name>
	<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
	</package>
	<package>
	<name>subversion17</name>
	<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
	</package>
	<package>
	<name>subversion</name>
	<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/">
	<p>Subversion HTTP servers with FSFS repositories are vulnerable to a remotely
	triggerable excessive memory use with certain REPORT requests.</p>
	<p>Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable
	assertion DoS vulnerability for certain requests with dynamically evaluated
	revision numbers.</p>
	<p>Subversion HTTP servers allow spoofing svn:author property values for new
	revisions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://subversion.apache.org/security/</url>
	<cvename>CVE-2015-0202</cvename>
	<cvename>CVE-2015-0248</cvename>
	<cvename>CVE-2015-0251</cvename>
	<url>http://subversion.apache.org/security/CVE-2015-0202-advisory.txt</url>
	<url>http://subversion.apache.org/security/CVE-2015-0248-advisory.txt</url>
	<url>http://subversion.apache.org/security/CVE-2015-0251-advisory.txt</url>
	</references>
	<dates>
	<discovery>2015-03-31</discovery>
	<entry>2015-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="d0c97697-df2c-4b8b-bff2-cec24dc35af8">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>37.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.6.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>37.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.34</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.6.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.34</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.6.0</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	<p>MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0
	/ rv:31.6)</p>
	<p>MFSA-2015-31 Use-after-free when using the Fluendo MP3
	GStreamer plugin</p>
	<p>MFSA-2015-32 Add-on lightweight theme installation
	approval bypassed through MITM attack</p>
	<p>MFSA-2015-33 resource:// documents can load privileged
	pages</p>
	<p>MFSA-2015-34 Out of bounds read in QCMS library</p>
	<p>MFSA-2015-35 Cursor clickjacking with flash and images</p>
	<p>MFSA-2015-36 Incorrect memory management for simple-type
	arrays in WebRTC</p>
	<p>MFSA-2015-37 CORS requests should not follow 30x
	redirections after preflight</p>
	<p>MFSA-2015-38 Memory corruption crashes in Off Main Thread
	Compositing</p>
	<p>MFSA-2015-39 Use-after-free due to type confusion flaws</p>
	<p>MFSA-2015-40 Same-origin bypass through anchor navigation</p>
	<p>MFSA-2015-41 PRNG weakness allows for DNS poisoning on
	Android</p>
	<p>MFSA-2015-42 Windows can retain access to privileged
	content on navigation to unprivileged pages</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2808</cvename>
	<cvename>CVE-2015-0800</cvename>
	<cvename>CVE-2015-0801</cvename>
	<cvename>CVE-2015-0802</cvename>
	<cvename>CVE-2015-0803</cvename>
	<cvename>CVE-2015-0804</cvename>
	<cvename>CVE-2015-0805</cvename>
	<cvename>CVE-2015-0806</cvename>
	<cvename>CVE-2015-0807</cvename>
	<cvename>CVE-2015-0808</cvename>
	<cvename>CVE-2015-0810</cvename>
	<cvename>CVE-2015-0811</cvename>
	<cvename>CVE-2015-0812</cvename>
	<cvename>CVE-2015-0813</cvename>
	<cvename>CVE-2015-0814</cvename>
	<cvename>CVE-2015-0815</cvename>
	<cvename>CVE-2015-0816</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-30/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-31/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-32/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-33/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-34/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-35/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-36/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-37/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-38/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-39/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-40/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-41/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-42/</url>
	<url>https://www.mozilla.org/security/advisories/</url>
	</references>
	<dates>
	<discovery>2015-03-31</discovery>
	<entry>2015-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="f450587b-d7bd-11e4-b5a4-14dae9d5a9d2">
	<topic>osc -- shell command injection via crafted _service files</topic>
	<affects>
	<package>
	<name>osc</name>
	<range><lt>0.151.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SUSE Security Update reports:</p>
	<blockquote cite="https://www.suse.com/security/cve/CVE-2015-0778.html">
	<p>osc before 0.151.0 allows remote attackers to execute
	arbitrary commands via shell metacharacters in a _service
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0778</cvename>
	<url>https://www.suse.com/security/cve/CVE-2015-0778.html</url>
	<url>https://bugzilla.suse.com/show_bug.cgi?id=901643</url>
	<url>http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html</url>
	</references>
	<dates>
	<discovery>2015-03-16</discovery>
	<entry>2015-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8">
	<topic>cpio -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gcpio</name>
	<range><lt>2.11_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the Debian Security Team:</p>
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2014-9112">
	<p>Heap-based buffer overflow in the process_copy_in
	function in GNU Cpio 2.11 allows remote attackers to cause
	a denial of service via a large block value in a cpio
	archive.</p>
	</blockquote>
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2015-1197">
	<p>cpio 2.11, when using the --no-absolute-filenames
	option, allows local users to write to arbitrary files
	via a symlink attack on a file in an archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9112</cvename>
	<url>https://security-tracker.debian.org/tracker/CVE-2014-9112</url>
	<cvename>CVE-2015-1197</cvename>
	<url>https://bugzilla.suse.com/show_bug.cgi?id=658010</url>
	</references>
	<dates>
	<discovery>2015-03-27</discovery>
	<entry>2015-03-31</entry>
	</dates>
	</vuln>

	<vuln vid="264749ae-d565-11e4-b545-00269ee29e57">
	<topic>libzip -- integer overflow</topic>
	<affects>
	<package>
	<name>libzip</name>
	<range><lt>0.11.2_2</lt></range>
	</package>
	<package>
	<name>ppsspp</name>
	<range><lt>1.0.1_5</lt></range>
	</package>
	<package>
	<name>ppsspp-devel</name>
	<range><lt>1.0.1.2668_1</lt></range>
	</package>
	<package>
	<name>radare2</name>
	<range><lt>0.9.8_1</lt></range>
	</package>
	<package>
	<name>openlierox</name>
	<range><lt>0.58.r3_5,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libzip developers report:</p>
	<blockquote cite="http://hg.nih.at/libzip/rev/9f11d54f692e">
	<p>Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=69253</url>
	<url>https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5</url>
	<url>http://hg.nih.at/libzip/rev/9f11d54f692e</url>
	<cvename>CVE-2015-2331</cvename>
	</references>
	<dates>
	<discovery>2015-03-18</discovery>
	<entry>2015-03-28</entry>
	<modified>2015-09-20</modified>
	</dates>
	</vuln>

	<vuln vid="62287f51-d43d-11e4-879c-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20150326,1</lt></range>
	</package>
	<package>
	<name>py32-django-devel</name>
	<range><lt>20150326,1</lt></range>
	</package>
	<package>
	<name>py33-django-devel</name>
	<range><lt>20150326,1</lt></range>
	</package>
	<package>
	<name>py34-django-devel</name>
	<range><lt>20150326,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/mar/18/security-releases/">
	<p>In accordance with our security release policy, the Django team
	is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and
	1.8c1. These releases are now available on PyPI and our download
	page. These releases address several security issues detailed
	below. We encourage all users of Django to upgrade as soon as
	possible. The Django master branch has also been updated.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2015/mar/18/security-releases/</url>
	<cvename>CVE-2015-2316</cvename>
	<cvename>CVE-2015-2317</cvename>
	</references>
	<dates>
	<discovery>2015-03-18</discovery>
	<entry>2015-03-27</entry>
	</dates>
	</vuln>

	<vuln vid="f6a014cd-d268-11e4-8339-001e679db764">
	<topic>GNU binutils -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cross-binutils</name>
	<range><lt>2.25</lt></range>
	</package>
	<package>
	<name>x86_64-pc-mingw32-binutils</name>
	<range><lt>2.25</lt></range>
	</package>
	<package>
	<name>m6811-binutils</name>
	<range><lt>2.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501">
	<p>The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU
	binutils 2.24 and earlier allows remote attackers to cause a
	denial of service (out-of-bounds write) and possibly have other
	unspecified impact via a crafted NumberOfRvaAndSizes field in the
	AOUT header in a PE executable.</p>
	</blockquote>
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502">
	<p>Heap-based buffer overflow in the pe_print_edata function in
	bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
	attackers to cause a denial of service (crash) and possibly have
	other unspecified impact via a truncated export table in a PE
	file.</p>
	</blockquote>
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503">
	<p>Stack-based buffer overflow in the ihex_scan function in
	bfd/ihex.c in GNU binutils 2.24 and earlier allows remote
	attackers to cause a denial of service (crash) and possibly have
	other unspecified impact via a crafted ihex file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8501</cvename>
	<cvename>CVE-2014-8502</cvename>
	<cvename>CVE-2014-8503</cvename>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501</url>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502</url>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503</url>
	</references>
	<dates>
	<discovery>2014-12-09</discovery>
	<entry>2015-03-24</entry>
	<modified>2016-01-08</modified>
	</dates>
	</vuln>

	<vuln vid="996bce94-d23d-11e4-9463-9cb654ea3e1c">
	<topic>libuv -- incorrect revocation order while relinquishing privileges</topic>
	<affects>
	<package>
	<name>node010</name>
	<range><lt>0.10.36</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nodejs releases reports:</p>
	<blockquote cite="http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable">
	<h5>CVE-2015-0278</h5>
	<p>This may potentially allow an attacker to gain elevated privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable</url>
	<freebsdpr>ports/198861</freebsdpr>
	<cvename>CVE-2015-0278</cvename>
	</references>
	<dates>
	<discovery>2015-03-14</discovery>
	<entry>2015-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="22dc4a22-d1e5-11e4-879c-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>1.605</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>1.596.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23">
	<h1>Description</h1>
	<h5>SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)</h5>
	<p>An attacker without any access to Jenkins can navigate the user
	to a carefully crafted URL and have the user execute unintended
	actions. This vulnerability can be used to attack Jenkins inside
	firewalls from outside so long as the location of Jenkins is known
	to the attacker.</p>
	<h5>SECURITY-180 (forced API token change)</h5>
	<p>The part of Jenkins that issues a new API token was not
	adequately protected against anonymous attackers. This allows an
	attacker to escalate privileges on Jenkins.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23</url>
	</references>
	<dates>
	<discovery>2015-03-23</discovery>
	<entry>2015-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="76ff65f4-17ca-4d3f-864a-a3d6026194fb">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>36.0.4,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.5.3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>36.0.4,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.33.1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.33.1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	<p>MFSA-2015-28 Privilege escalation through SVG navigation</p>
	<p>MFSA-2015-29 Code execution through incorrect JavaScript
	bounds checking elimination</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0817</cvename>
	<cvename>CVE-2015-0818</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-28/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-29/</url>
	<url>https://www.mozilla.org/security/advisories/</url>
	</references>
	<dates>
	<discovery>2015-03-20</discovery>
	<entry>2015-03-22</entry>
	</dates>
	</vuln>

	<vuln vid="9d15355b-ce7c-11e4-9db0-d050992ecde8">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_19</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1m</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_4</lt></range>
	</package>
	<package>
	<name>libressl</name>
	<range><le>2.1.5_1</le></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_8</lt></range>
	<range><ge>9.3</ge><lt>9.3_12</lt></range>
	<range><ge>8.4</ge><lt>8.4_26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20150319.txt">
	<ul>
	<li>Reclassified: RSA silently downgrades to EXPORT_RSA
	[Client] (CVE-2015-0204). OpenSSL only.</li>
	<li>Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)</li>
	<li>ASN.1 structure reuse memory corruption (CVE-2015-0287)</li>
	<li>PKCS#7 NULL pointer dereferences (CVE-2015-0289)</li>
	<li>Base64 decode (CVE-2015-0292). OpenSSL only.</li>
	<li>DoS via reachable assert in SSLv2 servers
	(CVE-2015-0293). OpenSSL only.</li>
	<li>Use After Free following d2i_ECPrivatekey error
	(CVE-2015-0209)</li>
	<li>X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:06.openssl</freebsdsa>
	<freebsdpr>ports/198681</freebsdpr>
	<cvename>CVE-2015-0204</cvename>
	<cvename>CVE-2015-0286</cvename>
	<cvename>CVE-2015-0287</cvename>
	<cvename>CVE-2015-0289</cvename>
	<cvename>CVE-2015-0292</cvename>
	<cvename>CVE-2015-0293</cvename>
	<cvename>CVE-2015-0209</cvename>
	<cvename>CVE-2015-0288</cvename>
	<url>https://www.openssl.org/news/secadv_20150319.txt</url>
	</references>
	<dates>
	<discovery>2015-03-19</discovery>
	<entry>2015-03-19</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="f7d79fac-cd49-11e4-898f-bcaec565249c">
	<topic>libXfont -- BDF parsing issues</topic>
	<affects>
	<package>
	<name>libXfont</name>
	<range><lt>1.5.1</lt></range>
	</package>
	<package>
	<name>linux-c6-xorg-libs</name>
	<range><lt>7.4_4</lt></range>
	</package>
	<package>
	<name>linux-f10-xorg-libs</name>
	<range><lt>7.4_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alan Coopersmith reports:</p>
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2015-March/002550.html">
	<p>Ilja van Sprundel, a security researcher with IOActive, has
	discovered an issue in the parsing of BDF font files by libXfont.
	Additional testing by Alan Coopersmith and William Robinet with
	the American Fuzzy Lop (afl) tool uncovered two more issues in
	the parsing of BDF font files.</p>

	<p>As libXfont is used by the X server to read font files, and an
	unprivileged user with access to the X server can tell the X
	server to read a given font file from a path of their choosing,
	these vulnerabilities have the potential to allow unprivileged
	users to run code with the privileges of the X server
	(often root access).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.x.org/archives/xorg-announce/2015-March/002550.html</url>
	<cvename>CVE-2015-1802</cvename>
	<cvename>CVE-2015-1803</cvename>
	<cvename>CVE-2015-1804</cvename>
	</references>
	<dates>
	<discovery>2015-03-17</discovery>
	<entry>2015-03-18</entry>
	<modified>2016-01-31</modified>
	</dates>
	</vuln>

	<vuln vid="8b3ecff5-c9b2-11e4-b71f-00bd5af88c00">
	<topic>Adobe Flash Player -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.442</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.442</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html">
	<p>
	Adobe has released security updates for Adobe Flash Player for
	Windows, Macintosh and Linux. These updates address vulnerabilities
	that could potentially allow an attacker to take control of the
	affected system.
	These updates resolve memory corruption vulnerabilities that could
	lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,
	CVE-2015-0339).
	These updates resolve type confusion vulnerabilities that could lead
	to code execution (CVE-2015-0334, CVE-2015-0336).
	These updates resolve a vulnerability that could lead to a
	cross-domain policy bypass (CVE-2015-0337).
	These updates resolve a vulnerability that could lead to a file
	upload restriction bypass (CVE-2015-0340).
	These updates resolve an integer overflow vulnerability that could
	lead to code execution (CVE-2015-0338).
	These updates resolve use-after-free vulnerabilities that could lead
	to code execution (CVE-2015-0341, CVE-2015-0342).
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb15-05.html</url>
	<cvename>CVE-2015-0332</cvename>
	<cvename>CVE-2015-0333</cvename>
	<cvename>CVE-2015-0334</cvename>
	<cvename>CVE-2015-0335</cvename>
	<cvename>CVE-2015-0336</cvename>
	<cvename>CVE-2015-0337</cvename>
	<cvename>CVE-2015-0338</cvename>
	<cvename>CVE-2015-0339</cvename>
	<cvename>CVE-2015-0340</cvename>
	<cvename>CVE-2015-0341</cvename>
	<cvename>CVE-2015-0342</cvename>
	</references>
	<dates>
	<discovery>2015-03-12</discovery>
	<entry>2015-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="451a6c79-c92b-11e4-a835-000c292ee6b8">
	<topic>sympa -- Remote attackers can read arbitrary files</topic>
	<affects>
	<package>
	<name>sympa</name>
	<range><lt>6.1.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Sympa Project reports:</p>
	<blockquote cite="https://www.sympa.org/security_advisories">
	<p>The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.sympa.org/security_advisories</url>
	<cvename>CVE-2015-1306</cvename>
	</references>
	<dates>
	<discovery>2015-01-13</discovery>
	<entry>2015-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="d08f6002-c588-11e4-8495-6805ca0b3d42">
	<topic>rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities</topic>
	<affects>
	<package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.10</lt></range>
	</package>
	<package>
	<name>rt40</name>
	<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Best Practical reports:</p>
	<blockquote cite="http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html">
	<p>RT 3.0.0 and above, if running on Perl 5.14.0 or higher,
	are vulnerable to a remote denial-of-service via the email
	gateway; any installation which accepts mail from untrusted
	sources is vulnerable, regardless of the permissions
	configuration inside RT. This denial-of-service may
	encompass both CPU and disk usage, depending on RT's logging
	configuration. This vulnerability is assigned
	CVE-2014-9472.</p>
	<p>RT 3.8.8 and above are vulnerable to an information
	disclosure attack which may reveal RSS feeds URLs, and thus
	ticket data; this vulnerability is assigned
	CVE-2015-1165. RSS feed URLs can also be leveraged to
	perform session hijacking, allowing a user with the URL to
	log in as the user that created the feed; this vulnerability
	is assigned CVE-2015-1464.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html</url>
	<cvename>CVE-2014-9472</cvename>
	<cvename>CVE-2015-1165</cvename>
	<cvename>CVE-2015-1464</cvename>
	</references>
	<dates>
	<discovery>2015-02-26</discovery>
	<entry>2015-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="81b4c118-c586-11e4-8495-6805ca0b3d42">
	<topic>phpMyAdmin -- Risk of BREACH attack due to reflected parameter</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.3.0</ge><lt>4.3.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php">
	<p>Risk of BREACH attack due to reflected parameter.</p>
	<p>With a large number of crafted requests it was possible to infer
	the CSRF token by a BREACH attack.</p>
	<p>Mitigation factor: this vulnerability can only be exploited in
	the presence of another vulnerability that allows the attacker to
	inject JavaScript into victim's browser.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php</url>
	<cvename>CVE-2015-2206</cvename>
	</references>
	<dates>
	<discovery>2015-03-04</discovery>
	<entry>2015-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="c0cae920-c4e9-11e4-898e-90e6ba741e35">
	<topic>mono -- TLS bugs</topic>
	<affects>
	<package>
	<name>mono</name>
	<range><lt>3.10.1</lt></range>
	<range><ge>3.12</ge><lt>3.12.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mono project reports:</p>
	<blockquote cite="http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs">
	<p>Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in <a href="https://www.smacktls.com/#skip">SKIP-TLS post</a>.</p>
	<p>Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the <a href="https://www.smacktls.com/#freak">FREAK</a> attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs</url>
	</references>
	<dates>
	<discovery>2015-03-06</discovery>
	<entry>2015-03-07</entry>
	</dates>
	</vuln>

	<vuln vid="92fc2e2b-c383-11e4-8ef7-080027ef73ec">
	<topic>PuTTY -- fails to scrub private keys from memory after use</topic>
	<affects>
	<package>
	<name>putty</name>
	<range><lt>0.64</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Tatham reports:</p>
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html">
	<p>When PuTTY has sensitive data in memory and has no further need for
	it, it should wipe the data out of its memory, in case malware later
	gains access to the PuTTY process or the memory is swapped out to
	disk or written into a crash dump file. An obvious example of this
	is the password typed during SSH login; other examples include
	obsolete session keys, public-key passphrases, and the private
	halves of public keys.</p>
	<p>PuTTY 0.63 and earlier versions, after loading a private key
	from a disk file, mistakenly leak a memory buffer containing a
	copy of the private key, in the function ssh2_load_userkey. The
	companion function ssh2_save_userkey (only called by PuTTYgen) can
	also leak a copy, but only in the case where the file it tried to
	save to could not be created.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html</url>
	<cvename>CVE-2015-2157</cvename>
	</references>
	<dates>
	<discovery>2015-02-28</discovery>
	<entry>2015-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="8505e013-c2b3-11e4-875d-000c6e25e3e9">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>41.0.2272.76</lt></range>
	</package>
	<package>
	<name>chromium-npapi</name>
	<range><lt>41.0.2272.76</lt></range>
	</package>
	<package>
	<name>chromium-pulse</name>
	<range><lt>41.0.2272.76</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl">
	<p>51 security fixes in this release, including:</p>
	<ul>
	<li>[456516] High CVE-2015-1212: Out-of-bounds write in media.
	Credit to anonymous.</li>
	<li>[448423] High CVE-2015-1213: Out-of-bounds write in skia
	filters. Credit to cloudfuzzer.</li>
	<li>[445810] High CVE-2015-1214: Out-of-bounds write in skia
	filters. Credit to cloudfuzzer.</li>
	<li>[445809] High CVE-2015-1215: Out-of-bounds write in skia
	filters. Credit to cloudfuzzer.</li>
	<li>[454954] High CVE-2015-1216: Use-after-free in v8 bindings.
	Credit to anonymous.</li>
	<li>[456192] High CVE-2015-1217: Type confusion in v8 bindings.
	Credit to anonymous.</li>
	<li>[456059] High CVE-2015-1218: Use-after-free in dom.
	Credit to cloudfuzzer.</li>
	<li>[446164] High CVE-2015-1219: Integer overflow in webgl.
	Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.</li>
	<li>[437651] High CVE-2015-1220: Use-after-free in gif decoder.
	Credit to Aki Helin of OUSPG.</li>
	<li>[455368] High CVE-2015-1221: Use-after-free in web databases.
	Credit to Collin Payne.</li>
	<li>[448082] High CVE-2015-1222: Use-after-free in service workers.
	Credit to Collin Payne.</li>
	<li>[454231] High CVE-2015-1223: Use-after-free in dom.
	Credit to Maksymillian Motyl.</li>
	<li>High CVE-2015-1230: Type confusion in v8.
	Credit to Skylined working with HP's Zero Day Initiative.</li>
	<li>[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
	Credit to Aki Helin of OUSPG.</li>
	<li>[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium.
	Credit to cloudfuzzer.</li>
	<li>[456841] Medium CVE-2015-1226: Validation issue in debugger.
	Credit to Rob Wu.</li>
	<li>[450389] Medium CVE-2015-1227: Uninitialized value in blink.
	Credit to Christoph Diehl.</li>
	<li>[444707] Medium CVE-2015-1228: Uninitialized value in rendering.
	Credit to miaubiz.</li>
	<li>[431504] Medium CVE-2015-1229: Cookie injection via proxies.
	Credit to iliwoy.</li>
	<li>[463349] CVE-2015-1231: Various fixes from internal audits,
	fuzzing, and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1212</cvename>
	<cvename>CVE-2015-1213</cvename>
	<cvename>CVE-2015-1214</cvename>
	<cvename>CVE-2015-1215</cvename>
	<cvename>CVE-2015-1216</cvename>
	<cvename>CVE-2015-1217</cvename>
	<cvename>CVE-2015-1218</cvename>
	<cvename>CVE-2015-1219</cvename>
	<cvename>CVE-2015-1220</cvename>
	<cvename>CVE-2015-1221</cvename>
	<cvename>CVE-2015-1222</cvename>
	<cvename>CVE-2015-1223</cvename>
	<cvename>CVE-2015-1224</cvename>
	<cvename>CVE-2015-1225</cvename>
	<cvename>CVE-2015-1226</cvename>
	<cvename>CVE-2015-1227</cvename>
	<cvename>CVE-2015-1228</cvename>
	<cvename>CVE-2015-1229</cvename>
	<cvename>CVE-2015-1230</cvename>
	<cvename>CVE-2015-1231</cvename>
	<url>http://googlechromereleases.blogspot.nl</url>
	</references>
	<dates>
	<discovery>2015-03-03</discovery>
	<entry>2015-03-04</entry>
	</dates>
	</vuln>

	<vuln vid="c9c3374d-c2c1-11e4-b236-5453ed2e2b49">
	<topic>qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler</topic>
	<affects>
	<package>
	<name>qt4-gui</name>
	<range><lt>4.8.6_4</lt></range>
	</package>
	<package>
	<name>qt5-gui</name>
	<range><lt>5.3.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Richard J. Moore reports:</p>
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-February/000059.html">
	<p>The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug
	that would lead to a division by zero when loading certain corrupt
	BMP files. This in turn would cause the application loading these
	hand crafted BMPs to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0295</cvename>
	<mlist>http://lists.qt-project.org/pipermail/announce/2015-February/000059.html</mlist>
	</references>
	<dates>
	<discovery>2015-02-22</discovery>
	<entry>2015-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="7480b6ac-adf1-443e-a33c-3a3c0becba1e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><le>1.600</le></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><le>1.580.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">
	<h1>Description</h1>
	<h5>SECURITY-125 (Combination filter Groovy script unsecured)</h5>
	<p>This vulnerability allows users with the job configuration
	privilege to escalate his privileges, resulting in arbitrary code
	execution to the master.</p>
	<h5>SECURITY-162 (directory traversal from artifacts via symlink)</h5>
	<p>This vulnerability allows users with the job configuration
	privilege or users with commit access to the build script to
	access arbitrary files/directories on the master, resulting in
	the exposure of sensitive information, such as encryption keys.</p>
	<h5>SECURITY-163 (update center metadata retrieval DoS attack)</h5>
	<p>This vulnerability allows authenticated users to disrupt the
	operation of Jenkins by feeding malicious update center data into
	Jenkins, affecting plugin installation and tool installation.</p>
	<h5>SECURITY-165 (external entity injection via XPath)</h5>
	<p>This vulnerability allows users with the read access to Jenkins
	to retrieve arbitrary XML document on the server, resulting in
	the exposure of sensitive information inside/outside Jenkins.</p>
	<h5>SECURITY-166 (HudsonPrivateSecurityRealm allows creation of
	reserved names)</h5>
	<p>For users using "Jenkins' own user database" setting, Jenkins
	doesn't refuse reserved names, thus allowing privilege escalation.</p>
	<h5>SECURITY-167 (External entity processing in XML can reveal
	sensitive local files)</h5>
	<p>This vulnerability allows attackers to create malicious XML
	documents and feed that into Jenkins, which causes Jenkins to
	retrieve arbitrary XML document on the server, resulting in the
	exposure of sensitive information inside/outside Jenkins.</p>
	<h1>Severity</h1>
	<p>SECURITY-125 is rated <strong>critical</strong>. This attack can be
	only mounted by users with some trust, but it results in arbitrary
	code execution on the master.</p>
	<p>SECURITY-162 is rated <strong>critical</strong>. This attack can be
	only mounted by users with some trust, but it results in the
	exposure of sensitive information.</p>
	<p>SECURITY-163 is rated <strong>medium</strong>, as it results in the
	loss of functionality.</p>
	<p>SECURITY-165 is rated <strong>critical</strong>. This attack is
	easy to mount, and it results in the exposure of sensitive
	information.</p>
	<p>SECURITY-166 is rated <strong>critical</strong>. For users who use
	the affected feature, this attack results in arbitrary code
	execution on the master.</p>
	<p>SECURITY-167 is rated <strong>critical</strong>. This attack is
	easy to mount, and it results in the exposure of sensitive information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</url>
	</references>
	<dates>
	<discovery>2015-03-01</discovery>
	<entry>2015-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="99029172-8253-407d-9d8b-2cfeab9abf81">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>36.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.5.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>36.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.33</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.5.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.33</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.5.0</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	<p>MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0
	/ rv:31.5)</p>
	<p>MFSA-2015-12 Invoking Mozilla updater will load locally
	stored DLL files</p>
	<p>MFSA-2015-13 Appended period to hostnames can bypass HPKP
	and HSTS protections</p>
	<p>MFSA-2015-14 Malicious WebGL content crash when writing
	strings</p>
	<p>MFSA-2015-15 TLS TURN and STUN connections silently fail
	to simple TCP connections</p>
	<p>MFSA-2015-16 Use-after-free in IndexedDB</p>
	<p>MFSA-2015-17 Buffer overflow in libstagefright during MP4
	video playback</p>
	<p>MFSA-2015-18 Double-free when using non-default memory
	allocators with a zero-length XHR</p>
	<p>MFSA-2015-19 Out-of-bounds read and write while rendering
	SVG content</p>
	<p>MFSA-2015-20 Buffer overflow during CSS restyling</p>
	<p>MFSA-2015-21 Buffer underflow during MP3 playback</p>
	<p>MFSA-2015-22 Crash using DrawTarget in Cairo graphics
	library</p>
	<p>MFSA-2015-23 Use-after-free in Developer Console date
	with OpenType Sanitiser</p>
	<p>MFSA-2015-24 Reading of local files through manipulation
	of form autocomplete</p>
	<p>MFSA-2015-25 Local files or privileged URLs in pages can
	be opened into new tabs</p>
	<p>MFSA-2015-26 UI Tour whitelisted sites in background tab
	can spoof foreground tabs</p>
	<p>MFSA-2015-27 Caja Compiler JavaScript sandbox bypass</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0819</cvename>
	<cvename>CVE-2015-0820</cvename>
	<cvename>CVE-2015-0821</cvename>
	<cvename>CVE-2015-0822</cvename>
	<cvename>CVE-2015-0823</cvename>
	<cvename>CVE-2015-0824</cvename>
	<cvename>CVE-2015-0825</cvename>
	<cvename>CVE-2015-0826</cvename>
	<cvename>CVE-2015-0827</cvename>
	<cvename>CVE-2015-0828</cvename>
	<cvename>CVE-2015-0829</cvename>
	<cvename>CVE-2015-0830</cvename>
	<cvename>CVE-2015-0831</cvename>
	<cvename>CVE-2015-0832</cvename>
	<cvename>CVE-2015-0833</cvename>
	<cvename>CVE-2015-0834</cvename>
	<cvename>CVE-2015-0835</cvename>
	<cvename>CVE-2015-0836</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-11/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-12/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-13/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-14/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-15/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-16/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-17/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-18/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-19/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-20/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-21/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-22/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-23/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-24/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-25/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-26/</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2015-27/</url>
	<url>https://www.mozilla.org/security/advisories/</url>
	</references>
	<dates>
	<discovery>2015-02-24</discovery>
	<entry>2015-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="f7a9e415-bdca-11e4-970c-000c292ee6b8">
	<topic>php5 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.4.38</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><lt>5.5.22</lt></range>
	</package>
	<package>
	<name>php56</name>
	<range><lt>5.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Project reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	<p>Use after free vulnerability in unserialize() with DateTimeZone.</p>
	<p>Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer
	overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0235</cvename>
	<cvename>CVE-2015-0273</cvename>
	<url>http://php.net/ChangeLog-5.php#5.4.38</url>
	<url>http://php.net/ChangeLog-5.php#5.5.22</url>
	<url>http://php.net/ChangeLog-5.php#5.6.6</url>
	</references>
	<dates>
	<discovery>2015-02-18</discovery>
	<entry>2015-02-26</entry>
	</dates>
	</vuln>

	<vuln vid="dbf9e66c-bd50-11e4-a7ba-206a8a720317">
	<topic>krb5 1.11 -- New release/fix multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>krb5-111</name>
	<range><lt>1.11.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:</p>
	<blockquote cite="http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt">
	<p>Handle certain invalid RFC 1964 GSS tokens correctly to avoid
	invalid memory reference vulnerabilities. [CVE-2014-4341</p>
	<p>Fix memory management vulnerabilities in GSSAPI SPNEGO.
	[CVE-2014-4343 CVE-2014-4344]</p>
	<p>Fix buffer overflow vulnerability in LDAP KDB back end.
	[CVE-2014-4345]</p>
	<p>Fix multiple vulnerabilities in the LDAP KDC back end.
	[CVE-2014-5354 CVE-2014-5353]</p>
	<p>Fix multiple kadmind vulnerabilities, some of which are based
	in the gssrpc library. [CVE-2014-5352 CVE-2014-9421
	CVE-2014-9422 CVE-2014-9423]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt</url>
	</references>
	<dates>
	<discovery>2015-02-25</discovery>
	<entry>2015-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="996c219c-bbb1-11e4-88ae-d050992ecde8">
	<topic>samba -- Unexpected code execution in smbd</topic>
	<affects>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><lt>4.0.25</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><lt>3.6.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba development team reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2015-0240">
	<p>All versions of Samba from 3.5.0 to 4.2.0rc4 are
	vulnerable to an unexpected code execution vulnerability
	in the smbd file server daemon.</p>
	<p>A malicious client could send packets that may set up the
	stack in such a way that the freeing of memory in a
	subsequent anonymous netlogon packet could allow execution
	of arbitrary code. This code would execute with root
	privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0240</cvename>
	<url>https://www.samba.org/samba/security/CVE-2015-0240</url>
	</references>
	<dates>
	<discovery>2015-02-23</discovery>
	<entry>2015-02-23</entry>
	</dates>
	</vuln>

	<vuln vid="0f488b7b-bbb9-11e4-903c-080027ef73ec">
	<topic>e2fsprogs -- buffer overflow if s_first_meta_bg too big</topic>
	<affects>
	<package>
	<name>e2fsprogs</name>
	<range><lt>1.42.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Theodore Ts'o reports:</p>
	<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4">
	<p>If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.</p>
	<p>The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4</url>
	<url>http://www.ocert.org/advisories/ocert-2015-002.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1187032</url>
	<cvename>CVE-2015-0247</cvename>
	</references>
	<dates>
	<discovery>2014-08-09</discovery>
	<entry>2015-02-24</entry>
	</dates>
	</vuln>

	<vuln vid="2a4bcd7d-bbb8-11e4-903c-080027ef73ec">
	<topic>e2fsprogs -- potential buffer overflow in closefs()</topic>
	<affects>
	<package>
	<name>e2fsprogs</name>
	<range><lt>1.42.12_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Theodore Ts'o reports:</p>
	<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73">
	<p>On a carefully crafted filesystem that gets modified through
	tune2fs or debugfs, it is possible to trigger a buffer overrun when
	the file system is closed via closefs().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73</url>
	<cvename>CVE-2015-1572</cvename>
	</references>
	<dates>
	<discovery>2015-02-06</discovery>
	<entry>2015-02-24</entry>
	</dates>
	</vuln>

	<vuln vid="58033a95-bba8-11e4-88ae-d050992ecde8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind910</name>
	<name>bind910-base</name>
	<range><lt>9.10.1P2</lt></range>
	</package>
	<package>
	<name>bind99</name>
	<name>bind99-base</name>
	<range><lt>9.9.6P2</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_10</lt></range>
	<range><ge>8.4</ge><lt>8.4_24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01235">
	<p>When configured to perform DNSSEC validation, named can
	crash when encountering a rare set of conditions in the
	managed trust anchors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:05.bind</freebsdsa>
	<cvename>CVE-2015-1349</cvename>
	<url>https://kb.isc.org/article/AA-01235</url>
	</references>
	<dates>
	<discovery>2015-02-18</discovery>
	<entry>2015-02-23</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="63527d0d-b9de-11e4-8a48-206a8a720317">
	<topic>krb5 1.12 -- New release/fix multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>krb5-112</name>
	<range><lt>1.12.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
	<p>Fix multiple vulnerabilities in the LDAP KDC back end.
	[CVE-2014-5354] [CVE-2014-5353]</p>
	<p>Fix multiple kadmind vulnerabilities, some of which are based
	in the gssrpc library. [CVE-2014-5352 CVE-2014-5352
	CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt</url>
	</references>
	<dates>
	<discovery>2015-02-20</discovery>
	<entry>2015-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="3680b234-b6f0-11e4-b7cc-d050992ecde8">
	<topic>unzip -- heap based buffer overflow in iconv patch</topic>
	<affects>
	<package>
	<name>unzip</name>
	<range><lt>6.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ubuntu Security Notice USN-2502-1 reports:</p>
	<blockquote cite="http://www.ubuntu.com/usn/usn-2502-1/">
	<p>unzip could be made to run programs if it opened a specially crafted file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1315</cvename>
	<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2015-1315</url>
	<url>http://www.ubuntu.com/usn/usn-2502-1/</url>
	</references>
	<dates>
	<discovery>2015-02-17</discovery>
	<entry>2015-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="3a888a1e-b321-11e4-83b2-206a8a720317">
	<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><lt>1.13.1</lt></range>
	</package>
	<package>
	<name>krb5-112</name>
	<range><lt>1.12.2_2</lt></range>
	</package>
	<package>
	<name>krb5-111</name>
	<range><lt>1.11.5_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
	<p>CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn
	function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in
	MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP,
	allows remote authenticated users to cause a denial of service
	(daemon crash) via a successful LDAP query with no results, as
	demonstrated by using an incorrect object type for a password
	policy.</p>
	<p>CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in
	MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when
	the KDC uses LDAP, allows remote authenticated users to cause a
	denial of service (NULL pointer dereference and daemon crash) by
	creating a database entry for a keyless principal, as
	demonstrated by a kadmin "add_principal -nokey" or "purgekeys
	-all" command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-5353</cvename>
	<cvename>CVE-2014-5354</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
	</references>
	<dates>
	<discovery>2015-02-12</discovery>
	<entry>2015-02-12</entry>
	<modified>2015-02-13</modified>
	</dates>
	</vuln>

	<vuln vid="54a69cf7-b2ef-11e4-b1f1-bcaec565249c">
	<topic>xorg-server -- Information leak in the XkbSetGeometry request of X servers.</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><lt>1.14.7_2,1</lt></range>
	</package>
	<package>
	<name>xorg-server</name>
	<range><ge>1.15.0,1</ge><lt>1.16.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Peter Hutterer reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2015-February/057158.html">
	<p>Olivier Fourdan from Red Hat has discovered a protocol handling
	issue in the way the X server code base handles the XkbSetGeometry
	request.</p>
	<p>The issue stems from the server trusting the client to send valid
	string lengths in the request data. A malicious client with string
	lengths exceeding the request length can cause the server to copy
	adjacent memory data into the XKB structs. This data is then
	available to the client via the XkbGetGeometry request. The
	data length is at least up to 64k, it is possible to obtain
	more data by chaining strings, each string length is then
	determined by whatever happens to be in that 16-bit region of
	memory.</p>
	<p>A similarly crafted request can likely cause the X server
	to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0255</cvename>
	<url>http://lists.freedesktop.org/archives/xorg/2015-February/057158.html</url>
	</references>
	<dates>
	<discovery>2015-02-10</discovery>
	<entry>2015-02-12</entry>
	</dates>
	</vuln>

	<vuln vid="a0c45e53-ae51-11e4-8ac7-d050992ecde8">
	<topic>openldap -- two remote denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>openldap-server</name>
	<range><lt>2.4.40_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ryan Tandy reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988">
	<p>With the deref overlay enabled, ldapsearch with '-E deref=member:'
	causes slapd to crash.</p>
	</blockquote>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991">
	<p>Bill MacAllister discovered that certain queries cause slapd
	to crash while freeing operation controls. This is a 2.4.40 regression.
	Earlier releases are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988</url>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991</url>
	</references>
	<dates>
	<discovery>2015-02-02</discovery>
	<entry>2015-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="a6eb239f-adbe-11e4-9fce-080027593b9a">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>40.0.2214.111</lt></range>
	</package>
	<package>
	<name>chromium-pulse</name>
	<range><lt>40.0.2214.111</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl">
	<p>11 security fixes in this release, including:</p>
	<ul>
	<li>[447906] High CVE-2015-1209: Use-after-free in DOM. Credit to
	Maksymillian.</li>
	<li>[453979] High CVE-2015-1210: Cross-origin-bypass in V8
	bindings. Credit to anonymous.</li>
	<li>[453982] High CVE-2015-1211: Privilege escalation using service
	workers. Credit to anonymous.</li>
	<li>[455225] CVE-2015-1212: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1209</cvename>
	<cvename>CVE-2015-1210</cvename>
	<cvename>CVE-2015-1211</cvename>
	<cvename>CVE-2015-1212</cvename>
	<url>http://googlechromereleases.blogspot.nl</url>
	</references>
	<dates>
	<discovery>2015-02-05</discovery>
	<entry>2015-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="3b40bf2c-ad83-11e4-a2b2-0026551a22dc">
	<topic>PostgreSQL -- multiple buffer overflows and memory issues</topic>
	<affects>
	<package>
	<name>postgresql90-server</name>
	<range><ge>9.0.0</ge><lt>9.0.19</lt></range>
	</package>
	<package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.15</lt></range>
	</package>
	<package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
	</package>
	<package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.6</lt></range>
	</package>
	<package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL Project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1569/">
	<p>This update fixes multiple security issues reported in PostgreSQL
	over the past few months. All of these issues require prior
	authentication, and some require additional conditions, and as such
	are not considered generally urgent. However, users should examine
	the list of security holes patched below in case they are particularly
	vulnerable.</p>
	<ol>
	<li>CVE-2015-0241 Buffer overruns in "to_char" functions.</li>
	<li>CVE-2015-0242 Buffer overrun in replacement printf family of
	functions.</li>
	<li>CVE-2015-0243 Memory errors in functions in the pgcrypto extension.</li>
	<li>CVE-2015-0244 An error in extended protocol message reading.</li>
	<li>CVE-2014-8161 Constraint violation errors can cause display of values in columns
	which the user would not normally have rights to see.</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0241</cvename>
	<cvename>CVE-2015-0242</cvename>
	<cvename>CVE-2015-0243</cvename>
	<cvename>CVE-2015-0244</cvename>
	<cvename>CVE-2014-8161</cvename>
	</references>
	<dates>
	<discovery>2015-02-05</discovery>
	<entry>2015-02-05</entry>
	</dates>
	</vuln>

	<vuln vid="24ce5597-acab-11e4-a847-206a8a720317">
	<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><lt>1.13_1</lt></range>
	</package>
	<package>
	<name>krb5-112</name>
	<range><lt>1.12.2_1</lt></range>
	</package>
	<package>
	<name>krb5-111</name>
	<range><lt>1.11.5_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SO-AND-SO reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
	<p>CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
	gss_process_context_token() is used to process a valid context
	deletion token, the caller is left with a security context handle
	containing a dangling pointer. Further uses of this handle will
	result in use-after-free and double-free memory access violations.
	libgssrpc server applications such as kadmind are vulnerable as
	they can be instructed to call gss_process_context_token().</p>
	<p>CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
	data from an authenticated user, it may perform use-after-free and
	double-free memory access violations while cleaning up the partial
	deserialization results. Other libgssrpc server applications may
	also be vulnerable if they contain insufficiently defensive XDR
	functions.</p>
	<p>CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts
	authentications to two-component server principals whose first
	component is a left substring of "kadmin" or whose realm is a left
	prefix of the default realm.</p>
	<p>CVE-2014-9423: libgssrpc applications including kadmind output
	four or eight bytes of uninitialized memory to the network as
	part of an unused "handle" field in replies to clients.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-5352</cvename>
	<cvename>CVE-2014-9421</cvename>
	<cvename>CVE-2014-9422</cvename>
	<cvename>CVE-2014-9423</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
	</references>
	<dates>
	<discovery>2015-02-03</discovery>
	<entry>2015-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="e543c6f8-abf2-11e4-8ac7-d050992ecde8">
	<topic>unzip -- out of boundary access issues in test_compr_eb</topic>
	<affects>
	<package>
	<name>unzip</name>
	<range><lt>6.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ubuntu Security Notice USN-2489-1 reports:</p>
	<blockquote cite="http://www.ubuntu.com/usn/usn-2489-1/">
	<p>Michal Zalewski discovered that unzip incorrectly handled
	certain malformed zip archives. If a user or automated system
	were tricked into processing a specially crafted zip archive,
	an attacker could possibly execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9636</cvename>
	<url>http://www.ubuntu.com/usn/usn-2489-1/</url>
	<url>http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html</url>
	<url>http://seclists.org/oss-sec/2014/q4/489</url>
	<url>http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450</url>
	</references>
	<dates>
	<discovery>2014-11-02</discovery>
	<entry>2015-02-03</entry>
	</dates>
	</vuln>

	<vuln vid="1c7cfd05-aaee-11e4-83b4-14dae9d210b8">
	<topic>Xymon -- buffer overrun</topic>
	<affects>
	<package>
	<name>xymon-server</name>
	<range><ge>4.3.4</ge><lt>4.3.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776007">
	<p>web/acknowledge.c uses a string twice in a format string, but only
	allocates memory for one copy.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2015/01/31/4</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2015-1430</url>
	<cvename>CVE-2015-1430</cvename>
	</references>
	<dates>
	<discovery>2014-09-28</discovery>
	<entry>2015-02-02</entry>
	</dates>
	</vuln>

	<vuln vid="8469d41c-a960-11e4-b18e-bcaec55be5e5">
	<topic>rabbitmq -- Security issues in management plugin</topic>
	<affects>
	<package>
	<name>rabbitmq</name>
	<range><lt>3.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The RabbitMQ project reports:</p>
	<blockquote cite="http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100">
	<p>Some user-controllable content was not properly HTML-escaped
	before being presented to a user in the management web UI:</p>
	<ul>
	<li>When a user unqueued a message from the management UI,
	message details (header names, arguments, etc.) were displayed
	unescaped. An attacker could publish a specially crafted
	message to add content or execute arbitrary Javascript code on
	behalf of a user, if this user unqueued the message from the
	management UI.</li>
	<li>When viewing policies, their name was displayed unescaped.
	An attacker could create a policy with a specially crafted name
	to add content or execute arbitrary Javascript code on behalf
	of a user who is viewing policies.</li>
	<li>When listing connected AMQP network clients, client details
	such as its version were displayed unescaped. An attacker could
	use a client with a specially crafted version field to add
	content or execute arbitrary Javascript code on behalf of a
	user who is viewing connected clients.</li>
	</ul>
	<p>In all cases, the attacker needs a valid user account on the
	targeted RabbitMQ cluster.</p>
	<p>Furthermore, some admin-controllable content was not properly
	escaped:</p>
	<ul>
	<li>user names;</li>
	<li>the cluster name.</li>
	</ul>
	<p>Likewise, an attacker could add content or execute arbitrary
	Javascript code on behalf of a user using the management web UI.
	However, the attacker must be an administrator on the RabbitMQ
	cluster, thus a trusted user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100</url>
	<url>http://www.rabbitmq.com/release-notes/README-3.4.3.txt</url>
	<cvename>CVE-2015-0862</cvename>
	</references>
	<dates>
	<discovery>2015-01-08</discovery>
	<entry>2015-01-31</entry>
	</dates>
	</vuln>

	<vuln vid="5804b9d4-a959-11e4-9363-20cf30e32f6d">
	<topic>apache24 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
	<p>mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
	with response headers' size above 8K.</p>
	<p>mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.</p>
	<p>mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used
	in multiple Require directives with different arguments. PR57204.</p>
	<p>core: HTTP trailers could be used to replace HTTP headers late during
	request processing, potentially undoing or otherwise confusing modules
	that examined or modified request headers earlier. Adds "MergeTrailers"
	directive to restore legacy behavior.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3583</cvename>
	<cvename>CVE-2014-3581</cvename>
	<cvename>CVE-2014-8109</cvename>
	<cvename>CVE-2013-5704</cvename>
	</references>
	<dates>
	<discovery>2015-01-29</discovery>
	<entry>2015-01-31</entry>
	</dates>
	</vuln>

	<vuln vid="7656fc62-a7a7-11e4-96ba-001999f8d30b">
	<topic>asterisk -- Mitigation for libcURL HTTP request injection vulnerability</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><lt>1.8.32.2</lt></range>
	</package>
	<package>
	<name>asterisk11</name>
	<range><lt>11.15.1</lt></range>
	</package>
	<package>
	<name>asterisk13</name>
	<range><lt>13.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>CVE-2014-8150 reported an HTTP request injection
	vulnerability in libcURL. Asterisk uses libcURL in its
	func_curl.so module (the CURL() dialplan function), as
	well as its res_config_curl.so (cURL realtime backend)
	modules.</p>
	<p>Since Asterisk may be configured to allow for user-supplied
	URLs to be passed to libcURL, it is possible that an
	attacker could use Asterisk as an attack vector to inject
	unauthorized HTTP requests if the version of libcURL
	installed on the Asterisk server is affected by
	CVE-2014-8150.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2015-002.html</url>
	</references>
	<dates>
	<discovery>2015-01-12</discovery>
	<entry>2015-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="2eeb6652-a7a6-11e4-96ba-001999f8d30b">
	<topic>asterisk -- File descriptor leak when incompatible codecs are offered</topic>
	<affects>
	<package>
	<name>asterisk13</name>
	<range><lt>13.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>Asterisk may be configured to only allow specific audio
	or video codecs to be used when communicating with a
	particular endpoint. When an endpoint sends an SDP offer
	that only lists codecs not allowed by Asterisk, the offer
	is rejected. However, in this case, RTP ports that are
	allocated in the process are not reclaimed.</p>
	<p>This issue only affects the PJSIP channel driver in
	Asterisk. Users of the chan_sip channel driver are not
	affected.</p>
	<p>As the resources are allocated after authentication,
	this issue only affects communications with authenticated
	endpoints.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2015-001.html</url>
	<cvename>CVE-2015-1558</cvename>
	</references>
	<dates>
	<discovery>2015-01-06</discovery>
	<entry>2015-01-29</entry>
	<modified>2015-02-17</modified>
	</dates>
	</vuln>

	<vuln vid="0765de84-a6c1-11e4-a0c1-c485083ca99c">
	<topic>glibc -- gethostbyname buffer overflow</topic>
	<affects>
	<package>
	<name>linux_base-c6</name>
	<range><lt>6.6_2</lt></range>
	</package>
	<package>
	<name>linux_base-f10</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>linux-c6-devtools</name>
	<range><lt>6.6_3</lt></range>
	</package>
	<package>
	<name>linux-f10-devtools</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Robert Krátký reports:</p>
	<blockquote cite="https://access.redhat.com/discussions/1332403">
	<p>
	GHOST is a 'buffer overflow' bug affecting the gethostbyname() and
	gethostbyname2() function calls in the glibc library. This
	vulnerability allows a remote attacker that is able to make an
	application call to either of these functions to execute arbitrary
	code with the permissions of the user running the application.
	The gethostbyname() function calls are used for DNS resolving, which
	is a very common event. To exploit this vulnerability, an attacker
	must trigger a buffer overflow by supplying an invalid hostname
	argument to an application that performs a DNS resolution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0235</cvename>
	<url>https://access.redhat.com/articles/1332213</url>
	<url>http://www.openwall.com/lists/oss-security/2015/01/27/9</url>
	</references>
	<dates>
	<discovery>2015-01-27</discovery>
	<entry>2015-01-28</entry>
	<modified>2015-02-02</modified>
	</dates>
	</vuln>

	<vuln vid="37a87ade-a59f-11e4-958e-0011d823eebd">
	<topic>Adobe Flash Player -- critical vulnerability</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.438</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.438</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsa15-01.html">
	<p>Successful exploitation could cause a crash and potentially allow
	an attacker to take control of the affected system. We are aware
	of reports that this vulnerability is being actively exploited in
	the wild via drive-by-download attacks against systems running
	Internet Explorer and Firefox on Windows 8.1 and below.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0311</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsa15-01.html</url>
	</references>
	<dates>
	<discovery>2015-01-22</discovery>
	<entry>2015-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="dc2d76df-a595-11e4-9363-20cf30e32f6d">
	<topic>Bugzilla multiple security issues</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bugzilla Security Advisory</p>
	<blockquote cite="http://www.bugzilla.org/security/4.0.15/">
	<h5>Command Injection</h5>
	<p>Some code in Bugzilla does not properly utilize 3 arguments form
	for open() and it is possible for an account with editcomponents
	permissions to inject commands into product names and other
	attributes.</p>
	<h5>Information Leak</h5>
	<p>Using the WebServices API, a user can possibly execute imported
	functions from other non-WebService modules. A whitelist has now
	been added that lists explicit methods that can be executed via the
	API.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8630</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1079065</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1090275</url>
	</references>
	<dates>
	<discovery>2015-01-21</discovery>
	<entry>2015-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="9c7b6c20-a324-11e4-879c-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20150124,1</lt></range>
	</package>
	<package>
	<name>py32-django-devel</name>
	<range><lt>20150124,1</lt></range>
	</package>
	<package>
	<name>py33-django-devel</name>
	<range><lt>20150124,1</lt></range>
	</package>
	<package>
	<name>py34-django-devel</name>
	<range><lt>20150124,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2015/jan/13/security/">
	<p>Today the Django team is issuing multiple releases --
	Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our
	security process. These releases are now available on PyPI and our
	download page.</p>
	<p>These releases address several security issues. We encourage all
	users of Django to upgrade as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2015/jan/13/security/</url>
	<cvename>CVE-2015-0219</cvename>
	<cvename>CVE-2015-0220</cvename>
	<cvename>CVE-2015-0221</cvename>
	<cvename>CVE-2015-0222</cvename>
	</references>
	<dates>
	<discovery>2015-01-13</discovery>
	<entry>2015-01-23</entry>
	<modified>2015-01-24</modified>
	</dates>
	</vuln>

	<vuln vid="0523fb7e-8444-4e86-812d-8de05f6f0dce">
	<topic>libutp -- remote denial of service or arbitrary code execution</topic>
	<affects>
	<package>
	<name>bittorrent-libutp</name>
	<range><lt>0.20130514_1</lt></range>
	</package>
	<package>
	<name>transmission-cli</name>
	<name>transmission-deamon</name>
	<name>transmission-gtk</name>
	<name>transmission-qt4</name>
	<range><lt>2.74</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6129">
	<p>Stack-based buffer overflow in utp.cpp in libutp, as used
	in Transmission before 2.74 and possibly other products,
	allows remote attackers to cause a denial of service (crash)
	and possibly execute arbitrary code via crafted "micro
	transport protocol packets."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-6129</cvename>
	<url>https://github.com/bittorrent/libutp/issues/38</url>
	<url>https://trac.transmissionbt.com/ticket/5002</url>
	</references>
	<dates>
	<discovery>2012-08-01</discovery>
	<entry>2014-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="f9c388c5-a256-11e4-992a-7b2a515a1247">
	<topic>LibreSSL -- DTLS vulnerability</topic>
	<affects>
	<package>
	<name>libressl</name>
	<range><lt>2.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL Security Advisory:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
	<p>
	A memory leak can occur in the dtls1_buffer_record function under certain
	conditions. In particular this could occur if an attacker sent repeated DTLS
	records with the same sequence number but for the next epoch. The memory leak
	could be exploited by an attacker in a Denial of Service attack through memory
	exhaustion.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0206</cvename>
	<url>https://www.openssl.org/news/secadv_20150108.txt</url>
	</references>
	<dates>
	<discovery>2015-01-08</discovery>
	<entry>2015-01-22</entry>
	</dates>
	</vuln>

	<vuln vid="cc294a2c-a232-11e4-8e9f-0011d823eebd">
	<topic>Adobe Flash Player -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.429</lt></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.429</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb15-01.html">
	<p>These updates address vulnerabilities that could potentially allow
	an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-0301</cvename>
	<cvename>CVE-2015-0302</cvename>
	<cvename>CVE-2015-0303</cvename>
	<cvename>CVE-2015-0304</cvename>
	<cvename>CVE-2015-0305</cvename>
	<cvename>CVE-2015-0306</cvename>
	<cvename>CVE-2015-0307</cvename>
	<cvename>CVE-2015-0308</cvename>
	<cvename>CVE-2015-0309</cvename>
	<url>http://helpx.adobe.com/security/products/flash-player/apsb15-01.html</url>
	</references>
	<dates>
	<discovery>2015-01-13</discovery>
	<entry>2015-01-22</entry>
	</dates>
	</vuln>

	<vuln vid="e30e0c99-a1b7-11e4-b85c-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>40.0.2214.91</lt></range>
	</package>
	<package>
	<name>chromium-pulse</name>
	<range><lt>40.0.2214.91</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/">
	<p>62 security fixes in this release, including:</p>
	<ul>
	<li>[430353] High CVE-2014-7923: Memory corruption in ICU. Credit
	to yangdingning.</li>
	<li>[435880] High CVE-2014-7924: Use-after-free in IndexedDB.
	Credit to Collin Payne.</li>
	<li>[434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit
	to mark.buer.</li>
	<li>[422824] High CVE-2014-7926: Memory corruption in ICU. Credit
	to yangdingning.</li>
	<li>[444695] High CVE-2014-7927: Memory corruption in V8. Credit to
	Christian Holler.</li>
	<li>[435073] High CVE-2014-7928: Memory corruption in V8. Credit to
	Christian Holler.</li>
	<li>[442806] High CVE-2014-7930: Use-after-free in DOM. Credit to
	cloudfuzzer.</li>
	<li>[442710] High CVE-2014-7931: Memory corruption in V8. Credit to
	cloudfuzzer.</li>
	<li>[443115] High CVE-2014-7929: Use-after-free in DOM. Credit to
	cloudfuzzer.</li>
	<li>[429666] High CVE-2014-7932: Use-after-free in DOM. Credit to
	Atte Kettunen of OUSPG.</li>
	<li>[427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit
	to aohelin.</li>
	<li>[427249] High CVE-2014-7934: Use-after-free in DOM. Credit to
	cloudfuzzer.</li>
	<li>[402957] High CVE-2014-7935: Use-after-free in Speech. Credit
	to Khalil Zhani.</li>
	<li>[428561] High CVE-2014-7936: Use-after-free in Views. Credit
	to Christoph Diehl.</li>
	<li>[419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit
	to Atte Kettunen of OUSPG.</li>
	<li>[416323] High CVE-2014-7938: Memory corruption in Fonts. Credit
	to Atte Kettunen of OUSPG.</li>
	<li>[399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit
	to Takeshi Terada.</li>
	<li>[433866] Medium CVE-2014-7940: Uninitialized-value in ICU.
	Credit to miaubiz.</li>
	<li>[428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit
	to Atte Kettunen of OUSPG and Christoph Diehl.</li>
	<li>[426762] Medium CVE-2014-7942: Uninitialized-value in Fonts.
	Credit to miaubiz.</li>
	<li>[422492] Medium CVE-2014-7943: Out-of-bounds read in Skia.
	Credit to Atte Kettunen of OUSPG.</li>
	<li>[418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium.
	Credit to cloudfuzzer.</li>
	<li>[414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium.
	Credit to cloudfuzzer.</li>
	<li>[414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts.
	Credit to miaubiz.</li>
	<li>[430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium.
	Credit to fuzztercluck.</li>
	<li>[414026] Medium CVE-2014-7948: Caching error in AppCache.
	Credit to jiayaoqijia.</li>
	<li>[449894] CVE-2015-1205: Various fixes from internal audits,
	fuzzing and other initiatives.</li>
	<li>Multiple vulnerabilities in V8 fixed at the tip of the 3.30
	branch (currently 3.30.33.15).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-7923</cvename>
	<cvename>CVE-2014-7924</cvename>
	<cvename>CVE-2014-7925</cvename>
	<cvename>CVE-2014-7926</cvename>
	<cvename>CVE-2014-7927</cvename>
	<cvename>CVE-2014-7928</cvename>
	<cvename>CVE-2014-7929</cvename>
	<cvename>CVE-2014-7930</cvename>
	<cvename>CVE-2014-7931</cvename>
	<cvename>CVE-2014-7932</cvename>
	<cvename>CVE-2014-7933</cvename>
	<cvename>CVE-2014-7934</cvename>
	<cvename>CVE-2014-7935</cvename>
	<cvename>CVE-2014-7936</cvename>
	<cvename>CVE-2014-7937</cvename>
	<cvename>CVE-2014-7938</cvename>
	<cvename>CVE-2014-7939</cvename>
	<cvename>CVE-2014-7940</cvename>
	<cvename>CVE-2014-7941</cvename>
	<cvename>CVE-2014-7942</cvename>
	<cvename>CVE-2014-7943</cvename>
	<cvename>CVE-2014-7944</cvename>
	<cvename>CVE-2014-7945</cvename>
	<cvename>CVE-2014-7946</cvename>
	<cvename>CVE-2014-7947</cvename>
	<cvename>CVE-2014-7948</cvename>
	<cvename>CVE-2015-1205</cvename>
	<url>http://googlechromereleases.blogspot.nl</url>
	</references>
	<dates>
	<discovery>2015-01-21</discovery>
	<entry>2015-01-21</entry>
	</dates>
	</vuln>

	<vuln vid="a5856eba-a015-11e4-a680-1c6f65c3c4ff">
	<topic>polarssl -- Remote attack using crafted certificates</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.12_1</lt></range>
	</package>
	<package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.9_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PolarSSL team reports:</p>
	<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04">
	<p>During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not
	initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a
	situation is created where the uninitialized pointer is passed to polarssl_free().</p>
	<p>This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this
	means clients when receiving a certificate from the server or servers in case they are actively
	asking for a client certificate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2015-1182</cvename>
	<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04</url>
	<url>https://www.certifiedsecure.com/polarssl-advisory/</url>
	</references>
	<dates>
	<discovery>2015-01-14</discovery>
	<entry>2015-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="d9360908-9d52-11e4-87fd-10bf48e1088e">
	<topic>unzip -- input sanitization errors</topic>
	<affects>
	<package>
	<name>unzip</name>
	<range><le>6.0_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-011.html">
	<p>The UnZip tool is an open source extraction utility for archives
	compressed in the zip format.</p>
	<p>The unzip command line tool is affected by heap-based buffer
	overflows within the CRC32 verification, the test_compr_eb() and
	the getZip64Data() functions. The input errors may result in
	arbitrary code execution.</p>
	<p>A specially crafted zip file, passed to unzip -t, can be used to
	trigger the vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8139</cvename>
	<cvename>CVE-2014-8140</cvename>
	<cvename>CVE-2014-8141</cvename>
	<url>http://www.info-zip.org/UnZip.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174844</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174856</url>
	</references>
	<dates>
	<discovery>2014-12-03</discovery>
	<entry>2015-01-16</entry>
	</dates>
	</vuln>

	<vuln vid="d4f45676-9d33-11e4-8275-000c292e4fd8">
	<topic>samba -- Elevation of privilege to Active Directory Domain Controller</topic>
	<affects>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba team reports:</p>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2014-8143">
	<p>In Samba's AD DC we neglected to ensure that
	attempted modifications of the userAccountControl attribute
	did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8143</cvename>
	<url>https://www.samba.org/samba/security/CVE-2014-8143</url>
	</references>
	<dates>
	<discovery>2015-01-15</discovery>
	<entry>2015-01-16</entry>
	</dates>
	</vuln>

	<vuln vid="7a8a74d1-9c34-11e4-a40b-5453ed2e2b49">
	<topic>kde-runtime -- incorrect CBC encryption handling</topic>
	<affects>
	<package>
	<name>kde-runtime</name>
	<range><lt>4.12_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Valentin Rusu reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20150109-1.txt">
	<p>Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC
	encryption blocks when encrypting secrets in kwl files. The secrets
	were still encrypted, but the result binary data corresponded to an
	ECB encrypted block instead of CBC.</p>
	<p>The ECB encryption algorithm, even if it'll scramble user data,
	will produce same encrypted byte sequence for the same input text.
	As a result, attackers may eventually find-out the encrypted
	text.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-7252</cvename>
	<url>https://www.kde.org/info/security/advisory-20150109-1.txt</url>
	</references>
	<dates>
	<discovery>2015-01-09</discovery>
	<entry>2015-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="bd62c640-9bb9-11e4-a5ad-000c297fb80f">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>35.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.4.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>35.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.32</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.4.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.32</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.4.0</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	<p>MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0
	/ rv:31.4)</p>
	<p>MFSA-2015-02 Uninitialized memory use during bitmap
	rendering</p>
	<p>MFSA-2015-03 sendBeacon requests lack an Origin header</p>
	<p>MFSA-2015-04 Cookie injection through Proxy Authenticate
	responses</p>
	<p>MFSA-2015-05 Read of uninitialized memory in Web Audio</p>
	<p>MFSA-2015-06 Read-after-free in WebRTC</p>
	<p>MFSA-2015-07 Gecko Media Plugin sandbox escape</p>
	<p>MFSA-2015-08 Delegated OCSP responder certificates failure
	with id-pkix-ocsp-nocheck extension</p>
	<p>MFSA-2015-09 XrayWrapper bypass through DOM objects</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8634</cvename>
	<cvename>CVE-2014-8635</cvename>
	<cvename>CVE-2014-8637</cvename>
	<cvename>CVE-2014-8638</cvename>
	<cvename>CVE-2014-8639</cvename>
	<cvename>CVE-2014-8640</cvename>
	<cvename>CVE-2014-8641</cvename>
	<cvename>CVE-2014-8642</cvename>
	<cvename>CVE-2014-8643</cvename>
	<cvename>CVE-2014-8636</cvename>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/</url>
	<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/</url>
	<url>https://www.mozilla.org/security/advisories/</url>
	</references>
	<dates>
	<discovery>2015-01-13</discovery>
	<entry>2015-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="daa8a49b-99b9-11e4-8f66-3085a9a4510d">
	<topic>libevent -- integer overflow in evbuffers</topic>
	<affects>
	<package>
	<name>libevent</name>
	<range><lt>1.4.15</lt></range>
	<range><ge>2.0</ge><lt>2.0.22</lt></range>
	</package>
	<package>
	<name>libevent2</name>
	<range><lt>2.0.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Security Team reports:</p>
	<blockquote cite="https://www.debian.org/security/2015/dsa-3119">
	<p>Andrew Bartlett of Catalyst reported a defect affecting certain
	applications using the Libevent evbuffer API. This defect leaves
	applications which pass insanely large inputs to evbuffers open
	to a possible heap overflow or infinite loop. In order to exploit
	this flaw, an attacker needs to be able to find a way to provoke
	the program into trying to make a buffer chunk larger than what
	will fit into a single size_t or off_t.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-6272</cvename>
	<url>https://www.debian.org/security/2015/dsa-3119</url>
	</references>
	<dates>
	<discovery>2015-01-05</discovery>
	<entry>2015-01-11</entry>
	<modified>2017-02-20</modified>
	</dates>
	</vuln>

	<vuln vid="caa98ffd-0a92-40d0-b234-fd79b429157e">
	<topic>cURL -- URL request injection vulnerability</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><lt>7.40.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150108B.html">
	<p>When libcurl sends a request to a server via a HTTP proxy, it
	copies the entire URL into the request and sends if off.
	If the given URL contains line feeds and carriage returns those will
	be sent along to the proxy too, which allows the program to for
	example send a separate HTTP request injected embedded in the URL.
	Many programs allow some kind of external sources to set the URL or
	provide partial pieces for the URL to ask for, and if the URL as
	received from the user is not stripped good enough this flaw allows
	malicious users to do additional requests in a way that was not
	intended, or just to insert request headers into the request that
	the program didn't intend.
	We are not aware of any exploit of this flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8150</cvename>
	<url>http://curl.haxx.se/docs/adv_20150108B.html</url>
	</references>
	<dates>
	<discovery>2014-12-25</discovery>
	<entry>2015-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="e9ccdb28-9802-11e4-9d9c-bcaec565249c">
	<topic>WebKit-gtk -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<range><lt>1.4.8</lt></range>
	</package>
	<package>
	<name>webkit-gtk3</name>
	<range><lt>1.4.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Webkit release team reports:</p>
	<blockquote cite="http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html">
	<p>This release fixes the following security issues:
	CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386,
	CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html</url>
	<cvename>CVE-2014-1344</cvename>
	<cvename>CVE-2014-1384</cvename>
	<cvename>CVE-2014-1385</cvename>
	<cvename>CVE-2014-1386</cvename>
	<cvename>CVE-2014-1387</cvename>
	<cvename>CVE-2014-1388</cvename>
	<cvename>CVE-2014-1389</cvename>
	<cvename>CVE-2014-1390</cvename>
	</references>
	<dates>
	<discovery>2015-01-07</discovery>
	<entry>2015-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="4e536c14-9791-11e4-977d-d050992ecde8">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_17</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1k</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_3</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_4</lt></range>
	<range><ge>10.0</ge><lt>10.0_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_8</lt></range>
	<range><ge>8.4</ge><lt>8.4_22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
	<p>DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)</p>
	<p>DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)</p>
	<p>no-ssl3 configuration sets method to NULL (CVE-2014-3569)</p>
	<p>ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)</p>
	<p>RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)</p>
	<p>DH client certificates accepted without verification [Server] (CVE-2015-0205)</p>
	<p>Certificate fingerprints can be modified (CVE-2014-8275)</p>
	<p>Bignum squaring may produce incorrect results (CVE-2014-3570)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-15:01.openssl</freebsdsa>
	<cvename>CVE-2014-3569</cvename>
	<cvename>CVE-2014-3570</cvename>
	<cvename>CVE-2014-3571</cvename>
	<cvename>CVE-2014-3572</cvename>
	<cvename>CVE-2014-8275</cvename>
	<cvename>CVE-2015-0204</cvename>
	<cvename>CVE-2015-0205</cvename>
	<cvename>CVE-2015-0206</cvename>
	<url>https://www.openssl.org/news/secadv_20150108.txt</url>
	</references>
	<dates>
	<discovery>2015-01-08</discovery>
	<entry>2015-01-08</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="5e135178-8aeb-11e4-801f-0022156e8794">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.7.5,1</lt></range>
	<range><ge>3.8,1</ge><lt>3.8.5,1</lt></range>
	<range><ge>3.9,1</ge><lt>3.9.3,1</lt></range>
	<range><ge>4.0,1</ge><lt>4.0.1,1</lt></range>
	</package>
	<package>
	<name>zh-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9039">
	<p>wp-login.php in WordPress before 3.7.5, 3.8.x before
	3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow
	remote attackers to reset passwords by leveraging access to
	an e-mail account that received a password-reset message.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9038">
	<p>wp-includes/http.php in WordPress before 3.7.5, 3.8.x
	before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
	allows remote attackers to conduct server-side request
	forgery (SSRF) attacks by referring to a 127.0.0.0/8
	resource.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9037">
	<p>WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
	3.9.3, and 4.x before 4.0.1 might allow remote attackers to
	obtain access to an account idle since 2008 by leveraging an
	improper PHP dynamic type comparison for an MD5 hash.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9036">
	<p>Cross-site scripting (XSS) vulnerability in WordPress
	before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and
	4.x before 4.0.1 allows remote attackers to inject arbitrary
	web script or HTML via a crafted Cascading Style Sheets
	(CSS) token sequence in a post.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9035">
	<p>Cross-site scripting (XSS) vulnerability in Press This in
	WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
	3.9.3, and 4.x before 4.0.1 allows remote attackers to
	inject arbitrary web script or HTML via unspecified
	vectors</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9034">
	<p>wp-includes/class-phpass.php in WordPress before 3.7.5,
	3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
	allows remote attackers to cause a denial of service (CPU
	consumption) via a long password that is improperly handled
	during hashing, a similar issue to CVE-2014-9016.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9033">
	<p>Cross-site request forgery (CSRF) vulnerability in
	wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0
	allows remote attackers to hijack the authentication of
	arbitrary users for requests that reset passwords.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9033</cvename>
	<cvename>CVE-2014-9034</cvename>
	<cvename>CVE-2014-9035</cvename>
	<cvename>CVE-2014-9036</cvename>
	<cvename>CVE-2014-9037</cvename>
	<cvename>CVE-2014-9038</cvename>
	<cvename>CVE-2014-9039</cvename>
	</references>
	<dates>
	<discovery>2014-11-25</discovery>
	<entry>2015-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="c564f9bd-8ba7-11e4-801f-0022156e8794">
	<topic>png -- heap overflow for 32-bit builds</topic>
	<affects>
	<package>
	<name>png</name>
	<range><ge>1.2.6</ge><lt>1.5.21</lt></range>
	<range><ge>1.6</ge><lt>1.6.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>32-bit builds of PNG library are vulnerable to an unsigned
	integer overflow that is triggered by a crafted wide
	interlaced images.
	Overflow results in a heap corruption that will crash the
	application and may lead to the controlled overwrite of a
	selected portions of process address space.</p>
	</body>
	</description>
	<references>
	<url>http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt</url>
	<url>http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/</url>
	</references>
	<dates>
	<discovery>2014-12-23</discovery>
	<entry>2015-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="9575259a-92d5-11e4-bce6-d050992ecde8">
	<topic>file -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>file</name>
	<range><lt>5.21</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.4</ge><lt>8.4_20</lt></range>
	<range><ge>9.1</ge><lt>9.1_23</lt></range>
	<range><ge>9.2</ge><lt>9.2_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_6</lt></range>
	<range><ge>10.0</ge><lt>10.0_13</lt></range>
	<range><ge>10.1</ge><lt>10.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2014/q4/1056">
	<p>Thomas Jarosch of Intra2net AG reported a number of
	denial of service issues (resource consumption) in
	the ELF parser used by file(1). These issues were
	fixed in the 5.21 release of file(1), but by mistake
	are missing from the changelog.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3710</cvename>
	<cvename>CVE-2014-8116</cvename>
	<cvename>CVE-2014-8117</cvename>
	<freebsdsa>SA-14:28.file</freebsdsa>
	<url>http://seclists.org/oss-sec/2014/q4/1056</url>
	</references>
	<dates>
	<discovery>2014-12-16</discovery>
	<entry>2015-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="c3d43001-8064-11e4-801f-0022156e8794">
	<topic>mutt -- denial of service via crafted mail message</topic>
	<affects>
	<package>
	<name>mutt</name>
	<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
	</package>
	<package>
	<name>ja-mutt</name>
	<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
	</package>
	<package>
	<name>zh-mutt</name>
	<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVD reports:</p>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9116">
	<p>The write_one_header function in mutt 1.5.23 does not
	properly handle newline characters at the beginning of a
	header, which allows remote attackers to cause a denial of
	service (crash) via a header with an empty body, which
	triggers a heap-based buffer overflow in the mutt_substrdup
	function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>71334</bid>
	<cvename>CVE-2014-9116</cvename>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125</url>
	<url>http://dev.mutt.org/trac/ticket/3716</url>
	</references>
	<dates>
	<discovery>2014-11-26</discovery>
	<entry>2014-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="4033d826-87dd-11e4-9079-3c970e169bc2">
	<topic>ntp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ntp</name>
	<name>ntp-devel</name>
	<range><lt>4.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/852879">
	<p>The Network Time Protocol (NTP) provides networked
	systems with a way to synchronize time for various
	services and applications. ntpd version 4.2.7 and
	previous versions allow attackers to overflow several
	buffers in a way that may allow malicious code to
	be executed. ntp-keygen prior to version 4.2.7p230
	also uses a non-cryptographic random number generator
	when generating symmetric keys.</p>
	<p>The buffer overflow vulnerabilities in ntpd may
	allow a remote unauthenticated attacker to execute
	arbitrary malicious code with the privilege level
	of the ntpd process. The weak default key and
	non-cryptographic random number generator in
	ntp-keygen may allow an attacker to gain
	information regarding the integrity checking
	and authentication encryption schemes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9293</cvename>
	<cvename>CVE-2014-9294</cvename>
	<cvename>CVE-2014-9295</cvename>
	<cvename>CVE-2014-9296</cvename>
	<url>http://www.kb.cert.org/vuls/id/852879</url>
	</references>
	<dates>
	<discovery>2014-12-19</discovery>
	<entry>2014-12-20</entry>
	</dates>
	</vuln>

	<vuln vid="1d567278-87a5-11e4-879c-000c292ee6b8">
	<topic>git -- Arbitrary command execution on case-insensitive filesystems</topic>
	<affects>
	<package>
	<name>git</name>
	<range><lt>2.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Git Project reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.linux.kernel/1853266">
	<p>When using a case-insensitive filesystem an attacker can
	craft a malicious Git tree that will cause Git to overwrite
	its own .git/config file when cloning or checking out a
	repository, leading to arbitrary command execution in the
	client machine. If you are a hosting service whose users
	may fetch from your service to Windows or Mac OS X machines,
	you are strongly encouraged to update to protect such users
	who use existing versions of Git.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-9390</cvename>
	<url>https://github.com/blog/1938-git-client-vulnerability-announced</url>
	<url>http://article.gmane.org/gmane.linux.kernel/1853266</url>
	</references>
	<dates>
	<discovery>2014-12-19</discovery>
	<entry>2014-12-19</entry>
	</dates>
	</vuln>

	<vuln vid="0c5cf7c4-856e-11e4-a089-60a44c524f57">
	<topic>otrs -- Incomplete Access Control</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><gt>3.2.*</gt><lt>3.2.17</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.11</lt></range>
	<range><gt>4.0.*</gt><lt>4.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS project reports:</p>
	<blockquote cite="http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/">
	<p>An attacker with valid OTRS credentials could access and manipulate ticket data
	of other users via the GenericInterface, if a ticket webservice is configured
	and not additionally secured.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/</url>
	<cvename>CVE-2014-9324</cvename>
	</references>
	<dates>
	<discovery>2014-12-16</discovery>
	<entry>2014-12-16</entry>
	</dates>
	</vuln>

	<vuln vid="f5561ade-846c-11e4-b7a7-20cf30e32f6d">
	<topic>subversion -- DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>mod_dav_svn</name>
	<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
	</package>
	<package>
	<name>subversion16</name>
	<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
	</package>
	<package>
	<name>subversion17</name>
	<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
	</package>
	<package>
	<name>subversion</name>
	<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
	receives a REPORT request for some invalid formatted special URIs.</p>
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
	receives a request for some invalid formatted special URIs.</p>
	<p>We consider this to be a medium risk vulnerability. Repositories which
	allow for anonymous reads will be vulnerable without authentication.
	Unfortunately, no special configuration is required and all mod_dav_svn
	servers are vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3580</cvename>
	<cvename>CVE-2014-8108</cvename>
	<url>http://subversion.apache.org/security/CVE-2014-3580-advisory.txt</url>
	<url>http://subversion.apache.org/security/CVE-2014-8108-advisory.txt</url>
	</references>
	<dates>
	<discovery>2014-12-13</discovery>
	<entry>2014-12-15</entry>
	</dates>
	</vuln>

	<vuln vid="fdf72a0e-8371-11e4-bc20-001636d274f3">
	<topic>NVIDIA UNIX driver -- remote denial of service or arbitrary code execution</topic>
	<affects>
	<package>
	<name>nvidia-driver</name>
	<range><lt>340.65</lt></range>
	</package>
	<package>
	<name>nvidia-driver-304</name>
	<range><lt>304.125</lt></range>
	</package>
	<package>
	<name>nvidia-driver-173</name>
	<range><le>173.14.35_3</le></range>
	</package>
	<package>
	<name>nvidia-driver-96</name>
	<range><le>96.43.23_2</le></range>
	</package>
	<package>
	<name>nvidia-driver-71</name>
	<range><le>71.86.15_4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVIDIA Unix security team reports:</p>
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3610">
	<p>The GLX indirect rendering support supplied on NVIDIA products
	is subject to the recently disclosed X.Org vulnerabilities
	(CVE-2014-8093, CVE-2014-8098) as well as internally identified
	vulnerabilities (CVE-2014-8298).</p>
	<p>Depending on how it is configured, the X server typically runs
	with raised privileges, and listens for GLX indirect rendering
	protocol requests from a local socket and potentially a TCP/IP
	port. The vulnerabilities could be exploited in a way that
	causes the X server to access uninitialized memory or overwrite
	arbitrary memory in the X server process. This can cause a
	denial of service (e.g., an X server segmentation fault), or
	could be exploited to achieve arbitrary code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8298</cvename>
	<cvename>CVE-2014-8093</cvename>
	<cvename>CVE-2014-8098</cvename>
	</references>
	<dates>
	<discovery>2014-12-03</discovery>
	<entry>2014-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="ab3e98d9-8175-11e4-907d-d050992ecde8">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<name>bind99-base</name>
	<range><lt>9.9.6</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<name>bind98-base</name>
	<name>bind96</name>
	<name>bind96-base</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_6</lt></range>
	<range><ge>9.2</ge><lt>9.2_16</lt></range>
	<range><ge>9.1</ge><lt>9.1_23</lt></range>
	<range><ge>8.4</ge><lt>8.4_20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/blogs/important-security-advisory-posted/">
	<p>We have today posted updated versions of 9.9.6 and 9.10.1
	to address a significant security vulnerability in DNS
	resolution. The flaw was discovered by Florian Maury of
	ANSSI, and applies to any recursive resolver that does not
	support a limit on the number of recursions. [<a href="http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html">CERTFR-2014-AVI-512</a>],
	[USCERT <a href="www.kb.cert.org/vuls/id/264212">VU#264212</a>]</p>
	<p>A flaw in delegation handling could be exploited to put named
	into an infinite loop, in which each lookup of a name server
	triggered additional lookups of more name servers. This has
	been addressed by placing limits on the number of levels of
	recursion named will allow (default 7), and on the number of
	queries that it will send before terminating a recursive query
	(default 50). The recursion depth limit is configured via the
	max-recursion-depth option, and the query limit via the
	max-recursion-queries option. For more information, see the
	security advisory at <a href="https://kb.isc.org/article/AA-01216/">https://kb.isc.org/article/AA-01216/</a>.
	<a href="https://kb.isc.org/article/AA-01216/">[CVE-2014-8500]</a>
	[RT #37580]</p>
	<p>In addition, we have also corrected a potential security
	vulnerability in the GeoIP feature in the 9.10.1 release only.
	For more information on this issue, see the security advisory
	at <a href="https://kb.isc.org/article/AA-01217">https://kb.isc.org/article/AA-01217</a>.
	<a href="https://kb.isc.org/article/AA-01217">[CVE-2014-8680]</a></p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-14:29.bind</freebsdsa>
	<cvename>CVE-2014-8500</cvename>
	<cvename>CVE-2014-8680</cvename>
	<url>https://www.isc.org/blogs/important-security-advisory-posted/</url>
	</references>
	<dates>
	<discovery>2014-12-08</discovery>
	<entry>2014-12-11</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="94268da0-8118-11e4-a180-001999f8d30b">
	<topic>asterisk -- Remote Crash Vulnerability in WebSocket Server</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.14.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>When handling a WebSocket frame the res_http_websocket
	module dynamically changes the size of the memory used
	to allow the provided payload to fit. If a payload length
	of zero was received the code would incorrectly attempt
	to resize to zero. This operation would succeed and end
	up freeing the memory but be treated as a failure. When
	the session was subsequently torn down this memory would
	get freed yet again causing a crash.</p>
	<p>Users of the WebSocket functionality also did not take
	into account that provided text frames are not guaranteed
	to be NULL terminated. This has been fixed in chan_sip
	and chan_pjsip in the applicable versions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-019.html</url>
	<cvename>CVE-2014-9374</cvename>
	</references>
	<dates>
	<discovery>2014-10-30</discovery>
	<entry>2014-12-11</entry>
	<modified>2015-01-29</modified>
	</dates>
	</vuln>

	<vuln vid="27b9b2f0-8081-11e4-b4ca-bcaec565249c">
	<topic>xserver -- multiple issue with X client request handling</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><lt>1.12.4_10,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alan Coopersmith reports:</p>
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-December/002500.html">
	<p>Ilja van Sprundel, a security researcher with IOActive, has
	discovered a large number of issues in the way the X server
	code base handles requests from X clients, and has worked
	with X.Org's security team to analyze, confirm, and fix
	these issues.</p>

	<p>The vulnerabilities could be exploited to cause the X server
	to access uninitialized memory or overwrite arbitrary memory
	in the X server process. This can cause a denial of service
	(e.g., an X server segmentation fault), or could be exploited
	to achieve arbitrary code execution.</p>

	<p>The GLX extension to the X Window System allows an X client
	to send X protocol to the X server, to request that the X
	server perform OpenGL rendering on behalf of the X client.
	This is known as "GLX indirect rendering", as opposed to
	"GLX direct rendering" where the X client submits OpenGL
	rendering commands directly to the GPU, bypassing the X
	server and avoiding the X server code for GLX protocol
	handling.</p>

	<p>Most GLX indirect rendering implementations share some
	common ancestry, dating back to "Sample Implementation"
	code from Silicon Graphics, Inc (SGI), which SGI
	originally commercially licensed to other Unix workstation
	and graphics vendors, and later released as open source, so
	those vulnerabilities may affect other licensees of SGI's
	code base beyond those running code from the X.Org Foundation
	or the XFree86 Project.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.x.org/archives/xorg-announce/2014-December/002500.html</url>
	<cvename>CVE-2014-8091</cvename>
	<cvename>CVE-2014-8092</cvename>
	<cvename>CVE-2014-8093</cvename>
	<cvename>CVE-2014-8094</cvename>
	<cvename>CVE-2014-8095</cvename>
	<cvename>CVE-2014-8096</cvename>
	<cvename>CVE-2014-8097</cvename>
	<cvename>CVE-2014-8098</cvename>
	<cvename>CVE-2014-8099</cvename>
	<cvename>CVE-2014-8100</cvename>
	<cvename>CVE-2014-8101</cvename>
	<cvename>CVE-2014-8102</cvename>
	</references>
	<dates>
	<discovery>2014-12-09</discovery>
	<entry>2014-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="10d73529-7f4b-11e4-af66-00215af774f0">
	<topic>unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources</topic>
	<affects>
	<package>
	<name>unbound</name>
	<range><lt>1.5.1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_14</lt></range>
	<range><ge>10.1</ge><lt>10.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unbound developer reports:</p>
	<blockquote cite="http://unbound.net/downloads/CVE-2014-8602.txt">
	<p>The resolver can be tricked into following an endless series of
	delegations, this consumes a lot of resources.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://unbound.net/downloads/CVE-2014-8602.txt</url>
	<freebsdsa>SA-14:30.unbound</freebsdsa>
	<cvename>CVE-2014-8602</cvename>
	</references>
	<dates>
	<discovery>2014-12-08</discovery>
	<entry>2014-12-09</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="567beb1e-7e0a-11e4-b9cc-bcaec565249c">
	<topic>freetype -- Out of bounds stack-based read/write</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.5.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner LEMBERG reports:</p>
	<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html">
	<p>The fix for CVE-2014-2240 was not 100% complete to fix the issue
	from the CVE completly.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html</url>
	<cvename>CVE-2014-2240</cvename>
	</references>
	<dates>
	<discovery>2014-12-07</discovery>
	<entry>2014-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="c9c46fbf-7b83-11e4-a96e-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS and DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.13.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php">
	<p>DoS vulnerability with long passwords.</p>
	<p>With very long passwords it was possible to initiate a
	denial of service attack on phpMyAdmin.</p>
	<p>We consider this vulnerability to be serious.</p>
	<p>This vulnerability can be mitigated by configuring
	throttling in the webserver.</p>
	</blockquote>

	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php">
	<p>XSS vulnerability in redirection mechanism.</p>
	<p>With a crafted URL it was possible to trigger an XSS in
	the redirection mechanism in phpMyAdmin.</p>
	<p>We consider this vulnerability to be non critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php</url>
	<cvename>CVE-2014-9218</cvename>
	<cvename>CVE-2014-9219</cvename>
	</references>
	<dates>
	<discovery>2014-12-03</discovery>
	<entry>2014-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="7ae61870-9dd2-4884-a2f2-f19bb5784d09">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>34.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.3.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>34.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.31</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.3.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.31</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.3.0</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.3.0</lt></range>
	</package>
	<package>
	<name>nss</name>
	<range><lt>3.17.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>ASN.1 DER decoding of lengths is too permissive, allowing
	undetected smuggling of arbitrary data</p>
	<p>MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10
	logging input data to /tmp directory</p>
	<p>MFSA-2014-89 Bad casting from the BasicThebesLayer to
	BasicContainerLayer</p>
	<p>MFSA-2014-88 Buffer overflow while parsing media content</p>
	<p>MFSA-2014-87 Use-after-free during HTML5 parsing</p>
	<p>MFSA-2014-86 CSP leaks redirect data via violation reports</p>
	<p>MFSA-2014-85 XMLHttpRequest crashes with some input streams</p>
	<p>MFSA-2014-84 XBL bindings accessible via improper CSS
	declarations</p>
	<p>MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0
	/ rv:31.3)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1587</cvename>
	<cvename>CVE-2014-1588</cvename>
	<cvename>CVE-2014-1589</cvename>
	<cvename>CVE-2014-1590</cvename>
	<cvename>CVE-2014-1591</cvename>
	<cvename>CVE-2014-1592</cvename>
	<cvename>CVE-2014-1593</cvename>
	<cvename>CVE-2014-1594</cvename>
	<cvename>CVE-2014-1595</cvename>
	<cvename>CVE-2014-1569</cvename>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-83</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-84</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-85</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-86</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-87</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-88</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-89</url>
	<url>https://www.mozilla.org/security/advisories/mfsa2014-90</url>
	<url>https://www.mozilla.org/security/advisories/</url>
	</references>
	<dates>
	<discovery>2014-12-01</discovery>
	<entry>2014-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="23ab5c3e-79c3-11e4-8b1e-d050992ecde8">
	<topic>OpenVPN -- denial of service security vulnerability</topic>
	<affects>
	<package>
	<name>openvpn</name>
	<range><lt>2.0.11</lt></range>
	<range><ge>2.1.0</ge><lt>2.2.3</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenVPN project reports:</p>
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b">
	<p>In late November 2014 Dragana Damjanovic notified OpenVPN
	developers of a critical denial of service security vulnerability
	(CVE-2014-8104). The vulnerability allows an tls-authenticated
	client to crash the server by sending a too-short control channel
	packet to the server. In other words this vulnerability is denial
	of service only.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8104</cvename>
	<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b</url>
	</references>
	<dates>
	<discovery>2014-12-01</discovery>
	<entry>2014-12-02</entry>
	</dates>
	</vuln>

	<vuln vid="a33addf6-74e6-11e4-a615-f8b156b6dcc8">
	<topic>flac -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>flac</name>
	<range><lt>1.3.0_3</lt></range>
	</package>
	<package>
	<name>linux-c6-flac</name>
	<range><lt>1.2.1_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Erik de Castro Lopo reports:</p>
	<blockquote cite="http://lists.xiph.org/pipermail/flac-dev/2014-November/005226.html">
	<p>Google Security Team member, Michele Spagnuolo, recently
	found two potential problems in the FLAC code base. They are:</p>
	<ul>
	<li>CVE-2014-9028: Heap buffer write overflow.</li>
	<li>CVE-2014-8962: Heap buffer read overflow.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e</url>
	<cvename>CVE-2014-8962</cvename>
	<url>https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85</url>
	<cvename>CVE-2014-9028</cvename>
	</references>
	<dates>
	<discovery>2014-11-25</discovery>
	<entry>2014-11-25</entry>
	<modified>2015-07-15</modified>
	</dates>
	</vuln>

	<vuln vid="7bfd797c-716d-11e4-b008-001999f8d30b">
	<topic>asterisk -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.14.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>AST-2014-014 - High call load may result in hung
	channels in ConfBridge.</p>
	<p>AST-2014-017 - Permission escalation through ConfBridge
	actions/dialplan functions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-014.html</url>
	<cvename>CVE-2014-8414</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-017.html</url>
	<cvename>CVE-2014-8417</cvename>
	</references>
	<dates>
	<discovery>2014-11-21</discovery>
	<entry>2014-11-21</entry>
	</dates>
	</vuln>

	<vuln vid="a92ed304-716c-11e4-b008-001999f8d30b">
	<topic>asterisk -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><lt>1.8.32.1</lt></range>
	</package>
	<package>
	<name>asterisk11</name>
	<range><lt>11.14.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>AST-2014-012 - Mixed IP address families in access
	control lists may permit unwanted traffic.</p>
	<p>AST-2014-018 - AMI permission escalation through DB
	dialplan function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-012.html</url>
	<cvename>CVE-2014-8412</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-018.html</url>
	<cvename>CVE-2014-8418</cvename>
	</references>
	<dates>
	<discovery>2014-11-21</discovery>
	<entry>2014-11-21</entry>
	</dates>
	</vuln>

	<vuln vid="a5d4a82a-7153-11e4-88c7-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS and information disclosure vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php">
	<ul>
	<li>With a crafted database, table or column name it is
	possible to trigger an XSS attack in the table browse
	page.</li>
	<li>With a crafted ENUM value it is possible to trigger
	XSS attacks in the table print view and zoom search
	pages.</li>
	<li>With a crafted value for font size it is possible to
	trigger an XSS attack in the home page.</li>
	</ul>
	<p>These vulnerabilities can be triggered only by someone
	who is logged in to phpMyAdmin, as the usual token
	protection prevents non-logged-in users from accessing the
	required pages. Moreover, exploitation of the XSS
	vulnerability related to the font size requires forgery of
	the pma_fontsize cookie.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php">
	<p> In the GIS editor feature, a parameter specifying the
	geometry type was not correcly validated, opening the door
	to a local file inclusion attack.</p>
	<p>This vulnerability can be triggered only by someone who
	is logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	page.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php">
	<p>With a crafted file name it is possible to trigger an
	XSS in the error reporting page.</p>
	<p>This vulnerability can be triggered only by someone who
	is logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	page.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php">
	<p>In the error reporting feature, a parameter specifying
	the file was not correctly validated, allowing the
	attacker to derive the line count of an arbitrary file</p>
	<p>This vulnerability can be triggered only by someone who
	is logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	page.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php</url>
	<cvename>CVE-2014-8958</cvename>
	<cvename>CVE-2014-8959</cvename>
	<cvename>CVE-2014-8960</cvename>
	<cvename>CVE-2014-8961</cvename>
	</references>
	<dates>
	<discovery>2014-11-20</discovery>
	<entry>2014-11-21</entry>
	</dates>
	</vuln>

	<vuln vid="890b6b22-70fa-11e4-91ae-5453ed2e2b49">
	<topic>kwebkitpart, kde-runtime -- insufficient input validation</topic>
	<affects>
	<package>
	<name>kde-runtime</name>
	<range><lt>4.14.2_2</lt></range>
	</package>
	<package>
	<name>kwebkitpart</name>
	<range><lt>1.3.2_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Aastals Cid reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20141113-1.txt">
	<p>kwebkitpart and the bookmarks:// io slave were not sanitizing
	input correctly allowing to some javascript being executed on the
	context of the referenced hostname.</p>
	<p>Whilst in most cases, the JavaScript will be executed in an
	untrusted context, with the bookmarks IO slave, it will be executed
	in the context of the referenced hostname. It should however be
	noted that KDE mitigates this risk by attempting to ensure that
	such URLs cannot be embedded directly into Internet hosted
	content.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.kde.org/info/security/advisory-20141113-1.txt</url>
	<cvename>CVE-2014-8600</cvename>
	</references>
	<dates>
	<discovery>2014-11-13</discovery>
	<entry>2014-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="5a35bc56-7027-11e4-a4a3-001999f8d30b">
	<topic>yii -- Remote arbitrary PHP code execution</topic>
	<affects>
	<package>
	<name>yii</name>
	<range><lt>1.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yii PHP Framework developers report:</p>
	<blockquote cite="http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/">
	<p>We are releasing Yii 1.1.15 to fix a security issue
	found in 1.1.14. We urge all 1.1.14 users to upgrade their
	Yii to this latest release. Note that the issue only
	affects 1.1.14. All previous releases are not affected.
	Upgrading to this release from 1.1.14 is very safe and
	will not break your existing code.</p>
	<p>The vulnerability is in the CDetailView widget. When
	a Yii application uses this widget and configures the
	"value" property of a CDetailView attribute using end
	user inputs, it may allow attackers to potentially execute
	arbitrary PHP scripts on the server. We are not showing
	how to exploit it here to allow users to upgrade before
	details about the exploit become publicly known. To our
	knowledge the details of this issue are only known to
	core team members.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4672</cvename>
	<url>http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix</url>
	</references>
	<dates>
	<discovery>2014-07-03</discovery>
	<entry>2014-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="d395e44f-6f4f-11e4-a444-00262d5ed8ee">
	<topic>chromium -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>chromium</name>
	<range><lt>39.0.2171.65</lt></range>
	</package>
	<package>
	<name>chromium-pulse</name>
	<range><lt>39.0.2171.65</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Chrome Releases reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html">
	<p>42 security fixes in this release, including:</p>
	<ul>
	<li>[389734] High CVE-2014-7899: Address bar spoofing. Credit to
	Eli Grey.</li>
	<li>[406868] High CVE-2014-7900: Use-after-free in pdfium. Credit
	to Atte Kettunen from OUSPG.</li>
	<li>[413375] High CVE-2014-7901: Integer overflow in pdfium. Credit
	to cloudfuzzer.</li>
	<li>[414504] High CVE-2014-7902: Use-after-free in pdfium. Credit
	to cloudfuzzer.</li>
	<li>[414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit
	to cloudfuzzer.</li>
	<li>[418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to
	Atte Kettunen from OUSPG.</li>
	<li>[421817] High CVE-2014-7905: Flaw allowing navigation to
	intents that do not have the BROWSABLE category. Credit to
	WangTao(neobyte) of Baidu X-Team.</li>
	<li>[423030] High CVE-2014-7906: Use-after-free in pepper plugins.
	Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
	<li>[423703] High CVE-2014-0574: Double-free in Flash. Credit to
	biloulehibou.</li>
	<li>[424453] High CVE-2014-7907: Use-after-free in blink. Credit to
	Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
	<li>[425980] High CVE-2014-7908: Integer overflow in media. Credit
	to Christoph Diehl.</li>
	<li>[391001] Medium CVE-2014-7909: Uninitialized memory read in
	Skia. Credit to miaubiz.</li>
	<li>CVE-2014-7910: Various fixes from internal audits, fuzzing and
	other initiatives.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0574</cvename>
	<cvename>CVE-2014-7899</cvename>
	<cvename>CVE-2014-7900</cvename>
	<cvename>CVE-2014-7901</cvename>
	<cvename>CVE-2014-7902</cvename>
	<cvename>CVE-2014-7903</cvename>
	<cvename>CVE-2014-7904</cvename>
	<cvename>CVE-2014-7905</cvename>
	<cvename>CVE-2014-7906</cvename>
	<cvename>CVE-2014-7907</cvename>
	<cvename>CVE-2014-7908</cvename>
	<cvename>CVE-2014-7909</cvename>
	<cvename>CVE-2014-7910</cvename>
	<url>http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html</url>
	</references>
	<dates>
	<discovery>2014-11-18</discovery>
	<entry>2014-11-18</entry>
	</dates>
	</vuln>

	<vuln vid="dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49">
	<topic>kde-workspace -- privilege escalation</topic>
	<affects>
	<package>
	<name>kde-workspace</name>
	<range><lt>4.11.13_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Edmundson reports:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20141106-1.txt">
	<p>KDE workspace configuration module for setting the date and time
	has a helper program which runs as root for performing actions.
	This is secured with polkit.</p>
	<p>This helper takes the name of the ntp utility to run as an
	argument. This allows a hacker to run any arbitrary command as root
	under the guise of updating the time.</p>
	<p>An application can gain root priveledges from an admin user with
	either misleading information or no interaction.</p>
	<p>On some systems the user will be shown a prompt to change the
	time. However, if the system has policykit-desktop-privileges
	installed, the datetime helper will be invoked by an admin user
	without any prompts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8651</cvename>
	<mlist>http://seclists.org/oss-sec/2014/q4/520</mlist>
	</references>
	<dates>
	<discovery>2014-11-06</discovery>
	<entry>2014-11-17</entry>
	</dates>
	</vuln>

	<vuln vid="c1930f45-6982-11e4-80e1-bcaec565249c">
	<topic>dbus -- incomplete fix for CVE-2014-3636 part A</topic>
	<affects>
	<package>
	<name>dbus</name>
	<range><lt>1.8.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon McVittie reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-November/016395.html">
	<p>The patch issued by the D-Bus maintainers for CVE-2014-3636
	was based on incorrect reasoning, and does not fully prevent
	the attack described as "CVE-2014-3636 part A", which is
	repeated below. Preventing that attack requires raising the
	system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher
	value. CVE-2014-7824 has been allocated for this
	vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-7824</cvename>
	<url>http://lists.freedesktop.org/archives/dbus/2014-November/016395.html</url>
	</references>
	<dates>
	<discovery>2014-11-10</discovery>
	<entry>2014-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e">
	<topic>wget -- path traversal vulnerability in recursive FTP mode</topic>
	<affects>
	<package>
	<name>wget</name>
	<range><lt>1.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877">
	<p>Absolute path traversal vulnerability in GNU Wget before
	1.16, when recursion is enabled, allows remote FTP servers
	to write to arbitrary files, and consequently execute
	arbitrary code, via a LIST response that references the same
	filename within two entries, one of which indicates that the
	filename is for a symlink. </p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4877</cvename>
	<certvu>685996</certvu>
	</references>
	<dates>
	<discovery>2014-10-27</discovery>
	<entry>2014-11-08</entry>
	</dates>
	</vuln>

	<vuln vid="0167f5ad-64ea-11e4-98c1-00269ee29e57">
	<topic>Konversation -- out-of-bounds read on a heap-allocated array</topic>
	<affects>
	<package>
	<name>konversation</name>
	<range><lt>1.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Konversation developers report:</p>
	<blockquote cite="https://www.kde.org/info/security/advisory-20141104-1.txt">
	<p>Konversation's Blowfish ECB encryption support assumes incoming blocks
	to be the expected 12 bytes. The lack of a sanity-check for the actual
	size can cause a denial of service and an information leak to the local
	user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-8483</cvename>
	<url>https://www.kde.org/info/security/advisory-20141104-1.txt</url>
	</references>
	<dates>
	<discovery>2014-11-04</discovery>
	<entry>2014-11-05</entry>
	</dates>
	</vuln>

	<vuln vid="21ce1840-6107-11e4-9e84-0022156e8794">
	<topic>twiki -- remote Perl code execution</topic>
	<affects>
	<package>
	<name>twiki</name>
	<range><lt>5.1.4_1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TWiki developers report:</p>
	<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236">
	<p>The debugenableplugins request parameter allows arbitrary
	Perl code execution.</p>
	<p>Using an HTTP GET request towards a TWiki server,
	add a specially crafted debugenableplugins request parameter
	to TWiki's view script (typically port 80/TCP).
	Prior authentication may or may not be necessary.</p>
	<p>A remote attacker can execute arbitrary Perl code
	to view and modify any file the webserver user has access to.</p>
	<p>Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit</p>
	<p>The TWiki site is vulnerable if you see a page with text
	"Vulnerable!".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-7236</cvename>
	<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236</url>
	</references>
	<dates>
	<discovery>2014-10-09</discovery>
	<entry>2014-10-31</entry>
	</dates>
	</vuln>

	<vuln vid="0dad9114-60cc-11e4-9e84-0022156e8794">
	<topic>jenkins -- slave-originated arbitrary code execution on master servers</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.587</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>1.580.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30">
	<p>Historically, Jenkins master and slaves behaved as if
	they altogether form a single distributed process. This
	means a slave can ask a master to do just about anything
	within the confinement of the operating system, such as
	accessing files on the master or trigger other jobs on
	Jenkins.</p>
	<p>This has increasingly become problematic, as larger
	enterprise deployments have developed more sophisticated
	trust separation model, where the administators of a master
	might take slaves owned by other teams. In such an
	environment, slaves are less trusted than the master.
	Yet the "single distributed process" assumption was not
	communicated well to the users, resulting in vulnerabilities
	in some deployments.</p>
	<p>SECURITY-144 (CVE-2014-3665) introduces a new subsystem
	to address this problem. This feature is off by default for
	compatibility reasons. See Wiki for more details, who should
	turn this on, and implications.</p>
	<p>CVE-2014-3566 is rated high. It only affects
	installations that accept slaves from less trusted
	computers, but this will allow an owner of of such slave to
	mount a remote code execution attack on Jenkins.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3665</cvename>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30</url>
	<url>https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control</url>
	<url>http://www.cloudbees.com/jenkins-security-advisory-2014-10-30</url>
	</references>
	<dates>
	<discovery>2014-10-30</discovery>
	<entry>2014-10-31</entry>
	</dates>
	</vuln>

	<vuln vid="f8c88d50-5fb3-11e4-81bd-5453ed2e2b49">
	<topic>libssh -- PRNG state reuse on forking servers</topic>
	<affects>
	<package>
	<name>libssh</name>
	<range><lt>0.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aris Adamantiadis reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/05/1">
	<p>When accepting a new connection, the server forks and the
	child process handles the request. The RAND_bytes() function
	of openssl doesn't reset its state after the fork, but
	simply adds the current process id (getpid) to the PRNG
	state, which is not guaranteed to be unique.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0017</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2014/03/05/1</mlist>
	<url>http://secunia.com/advisories/57407</url>
	</references>
	<dates>
	<discovery>2014-03-05</discovery>
	<entry>2014-10-29</entry>
	</dates>
	</vuln>

	<vuln vid="d057c5e6-5b20-11e4-bebd-000c2980a9f3">
	<topic>libpurple/pidgin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libpurple</name>
	<range><lt>2.10.10</lt></range>
	</package>
	<package>
	<name>pidgin</name>
	<range><lt>2.10.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The pidgin development team reports:</p>
	<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
	<p>.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3694</cvename>
	<cvename>CVE-2014-3697</cvename>
	<cvename>CVE-2014-3696</cvename>
	<cvename>CVE-2014-3695</cvename>
	<cvename>CVE-2014-3698</cvename>
	<url>https://developer.pidgin.im/wiki/ChangeLog</url>
	</references>
	<dates>
	<discovery>2014-10-22</discovery>
	<entry>2014-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="25b78f04-59c8-11e4-b711-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page.</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.10.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php">
	<p>With a crafted database or table name it is possible to
	trigger an XSS in SQL debug output when enabled and in
	server monitor page when viewing and analysing executed
	queries.</p>
	<p>This vulnerability can be triggered only by someone who
	is logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	pages. Moreover, debugging SQL is a developer option which
	is disabled by default and expected to be disabled in
	production environments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php</url>
	<cvename>CVE-2014-8326</cvename>
	</references>
	<dates>
	<discovery>2014-10-21</discovery>
	<entry>2014-10-22</entry>
	</dates>
	</vuln>

	<vuln vid="76c7a0f5-5928-11e4-adc7-001999f8d30b">
	<topic>asterisk -- Asterisk Susceptibility to POODLE Vulnerability</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><lt>1.8.31.1</lt></range>
	</package>
	<package>
	<name>asterisk11</name>
	<range><lt>11.13.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	<p>The POODLE vulnerability is described under CVE-2014-3566.
	This advisory describes the Asterisk's project susceptibility
	to this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-011.html</url>
	<cvename>CVE-2014-3566</cvename>
	</references>
	<dates>
	<discovery>2014-10-20</discovery>
	<entry>2014-10-21</entry>
	</dates>
	</vuln>

	<vuln vid="0642b064-56c4-11e4-8b87-bcaec565249c">
	<topic>libxml2 -- Denial of service</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.9.2</lt></range>
	</package>
	<package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_2</lt></range>
	</package>
	<package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat reports:</p>
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2014-1655.html">
	<p>A denial of service flaw was found in libxml2, a library
	providing support to read, modify and write XML and HTML
	files. A remote attacker could provide a specially crafted
	XML file that, when processed by an application using
	libxml2, would lead to excessive CPU consumption (denial of
	service) based on excessive entity substitutions, even if
	entity substitution was disabled, which is the parser default
	behavior.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3660</cvename>
	<url>https://rhn.redhat.com/errata/RHSA-2014-1655.html</url>
	</references>
	<dates>
	<discovery>2014-10-16</discovery>
	<entry>2014-10-18</entry>
	<modified>2015-07-15</modified>
	</dates>
	</vuln>

	<vuln vid="6f825fa4-5560-11e4-a4c3-00a0986f28c4">
	<topic>drupal7 -- SQL injection</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.32</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://drupal.org/SA-CORE-2013-003">
	<p>Drupal 7 includes a database abstraction API to ensure that
	queries executed against the database are sanitized to prevent
	SQL injection attacks.
	A vulnerability in this API allows an attacker to send
	specially crafted requests resulting in arbitrary SQL execution.
	Depending on the content of the requests this can lead to
	privilege escalation, arbitrary PHP execution, or other attacks.
	This vulnerability can be exploited by anonymous users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3704</cvename>
	<url>https://www.drupal.org/SA-CORE-2014-005</url>
	<url>https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html</url>
	</references>
	<dates>
	<discovery>2014-10-15</discovery>
	<entry>2014-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="03175e62-5494-11e4-9cc1-bc5ff4fb5e7b">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_16</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1j</lt></range>
	</package>
	<package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.4</ge><lt>8.4_17</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL Project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20141015.txt">
	<p>A flaw in the DTLS SRTP extension parsing code allows an
	attacker, who sends a carefully crafted handshake message,
	to cause OpenSSL to fail to free up to 64k of memory causing
	a memory leak. This could be exploited in a Denial Of Service
	attack. This issue affects OpenSSL 1.0.1 server implementations
	for both SSL/TLS and DTLS regardless of whether SRTP is used
	or configured. Implementations of OpenSSL that have been
	compiled with OPENSSL_NO_SRTP defined are not affected.
	[CVE-2014-3513].</p>
	<p>When an OpenSSL SSL/TLS/DTLS server receives a session
	ticket the integrity of that ticket is first verified.
	In the event of a session ticket integrity check failing,
	OpenSSL will fail to free memory causing a memory leak.
	By sending a large number of invalid session tickets an
	attacker could exploit this issue in a Denial Of Service
	attack. [CVE-2014-3567].</p>
	<p>OpenSSL has added support for TLS_FALLBACK_SCSV to allow
	applications to block the ability for a MITM attacker to
	force a protocol downgrade.</p>
	<p>Some client applications (such as browsers) will reconnect
	using a downgraded protocol to work around interoperability
	bugs in older servers. This could be exploited by an active
	man-in-the-middle to downgrade connections to SSL 3.0 even
	if both sides of the connection support higher protocols.
	SSL 3.0 contains a number of weaknesses including POODLE
	[CVE-2014-3566].</p>
	<p>When OpenSSL is configured with "no-ssl3" as a build option,
	servers could accept and complete a SSL 3.0 handshake, and
	clients could be configured to send them. [CVE-2014-3568].</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-14:23.openssl</freebsdsa>
	<cvename>CVE-2014-3513</cvename>
	<cvename>CVE-2014-3566</cvename>
	<cvename>CVE-2014-3567</cvename>
	<cvename>CVE-2014-3568</cvename>
	<url>https://www.openssl.org/news/secadv_20141015.txt</url>
	</references>
	<dates>
	<discovery>2014-10-15</discovery>
	<entry>2014-10-15</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="9c1495ac-8d8c-4789-a0f3-8ca6b476619c">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>33.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>31.2.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>33.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.30</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.2.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.30</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>31.2.0</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><lt>31.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2014-74 Miscellaneous memory safety hazards
	(rv:33.0 / rv:31.2)</p>
	<p>MFSA 2014-75 Buffer overflow during CSS manipulation</p>
	<p>MFSA 2014-76 Web Audio memory corruption issues with
	custom waveforms</p>
	<p>MFSA 2014-78 Further uninitialized memory use during GIF</p>
	<p>MFSA 2014-79 Use-after-free interacting with text
	directionality</p>
	<p>MFSA 2014-80 Key pinning bypasses</p>
	<p>MFSA 2014-81 Inconsistent video sharing within iframe</p>
	<p>MFSA 2014-82 Accessing cross-origin objects via the
	Alarms API</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1574</cvename>
	<cvename>CVE-2014-1575</cvename>
	<cvename>CVE-2014-1576</cvename>
	<cvename>CVE-2014-1577</cvename>
	<cvename>CVE-2014-1580</cvename>
	<cvename>CVE-2014-1581</cvename>
	<cvename>CVE-2014-1582</cvename>
	<cvename>CVE-2014-1583</cvename>
	<cvename>CVE-2014-1584</cvename>
	<cvename>CVE-2014-1585</cvename>
	<cvename>CVE-2014-1586</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-74.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-75.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-76.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-78.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-79.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-80.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-81.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-82.html</url>
	<url>https://www.mozilla.org/security/announce/</url>
	</references>
	<dates>
	<discovery>2014-10-14</discovery>
	<entry>2014-10-14</entry>
	<modified>2015-08-12</modified>
	</dates>
	</vuln>

	<vuln vid="c30c3a2e-4fb1-11e4-b275-14dae9d210b8">
	<topic>foreman-proxy SSL verification issue</topic>
	<affects>
	<package>
	<name>foreman-proxy</name>
	<range><lt>1.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Foreman Security reports:</p>
	<blockquote cite="http://projects.theforeman.org/issues/7822">
	<p>The smart proxy when running in an SSL-secured mode permits incoming
	API calls to any endpoint without requiring, or performing any
	verification of an SSL client certificate. This permits any client
	with access to the API to make requests and perform actions
	permitting control of Puppet CA, DHCP, DNS etc.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3691</cvename>
	<url>https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U</url>
	</references>
	<dates>
	<discovery>2014-05-09</discovery>
	<entry>2014-10-09</entry>
	</dates>
	</vuln>

	<vuln vid="b6587341-4d88-11e4-aef9-20cf30e32f6d">
	<topic>Bugzilla multiple security issues</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bugzilla Security Advisory</p>
	<blockquote cite="http://www.bugzilla.org/security/4.0.14/">
	<h5>Unauthorized Account Creation</h5>
	<p>An attacker creating a new Bugzilla account can override certain
	parameters when finalizing the account creation that can lead to the
	user being created with a different email address than originally
	requested. The overridden login name could be automatically added
	to groups based on the group's regular expression setting.</p>
	<h5>Cross-Site Scripting</h5>
	<p>During an audit of the Bugzilla code base, several places
	were found where cross-site scripting exploits could occur which
	could allow an attacker to access sensitive information.</p>
	<h5>Information Leak</h5>
	<p>If a new comment was marked private to the insider group, and a flag
	was set in the same transaction, the comment would be visible to
	flag recipients even if they were not in the insider group.</p>
	<h5>Social Engineering</h5>
	<p>Search results can be exported as a CSV file which can then be
	imported into external spreadsheet programs. Specially formatted
	field values can be interpreted as formulas which can be executed
	and used to attack a user's computer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1572</cvename>
	<cvename>CVE-2014-1573</cvename>
	<cvename>CVE-2014-1571</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1074812</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1075578</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1064140</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1054702</url>
	</references>
	<dates>
	<discovery>2014-10-06</discovery>
	<entry>2014-10-06</entry>
	</dates>
	</vuln>

	<vuln vid="81e2b308-4a6c-11e4-b711-6805ca0b3d42">
	<topic>rt42 -- vulnerabilities related to shellshock</topic>
	<affects>
	<package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Best Practical reports:</p>
	<blockquote cite="http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html">
	<p>RT 4.2.0 and above may be vulnerable to arbitrary
	execution of code by way of CVE-2014-7169, CVE-2014-7186,
	CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 --
	collectively known as "Shellshock." This vulnerability
	requires a privileged user with access to an RT instance
	running with SMIME integration enabled; it applies to both
	mod_perl and fastcgi deployments. If you have already
	taken upgrades to bash to resolve "Shellshock," you are
	protected from this vulnerability in RT, and there is no
	need to apply this patch. This vulnerability has been
	assigned CVE-2014-7227.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html</url>
	<cvename>CVE-2014-7227</cvename>
	</references>
	<dates>
	<discovery>2014-10-02</discovery>
	<entry>2014-10-02</entry>
	</dates>
	</vuln>

	<vuln vid="549a2771-49cc-11e4-ae2c-c80aa9043978">
	<topic>jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.583</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>1.565.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01</url>
	<cvename>CVE-2014-3661</cvename>
	<cvename>CVE-2014-3662</cvename>
	<cvename>CVE-2014-3663</cvename>
	<cvename>CVE-2014-3664</cvename>
	<cvename>CVE-2014-3680</cvename>
	<cvename>CVE-2014-3681</cvename>
	<cvename>CVE-2014-3666</cvename>
	<cvename>CVE-2014-3667</cvename>
	<cvename>CVE-2013-2186</cvename>
	<cvename>CVE-2014-1869</cvename>
	<cvename>CVE-2014-3678</cvename>
	<cvename>CVE-2014-3679</cvename>
	</references>
	<dates>
	<discovery>2014-10-01</discovery>
	<entry>2014-10-01</entry>
	</dates>
	</vuln>

	<vuln vid="512d1301-49b9-11e4-ae2c-c80aa9043978">
	<topic>bash -- remote code execution</topic>
	<affects>
	<package>
	<name>bash</name>
	<name>bash-static</name>
	<range><lt>4.3.25_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Note that this is different than the public "Shellshock"
	issue.</p>
	<p>Specially crafted environment variables could lead to remote
	arbitrary code execution. This was fixed in bash 4.3.27, however
	the port was patched with a mitigation in 4.3.25_2.</p>
	</body>
	</description>
	<references>
	<url>http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html</url>
	<cvename>CVE-2014-6277</cvename>
	<cvename>CVE-2014-6278</cvename>
	</references>
	<dates>
	<discovery>2014-09-27</discovery>
	<entry>2014-10-01</entry>
	</dates>
	</vuln>

	<vuln vid="3e8b7f8a-49b0-11e4-b711-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php">
	<p>With a crafted ENUM value it is possible to trigger an
	XSS in table search and table structure pages. This
	vulnerability can be triggered only by someone who is
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php</url>
	<cvename>CVE-2014-7217</cvename>
	</references>
	<dates>
	<discovery>2014-10-01</discovery>
	<entry>2014-10-01</entry>
	</dates>
	</vuln>

	<vuln vid="4a4e9f88-491c-11e4-ae2c-c80aa9043978">
	<topic>bash -- out-of-bounds memory access in parser</topic>
	<affects>
	<package>
	<name>bash</name>
	<name>bash-static</name>
	<range><lt>4.3.27_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat security team reports:</p>
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7186">
	<p>It was discovered that the fixed-sized redir_stack could be forced
	to overflow in the Bash parser, resulting in memory corruption, and
	possibly leading to arbitrary code execution when evaluating
	untrusted input that would not otherwise be run as code.</p>
	</blockquote>
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7187">
	<p>An off-by-one error was discovered in the way Bash was handling
	deeply nested flow control constructs. Depending on the layout of
	the .bss segment, this could allow arbitrary execution of code that
	would not otherwise be executed by Bash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://access.redhat.com/security/cve/CVE-2014-7186</url>
	<cvename>CVE-2014-7186</cvename>
	<cvename>CVE-2014-7187</cvename>
	</references>
	<dates>
	<discovery>2014-09-25</discovery>
	<entry>2014-10-01</entry>
	</dates>
	</vuln>

	<vuln vid="8e0e86ff-48b5-11e4-ab80-000c29f6ae42">
	<topic>rsyslog -- remote syslog PRI vulnerability</topic>
	<affects>
	<package>
	<name>rsyslog</name>
	<range><lt>7.6.7</lt></range>
	</package>
	<package>
	<name>rsyslog8</name>
	<range><lt>8.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The rsyslog project reports:</p>
	<blockquote cite="http://www.rsyslog.com/remote-syslog-pri-vulnerability/">
	<p>potential abort when a message with PRI > 191 was processed
	if the "pri-text" property was used in active templates,
	this could be abused to a remote denial of service from
	permitted senders</p>
	<p>The original fix for CVE-2014-3634 was not adequate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.rsyslog.com/remote-syslog-pri-vulnerability/</url>
	<cvename>CVE-2014-3634</cvename>
	</references>
	<dates>
	<discovery>2014-09-30</discovery>
	<entry>2014-09-30</entry>
	<modified>2014-10-02</modified>
	</dates>
	</vuln>

	<vuln vid="6c083cf8-4830-11e4-ae2c-c80aa9043978">
	<topic>fish -- local privilege escalation and remote code execution</topic>
	<affects>
	<package>
	<name>fish</name>
	<range><ge>1.6.0</ge><lt>2.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fish developer David Adam reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/09/28/8">
	<p>This release fixes a number of local privilege escalation
	vulnerability and one remote code execution vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2014/09/28/8</url>
	<cvename>CVE-2014-2905</cvename>
	<url>https://github.com/fish-shell/fish-shell/issues/1436</url>
	<cvename>CVE-2014-2906</cvename>
	<cvename>CVE-2014-3856</cvename>
	<url>https://github.com/fish-shell/fish-shell/issues/1437</url>
	<cvename>CVE-2014-2914</cvename>
	<url>https://github.com/fish-shell/fish-shell/issues/1438</url>
	<cvename>CVE-2014-3219</cvename>
	<url>https://github.com/fish-shell/fish-shell/issues/1440</url>
	</references>
	<dates>
	<discovery>2014-09-28</discovery>
	<entry>2014-09-29</entry>
	</dates>
	</vuln>

	<vuln vid="ca44b64c-4453-11e4-9ea1-c485083ca99c">
	<topic>Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.400</lt></range>
	</package>
	<package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.400</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-21.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0547</cvename>
	<cvename>CVE-2014-0548</cvename>
	<cvename>CVE-2014-0549</cvename>
	<cvename>CVE-2014-0550</cvename>
	<cvename>CVE-2014-0551</cvename>
	<cvename>CVE-2014-0552</cvename>
	<cvename>CVE-2014-0553</cvename>
	<cvename>CVE-2014-0554</cvename>
	<cvename>CVE-2014-0555</cvename>
	<cvename>CVE-2014-0556</cvename>
	<cvename>CVE-2014-0557</cvename>
	<cvename>CVE-2014-0559</cvename>
	<url>http://helpx.adobe.com/security/products/flash-player/apsb14-21.html</url>
	</references>
	<dates>
	<discovery>2014-09-09</discovery>
	<entry>2014-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="48108fb0-751c-4cbb-8f33-09239ead4b55">
	<topic>NSS -- RSA Signature Forgery</topic>
	<affects>
	<package>
	<name>linux-firefox</name>
	<range><lt>32.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>31.1.2</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.29.1</lt></range>
	</package>
	<package>
	<name>nss</name>
	<range><lt>3.17.1</lt></range>
	</package>
	<package>
	<name>linux-c6-nss</name>
	<range><lt>3.16.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="https://www.mozilla.org/security/announce/2014/mfsa2014-73.html">
	<p>Antoine Delignat-Lavaud discovered that NSS is vulnerable
	to a variant of a signature forgery attack previously
	published by Daniel Bleichenbacher. This is due to lenient
	parsing of ASN.1 values involved in a signature and could
	lead to the forging of RSA certificates.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1568</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-73.html</url>
	</references>
	<dates>
	<discovery>2014-09-23</discovery>
	<entry>2014-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="fb25333d-442f-11e4-98f3-5453ed2e2b49">
	<topic>krfb -- Multiple security issues in bundled libvncserver</topic>
	<affects>
	<package>
	<name>krfb</name>
	<range><lt>4.12.5_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin Sandsmark reports:</p>
	<blockquote cite="http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2">
	<p>krfb 4.14 [and earlier] embeds libvncserver which has had
	several security issues.</p>
	<p>Several remotely exploitable security issues have been
	uncovered in libvncserver, some of which might allow a
	remote authenticated user code execution or application
	crashes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-6055</cvename>
	<mlist>http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2</mlist>
	</references>
	<dates>
	<discovery>2014-09-23</discovery>
	<entry>2014-09-25</entry>
	</dates>
	</vuln>

	<vuln vid="71ad81da-4414-11e4-a33e-3c970e169bc2">
	<topic>bash -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>bash</name>
	<name>bash-static</name>
	<range><gt>3.0</gt><le>3.0.17</le></range>
	<range><gt>3.1</gt><le>3.1.18</le></range>
	<range><gt>3.2</gt><le>3.2.52</le></range>
	<range><gt>4.0</gt><le>4.0.39</le></range>
	<range><gt>4.1</gt><le>4.1.12</le></range>
	<range><gt>4.2</gt><le>4.2.48</le></range>
	<range><gt>4.3</gt><lt>4.3.25_1</lt></range>
	</package>
	<package>
	<name>linux_base-c6</name>
	<range><lt>6.5_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chet Ramey reports:</p>
	<blockquote cite="https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html">
	<p>Under certain circumstances, bash will execute user code
	while processing the environment for exported function
	definitions.</p>
	</blockquote>
	<p>The original fix released for CVE-2014-6271 was not adequate. A
	similar vulnerability was discovered and tagged as CVE-2014-7169.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-6271</cvename>
	<cvename>CVE-2014-7169</cvename>
	<url>https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/</url>
	<url>https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html</url>
	<url>http://seclists.org/oss-sec/2014/q3/690</url>
	</references>
	<dates>
	<discovery>2014-09-24</discovery>
	<entry>2014-09-24</entry>
	<modified>2014-09-25</modified>
	</dates>
	</vuln>

	<vuln vid="e60d9e65-3f6b-11e4-ad16-001999f8d30b">
	<topic>asterisk -- Remotely triggered crash</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.12.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>When an out of call message - delivered by either the
	SIP or PJSIP channel driver or the XMPP stack - is handled
	in Asterisk, a crash can occur if the channel servicing
	the message is sent into the ReceiveFax dialplan application
	while using the res_fax_spandsp module.</p>
	<p>Note that this crash does not occur when using the
	res_fax_digium module. While this crash technically
	occurs due to a configuration issue, as attempting to
	receive a fax from a channel driver that only contains
	textual information will never succeed, the likelihood
	of having it occur is sufficiently high as to warrant
	this advisory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-010.pdf</url>
	<url>https://issues.asterisk.org/jira/browse/ASTERISK-24301</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2014-09-05</discovery>
	<entry>2014-09-18</entry>
	</dates>
	</vuln>

	<vuln vid="d3324c55-3f11-11e4-ad16-001999f8d30b">
	<topic>squid -- Buffer overflow in SNMP processing</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>3.4.8</lt></range>
	</package>
	<package>
	<name>squid32</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>squid33</name>
	<range><lt>3.3.13_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid-cache project reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2014_3.txt">
	<p>Due to incorrect buffer management Squid can be caused
	by an attacker to write outside its allocated SNMP buffer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.squid-cache.org/Advisories/SQUID-2014_3.txt</url>
	<cvename>CVE-2014-6270</cvename>
	</references>
	<dates>
	<discovery>2014-09-15</discovery>
	<entry>2014-09-18</entry>
	</dates>
	</vuln>

	<vuln vid="38242d51-3e58-11e4-ac2f-bcaec565249c">
	<topic>dbus -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dbus</name>
	<range><lt>1.8.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon McVittie reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-September/016343.html">
	<p>Do not accept an extra fd in the padding of a cmsg message,
	which could lead to a 4-byte heap buffer overrun
	(CVE-2014-3635).</p>
	<p>Reduce default for maximum Unix file descriptors passed per
	message from 1024 to 16, preventing a uid with the default
	maximum number of connections from exhausting the system
	bus' file descriptors under Linux's default rlimit
	(CVE-2014-3636).</p>
	<p>Disconnect connections that still have a fd pending
	unmarshalling after a new configurable limit,
	pending_fd_timeout (defaulting to 150 seconds), removing
	the possibility of creating an abusive connection that
	cannot be disconnected by setting up a circular reference
	to a connection's file descriptor (CVE-2014-3637).</p>
	<p>Reduce default for maximum pending replies per connection
	from 8192 to 128, mitigating an algorithmic complexity
	denial-of-service attack (CVE-2014-3638).</p>
	<p>Reduce default for authentication timeout on the system
	bus from 30 seconds to 5 seconds, avoiding denial of service
	by using up all unauthenticated connection slots; and when
	all unauthenticated connection slots are used up, make new
	connection attempts block instead of disconnecting them
	(CVE-2014-3639).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3635</cvename>
	<cvename>CVE-2014-3636</cvename>
	<cvename>CVE-2014-3637</cvename>
	<cvename>CVE-2014-3638</cvename>
	<cvename>CVE-2014-3639</cvename>
	<url>http://lists.freedesktop.org/archives/dbus/2014-September/016343.html</url>
	</references>
	<dates>
	<discovery>2014-09-16</discovery>
	<entry>2014-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="77b784bb-3dc6-11e4-b191-f0def16c5c1b">
	<topic>nginx -- inject commands into SSL session vulnerability</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><ge>0.6.0</ge><lt>1.6.2,2</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><ge>0.5.6</ge><lt>1.7.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html">
	<p>Security: it was possible to reuse SSL sessions in unrelated contexts
	if a shared SSL session cache or the same TLS session ticket key was
	used for multiple "server" blocks (CVE-2014-3616).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3616</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html</url>
	</references>
	<dates>
	<discovery>2014-09-16</discovery>
	<entry>2014-09-16</entry>
	</dates>
	</vuln>

	<vuln vid="cc627e6c-3b89-11e4-b629-6805ca0b3d42">
	<topic>phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php">
	<p>XSRF/CSRF due to DOM based XSS in the micro history feature.</p>
	<p>By deceiving a logged-in user to click on a crafted URL,
	it is possible to perform remote code execution and in some
	cases, create a root account due to a DOM based XSS
	vulnerability in the micro history feature.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php</url>
	<cvename>CVE-2014-6300</cvename>
	</references>
	<dates>
	<discovery>2014-09-13</discovery>
	<entry>2014-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="36858e78-3963-11e4-ad84-000c29f6ae42">
	<topic>security/ossec-hids-* -- root escalation via temp files</topic>
	<affects>
	<package>
	<name>ossec-hids-server</name>
	<name>ossec-hids-client</name>
	<name>ossec-hids-local</name>
	<range><lt>2.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OSSEC reports:</p>
	<blockquote cite="http://www.ossec.net/?p=1135">
	<p>This correction will create the temp file for the hosts deny file
	in /var/ossec and will use mktemp where available to create
	NON-predictable temp file name. In cases where mktemp is not
	available we have written a BAD version of mktemp, but should be a
	little better then just process id.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-5284</cvename>
	<url>http://www.ossec.net/?p=1135</url>
	</references>
	<dates>
	<discovery>2014-09-09</discovery>
	<entry>2014-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="6318b303-3507-11e4-b76c-0011d823eebd">
	<topic>trafficserver -- unspecified vulnerability</topic>
	<affects>
	<package>
	<name>trafficserver</name>
	<range><lt>5.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bryan Call reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E">
	<p>Below is our announcement for the security issue reported to us
	from Yahoo! Japan. All versions of Apache Traffic Server are
	vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1
	immediately.</p>
	<p>This fixes CVE-2014-3525 and limits access to how the health
	checks are performed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3525</cvename>
	<url>http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E</url>
	</references>
	<dates>
	<discovery>2014-07-23</discovery>
	<entry>2014-09-05</entry>
	</dates>
	</vuln>

	<vuln vid="84203724-296b-11e4-bebd-000c2980a9f3">
	<topic>file -- buffer overruns and missing buffer size tests</topic>
	<affects>
	<package>
	<name>file</name>
	<range><lt>5.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Christos Zoulas reports:</p>
	<blockquote cite="http://mx.gw.com/pipermail/file/2014/001553.html">
	<p>A specially crafted file can cause a segmentation fault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mx.gw.com/pipermail/file/2014/001553.html</url>
	</references>
	<dates>
	<discovery>2014-06-09</discovery>
	<entry>2014-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="3c5579f7-294a-11e4-99f6-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py27-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
	</package>
	<package>
	<name>py27-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
	</package>
	<package>
	<name>py27-django14</name>
	<range><ge>1.4</ge><lt>1.4.14</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
	</package>
	<package>
	<name>py32-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
	</package>
	<package>
	<name>py33-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
	</package>
	<package>
	<name>py34-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20140821,1</lt></range>
	</package>
	<package>
	<name>py32-django-devel</name>
	<range><lt>20140821,1</lt></range>
	</package>
	<package>
	<name>py33-django-devel</name>
	<range><lt>20140821,1</lt></range>
	</package>
	<package>
	<name>py34-django-devel</name>
	<range><lt>20140821,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2014/aug/20/security/">
	<p>These releases address an issue with reverse() generating external
	URLs; a denial of service involving file uploads; a potential
	session hijacking issue in the remote-user middleware; and a data
	leak in the administrative interface. We encourage all users of
	Django to upgrade as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2014/aug/20/security/</url>
	<cvename>CVE-2014-0480</cvename>
	<cvename>CVE-2014-0481</cvename>
	<cvename>CVE-2014-0482</cvename>
	<cvename>CVE-2014-0483</cvename>
	</references>
	<dates>
	<discovery>2014-08-20</discovery>
	<entry>2014-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="d2a892b9-2605-11e4-9da0-00a0986f28c4">
	<topic>PHP multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php53</name>
	<range><lt>5.3.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Team reports:</p>
	<blockquote cite="http://php.net/ChangeLog-5.php#5.3.29">
	<p>insecure temporary file use in the configure script</p>
	<p>unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
	</p>
	<p>Heap buffer over-read in DateInterval</p>
	<p>fileinfo: cdf_read_short_sector insufficient boundary check</p>
	<p>fileinfo: CDF infinite loop in nelements DoS</p>
	<p>fileinfo: fileinfo: numerous file_printf calls resulting in
	performance degradation)</p>
	<p>Fix potential segfault in dns_check_record()</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6712</cvename>
	<cvename>CVE-2014-0207</cvename>
	<cvename>CVE-2014-0237</cvename>
	<cvename>CVE-2014-0238</cvename>
	<cvename>CVE-2014-3515</cvename>
	<cvename>CVE-2014-3981</cvename>
	<cvename>CVE-2014-4049</cvename>
	<url>http://php.net/ChangeLog-5.php#5.3.29</url>
	<url>https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html</url>
	</references>
	<dates>
	<discovery>2014-08-14</discovery>
	<entry>2014-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="fbb01289-2645-11e4-bc44-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php">
	<p>Multiple XSS vulnerabilities in browse table, ENUM
	editor, monitor, query charts and table relations pages.</p>
	<p> With a crafted database, table or a primary/unique key
	column name it is possible to trigger an XSS when dropping
	a row from the table. With a crafted column name it is
	possible to trigger an XSS in the ENUM editor dialog. With
	a crafted variable name or a crafted value for unit field
	it is possible to trigger a self-XSS when adding a new
	chart in the monitor page. With a crafted value for x-axis
	label it is possible to trigger a self-XSS in the query
	chart page. With a crafted relation name it is possible to
	trigger an XSS in table relations page.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php">
	<p>XSS in view operations page.</p>
	<p>With a crafted view name it is possible to trigger an
	XSS when dropping the view in view operation page.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php</url>
	<cvename>CVE-2014-5273</cvename>
	<cvename>CVE-2014-5274</cvename>
	</references>
	<dates>
	<discovery>2014-08-17</discovery>
	<entry>2014-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="69048656-2187-11e4-802c-20cf30e32f6d">
	<topic>serf -- SSL Certificate Null Byte Poisoning</topic>
	<affects>
	<package>
	<name>serf</name>
	<range><lt>1.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>serf Development list reports:</p>
	<blockquote cite="https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc">
	<p>Serf provides APIs to retrieve information about a certificate. These
	APIs return the information as NUL terminated strings (commonly called C
	strings). X.509 uses counted length strings which may include a NUL byte.
	This means that a library user will interpret any information as ending
	upon seeing this NUL byte and will only see a partial value for that field.
	</p>
	<p>Attackers could exploit this vulnerability to create a certificate that a
	client will accept for a different hostname than the full certificate is
	actually for by embedding a NUL byte in the certificate.</p>
	<p>This can lead to a man-in-the-middle attack. There are no known instances
	of this problem being exploited in the wild and in practice it should be
	difficult to actually exploit this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3504</cvename>
	</references>
	<dates>
	<discovery>2014-08-06</discovery>
	<entry>2014-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="83a418cc-2182-11e4-802c-20cf30e32f6d">
	<topic>subversion -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion16</name>
	<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
	</package>
	<package>
	<name>subversion17</name>
	<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
	</package>
	<package>
	<name>subversion</name>
	<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2014-3522-advisory.txt">
	<p>Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API
	to handle matching wildcards in certificate Common Names and Subject
	Alternate Names. However, apr_fnmatch is not designed for this purpose.
	Instead it is designed to behave like common shell globbing. In particular
	this means that '*' is not limited to a single label within a hostname
	(i.e. it will match '.'). But even further apr_fnmatch supports '?' and
	character classes (neither of which are part of the RFCs defining how
	certificate validation works).</p>
	<p>Subversion stores cached credentials by an MD5 hash based on the URL and
	the authentication realm of the server the credentials are cached for.
	MD5 has been shown to be subject to chosen plaintext hash collisions.
	This means it may be possible to generate an authentication realm which
	results in the same MD5 hash for a different URL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3522</cvename>
	<cvename>CVE-2014-3528</cvename>
	<url>http://subversion.apache.org/security/CVE-2014-3522-advisory.txt</url>
	<url>http://subversion.apache.org/security/CVE-2014-3528-advisory.txt</url>
	</references>
	<dates>
	<discovery>2014-08-06</discovery>
	<entry>2014-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="ad747a01-1fee-11e4-8ff1-f0def16c5c1b">
	<topic>nginx -- inject commands into SSL session vulnerability</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><ge>1.6.0,2</ge><lt>1.6.1,2</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><ge>1.5.6</ge><lt>1.7.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html">
	<p>Security: pipelined commands were not discarded after STARTTLS
	command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3556</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html</url>
	</references>
	<dates>
	<discovery>2014-08-05</discovery>
	<entry>2014-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="8aff07eb-1dbd-11e4-b6ba-3c970e169bc2">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_14</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1i</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.4</ge><lt>8.4_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_18</lt></range>
	<range><ge>9.2</ge><lt>9.2_11</lt></range>
	<range><ge>9.3</ge><lt>9.3_1</lt></range>
	<range><ge>10.0</ge><lt>10.0_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL Project reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20140806.txt">
	<p>A flaw in OBJ_obj2txt may cause pretty printing functions
	such as X509_name_oneline, X509_name_print_ex et al. to leak
	some information from the stack. [CVE-2014-3508]</p>
	<p>The issue affects OpenSSL clients and allows a malicious
	server to crash the client with a null pointer dereference
	(read) by specifying an SRP ciphersuite even though it was
	not properly negotiated with the client. [CVE-2014-5139]</p>
	<p>If a multithreaded client connects to a malicious server
	using a resumed session and the server sends an ec point
	format extension it could write up to 255 bytes to freed
	memory. [CVE-2014-3509]</p>
	<p>An attacker can force an error condition which causes
	openssl to crash whilst processing DTLS packets due to
	memory being freed twice. This can be exploited through
	a Denial of Service attack. [CVE-2014-3505]</p>
	<p>An attacker can force openssl to consume large amounts
	of memory whilst processing DTLS handshake messages.
	This can be exploited through a Denial of Service
	attack. [CVE-2014-3506]</p>
	<p>By sending carefully crafted DTLS packets an attacker
	could cause openssl to leak memory. This can be exploited
	through a Denial of Service attack. [CVE-2014-3507]</p>
	<p>OpenSSL DTLS clients enabling anonymous (EC)DH
	ciphersuites are subject to a denial of service attack.
	A malicious server can crash the client with a null pointer
	dereference (read) by specifying an anonymous (EC)DH
	ciphersuite and sending carefully crafted handshake
	messages. [CVE-2014-3510]</p>
	<p>A flaw in the OpenSSL SSL/TLS server code causes the
	server to negotiate TLS 1.0 instead of higher protocol
	versions when the ClientHello message is badly
	fragmented. This allows a man-in-the-middle attacker
	to force a downgrade to TLS 1.0 even if both the server
	and the client support a higher protocol version, by
	modifying the client's TLS records. [CVE-2014-3511]</p>
	<p>A malicious client or server can send invalid SRP
	parameters and overrun an internal buffer. Only
	applications which are explicitly set up for SRP
	use are affected. [CVE-2014-3512]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.openssl.org/news/secadv_20140806.txt</url>
	<freebsdsa>SA-14:18.openssl</freebsdsa>
	<cvename>CVE-2014-3505</cvename>
	<cvename>CVE-2014-3506</cvename>
	<cvename>CVE-2014-3507</cvename>
	<cvename>CVE-2014-3508</cvename>
	<cvename>CVE-2014-3509</cvename>
	<cvename>CVE-2014-3510</cvename>
	<cvename>CVE-2014-3511</cvename>
	<cvename>CVE-2014-3512</cvename>
	<cvename>CVE-2014-5139</cvename>
	</references>
	<dates>
	<discovery>2014-08-06</discovery>
	<entry>2014-08-06</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="be5421ab-1b56-11e4-a767-5453ed2e2b49">
	<topic>krfb -- Possible Denial of Service or code execution via integer overflow</topic>
	<affects>
	<package>
	<name>krfb</name>
	<range><lt>4.12.5_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Aastals Cid reports:</p>
	<blockquote cite="http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2">
	<p>krfb embeds libvncserver which embeds liblzo2, it contains various
	flaws that result in integer overflow problems.</p>
	<p>This potentially allows a malicious application to create a
	possible denial of service or code execution. Due to the need to
	exploit precise details of the target architecture and threading it
	is unlikely that remote code execution can be achieved in
	practice.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4607</cvename>
	<mlist>http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2</mlist>
	</references>
	<dates>
	<discovery>2014-08-03</discovery>
	<entry>2014-08-03</entry>
	</dates>
	</vuln>

	<vuln vid="89ff45e3-1a57-11e4-bebd-000c2980a9f3">
	<topic>samba -- remote code execution</topic>
	<affects>
	<package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><lt>4.0.21</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba developers report:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2014-3560">
	<p>A malicious browser can send packets that may overwrite the heap of
	the target nmbd NetBIOS name services daemon. It may be possible to
	use this to generate a remote code execution vulnerability as the
	superuser (root).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3560</cvename>
	<url>http://www.samba.org/samba/security/CVE-2014-3560</url>
	</references>
	<dates>
	<discovery>2014-07-31</discovery>
	<entry>2014-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="90ca3ba5-19e6-11e4-8616-001b3856973b">
	<topic>gpgme -- heap-based buffer overflow in gpgsm status handler</topic>
	<affects>
	<package>
	<name>gpgme</name>
	<range><lt>1.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tomas Trnka reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1113267">
	<p>Gpgme contains a buffer overflow in the gpgsm status handler
	that could possibly be exploited using a specially crafted certificate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3564</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1113267</url>
	</references>
	<dates>
	<discovery>2014-06-25</discovery>
	<entry>2014-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="2f90556f-18c6-11e4-9cc4-5453ed2e2b49">
	<topic>kdelibs -- KAuth PID Reuse Flaw</topic>
	<affects>
	<package>
	<name>kdelibs</name>
	<range><lt>4.12.5_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin Sandsmark reports:</p>
	<blockquote cite="http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2">
	<p>The KAuth framework uses polkit-1 API which tries to authenticate
	using the requestors PID. This is prone to PID reuse race
	conditions.</p>
	<p>This potentially allows a malicious application to pose as another
	for authentication purposes when executing privileged actions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-5033</cvename>
	<mlist>http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2</mlist>
	</references>
	<dates>
	<discovery>2014-07-30</discovery>
	<entry>2014-07-31</entry>
	</dates>
	</vuln>

	<vuln vid="31c09848-1829-11e4-bf04-60a44c524f57">
	<topic>tor -- traffic confirmation attack</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.2.4.23</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.5.6.a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Project reports:</p>
	<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html">
	<p>Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a
	circuit after an inbound RELAY_EARLY cell is received by a client,
	which makes it easier for remote attackers to conduct
	traffic-confirmation attacks by using the pattern of RELAY and
	RELAY_EARLY cells as a means of communicating information about
	hidden service names.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html</url>
	<url>https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack</url>
	<cvename>CVE-2014-5117</cvename>
	</references>
	<dates>
	<discovery>2014-07-30</discovery>
	<entry>2014-07-30</entry>
	</dates>
	</vuln>

	<vuln vid="13419364-1685-11e4-bf04-60a44c524f57">
	<topic>i2p -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>i2p</name>
	<range><lt>0.9.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The i2p project reports:</p>
	<blockquote cite="http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release">
	<p>XSS and remote execution vulnerabilities reported by Exodus Intelligence.</p>
	</blockquote>
	<p>Exodus Intelligence reports:</p>
	<blockquote cite="http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/">
	<p>The vulnerability we have found is able to perform remote code
	execution with a specially crafted payload. This payload can be
	customized to unmask a user and show the public IP address in
	which the user connected from within 'a couple of seconds.'</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/</url>
	<url>http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release</url>
	</references>
	<dates>
	<discovery>2014-07-24</discovery>
	<entry>2014-07-28</entry>
	</dates>
	</vuln>

	<vuln vid="9defb2d6-1404-11e4-8cae-20cf30e32f6d">
	<topic>bugzilla -- Cross Site Request Forgery</topic>
	<affects>
	<package>
	<name>bugzilla44</name>
	<range><lt>4.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.13/">
	<p>Adobe does not properly restrict the SWF file format,
	which allows remote attackers to conduct cross-site
	request forgery (CSRF) attacks against Bugzilla's JSONP
	endpoint, possibly obtaining sensitive bug information,
	via a crafted OBJECT element with SWF content satisfying
	the character-set requirements of a callback API.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1546</cvename>
	</references>
	<dates>
	<discovery>2014-07-24</discovery>
	<entry>2014-07-25</entry>
	</dates>
	</vuln>

	<vuln vid="f927e06c-1109-11e4-b090-20cf30e32f6d">
	<topic>apache22 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
	</package>
	<package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
	</package>
	<package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
	</package>
	<package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
	</package>
	<package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache HTTP SERVER PROJECT reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.29">
	<p> mod_deflate: The DEFLATE input filter (inflates request bodies) now
	limits the length and compression ratio of inflated request bodies to
	avoid denial of service via highly compressed bodies. See directives
	DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and
	DeflateInflateRatioBurst.</p>
	<p>mod_cgid: Fix a denial of service against CGI scripts that do not consume
	stdin that could lead to lingering HTTPD child processes filling up the
	scoreboard and eventually hanging the server. By default, the client I/O
	timeout (Timeout directive) now applies to communication with scripts. The
	CGIDScriptTimeout directive can be used to set a different timeout for
	communication with scripts.</p>
	<p>Fix a race condition in scoreboard handling, which could lead to a heap
	buffer overflow.</p>
	<p>core: HTTP trailers could be used to replace HTTP headers late during
	request processing, potentially undoing or otherwise confusing modules
	that examined or modified request headers earlier. Adds "MergeTrailers"
	directive to restore legacy behavior.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0118</cvename>
	<cvename>CVE-2014-0231</cvename>
	<cvename>CVE-2014-0226</cvename>
	<cvename>CVE-2013-5704</cvename>
	</references>
	<dates>
	<discovery>2014-07-19</discovery>
	<entry>2014-07-24</entry>
	<modified>2014-09-03</modified>
	</dates>
	</vuln>

	<vuln vid="81fc1076-1286-11e4-bebd-000c2980a9f3">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><lt>6.0.40</lt></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><lt>7.0.53</lt></range>
	</package>
	<package>
	<name>tomcat8</name>
	<range><lt>8.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tomcat Security Team reports:</p>
	<blockquote cite="https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.54">
	<p>Tomcat does not properly restrict XSLT stylesheets, which allows
	remote attackers to bypass security-manager restrictions and read
	arbitrary files via a crafted web application that provides an XML
	external entity declaration in conjunction with an entity
	reference, related to an XML External Entity (XXE) issue.</p>
	<p>An integer overflow, when operated behind a reverse proxy, allows
	remote attackers to conduct HTTP request smuggling attacks via a
	crafted Content-Length HTTP header.</p>
	<p>An integer overflow in parseChunkHeader allows remote attackers
	to cause a denial of service (resource consumption) via a malformed
	chunk size in chunked transfer coding of a request during the
	streaming of data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0096</cvename>
	<cvename>CVE-2014-0099</cvename>
	<cvename>CVE-2014-0075</cvename>
	<url>https://tomcat.apache.org/security-6.html</url>
	<url>https://tomcat.apache.org/security-7.html</url>
	<url>https://tomcat.apache.org/security-8.html</url>
	</references>
	<dates>
	<discovery>2014-05-23</discovery>
	<entry>2014-07-23</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="978b0f76-122d-11e4-afe3-bc5ff4fb5e7b">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>31.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>24.7.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>31.0,1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.7.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.7.0</lt></range>
	</package>
	<package>
	<name>nss</name>
	<range><lt>3.16.1_2</lt></range>
	<!-- CVE-2014-1544/Bug 963150 -->
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2014-66 IFRAME sandbox same-origin access through
	redirect</p>
	<p>MFSA 2014-65 Certificate parsing broken by non-standard
	character encoding</p>
	<p>MFSA 2014-64 Crash in Skia library when scaling high
	quality images</p>
	<p>MFSA 2014-63 Use-after-free while when manipulating
	certificates in the trusted cache</p>
	<p>MFSA 2014-62 Exploitable WebGL crash with Cesium
	JavaScript library</p>
	<p>MFSA 2014-61 Use-after-free with FireOnStateChange
	event</p>
	<p>MFSA 2014-60 Toolbar dialog customization event
	spoofing</p>
	<p>MFSA 2014-59 Use-after-free in DirectWrite font
	handling</p>
	<p>MFSA 2014-58 Use-after-free in Web Audio due to
	incorrect control message ordering</p>
	<p>MFSA 2014-57 Buffer overflow during Web Audio
	buffering for playback</p>
	<p>MFSA 2014-56 Miscellaneous memory safety hazards
	(rv:31.0 / rv:24.7)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1544</cvename>
	<cvename>CVE-2014-1547</cvename>
	<cvename>CVE-2014-1548</cvename>
	<cvename>CVE-2014-1549</cvename>
	<cvename>CVE-2014-1550</cvename>
	<cvename>CVE-2014-1551</cvename>
	<cvename>CVE-2014-1552</cvename>
	<cvename>CVE-2014-1555</cvename>
	<cvename>CVE-2014-1556</cvename>
	<cvename>CVE-2014-1557</cvename>
	<cvename>CVE-2014-1558</cvename>
	<cvename>CVE-2014-1559</cvename>
	<cvename>CVE-2014-1560</cvename>
	<cvename>CVE-2014-1561</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-56.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-57.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-58.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-59.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-60.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-61.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-62.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-63.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-64.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-65.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-66.html</url>
	<url>https://www.mozilla.org/security/announce/</url>
	</references>
	<dates>
	<discovery>2014-07-22</discovery>
	<entry>2014-07-23</entry>
	</dates>
	</vuln>

	<vuln vid="ecea9e92-0be5-4931-88da-8772d044972a">
	<topic>mcollective -- cert valication issue</topic>
	<affects>
	<package>
	<name>mcollective</name>
	<range><lt>2.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Melissa Stone reports:</p>
	<blockquote cite="https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4">
	<p>The MCollective aes_security public key plugin does not correctly
	validate certs against the CA. By exploiting this vulnerability
	within a race/initialization window, an attacker with local access
	could initiate an unauthorized MCollective client connection with a
	server, and thus control the mcollective plugins running on that
	server. This vulnerability requires a collective be configured to
	use the aes_security plugin. Puppet Enterprise and open source
	MCollective are not configured to use the plugin and are not
	vulnerable by default.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3251</cvename>
	<url>https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4</url>
	</references>
	<dates>
	<discovery>2014-07-09</discovery>
	<entry>2014-07-21</entry>
	</dates>
	</vuln>

	<vuln vid="904d78b8-0f7e-11e4-8b71-5453ed2e2b49">
	<topic>qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler</topic>
	<affects>
	<package>
	<name>qt4-imageformats</name>
	<range><lt>4.8.6_1</lt></range>
	</package>
	<package>
	<name>qt5-gui</name>
	<range><lt>5.2.1_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Richard J. Moore reports:</p>
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2014-April/000045.html">
	<p>The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug
	that would lead to a null pointer dereference when loading certain
	hand crafted corrupt GIF files. This in turn would cause the
	application loading these hand crafted GIFs to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0190</cvename>
	<bid>67087</bid>
	<mlist>http://lists.qt-project.org/pipermail/announce/2014-April/000045.html</mlist>
	</references>
	<dates>
	<discovery>2014-04-24</discovery>
	<entry>2014-07-19</entry>
	<modified>2014-07-21</modified>
	</dates>
	</vuln>

	<vuln vid="4364e1f1-0f44-11e4-b090-20cf30e32f6d">
	<topic>apache24 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup&pathrev=1610737">
	<p>mod_proxy: Fix crash in Connection header handling which allowed a
	denial of service attack against a reverse proxy with a threaded MPM.</p>
	<p>Fix a race condition in scoreboard handling, which could lead to a
	heap buffer overflow.</p>
	<p>mod_deflate: The DEFLATE input filter (inflates request bodies) now
	limits the length and compression ratio of inflated request bodies to avoid
	denial of sevice via highly compressed bodies. See directives
	DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
	and DeflateInflateRatioBurst.</p>
	<p>mod_cgid: Fix a denial of service against CGI scripts that do
	not consume stdin that could lead to lingering HTTPD child processes
	filling up the scoreboard and eventually hanging the server. By
	default, the client I/O timeout (Timeout directive) now applies to
	communication with scripts. The CGIDScriptTimeout directive can be
	used to set a different timeout for communication with scripts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0117</cvename>
	<cvename>CVE-2014-3523</cvename>
	<cvename>CVE-2014-0226</cvename>
	<cvename>CVE-2014-0118</cvename>
	<cvename>CVE-2014-0231</cvename>
	</references>
	<dates>
	<discovery>2014-07-15</discovery>
	<entry>2014-07-19</entry>
	</dates>
	</vuln>

	<vuln vid="3f09ca29-0e48-11e4-b17a-6805ca0b3d42">
	<topic>phpMyAdmin -- multiple XSS vulnerabilities, missing validation</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php">
	<p>Self-XSS due to unescaped HTML output in database
	structure page.</p>
	<p>With a crafted table comment, it is possible to trigger
	an XSS in database structure page.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php">
	<p>Self-XSS due to unescaped HTML output in database
	triggers page.</p>
	<p>When navigating into the database triggers page, it is
	possible to trigger an XSS with a crafted trigger
	name.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php">
	<p>Multiple XSS in AJAX confirmation messages.</p>
	<p>With a crafted column name it is possible to trigger an
	XSS when dropping the column in table structure page. With
	a crafted table name it is possible to trigger an XSS when
	dropping or truncating the table in table operations
	page.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php">
	<p>Access for an unprivileged user to MySQL user list.</p>
	<p>An unpriviledged user could view the MySQL user list and
	manipulate the tabs displayed in phpMyAdmin for them.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4954</cvename>
	<cvename>CVE-2014-4955</cvename>
	<cvename>CVE-2014-4986</cvename>
	<cvename>CVE-2014-4987</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php</url>
	</references>
	<dates>
	<discovery>2014-07-18</discovery>
	<entry>2014-07-18</entry>
	<modified>2014-07-20</modified>
	</dates>
	</vuln>

	<vuln vid="4a114331-0d24-11e4-8dd2-5453ed2e2b49">
	<topic>kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw</topic>
	<affects>
	<package>
	<name>kdelibs</name>
	<range><ge>4.10.95</ge><lt>4.12.5_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Richard J. Moore reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20140618-1.txt">
	<p>The POP3 kioslave used by KMail will accept invalid
	certificates without presenting a dialog to the user due a
	bug that leads to an inability to display the dialog
	combined with an error in the way the result is checked.</p>
	<p>This flaw allows an active attacker to perform MITM
	attacks against the ioslave which could result in the leakage of
	sensitive data such as the authentication details and the contents of
	emails.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3494</cvename>
	<bid>68113</bid>
	<mlist>http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2</mlist>
	</references>
	<dates>
	<discovery>2014-06-17</discovery>
	<entry>2014-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="ff98087f-0a8f-11e4-b00b-5453ed2e2b49">
	<topic>postfixadmin -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>postfixadmin</name>
	<range><lt>2.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thijs Kinkhorst reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/26/6">
	<p>Postfixadmin has an SQL injection vulnerability. This
	vulnerability is only exploitable by authenticated users able to
	create new aliases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2655</cvename>
	<bid>66455</bid>
	<freebsdpr>ports/189248</freebsdpr>
	<mlist>http://www.openwall.com/lists/oss-security/2014/03/26/6</mlist>
	<url>https://www.debian.org/security/2014/dsa-2889</url>
	</references>
	<dates>
	<discovery>2014-03-28</discovery>
	<entry>2014-07-13</entry>
	<modified>2015-09-28</modified>
	</dates>
	</vuln>

	<vuln vid="e6a7636a-02d0-11e4-88b6-080027671656">
	<topic>dbus -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dbus</name>
	<range><lt>1.8.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon McVittie reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-July/016235.html">
	<p>Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's
	support for file descriptor passing. A malicious process could
	force system services or user applications to be disconnected
	from the D-Bus system bus by sending them a message containing
	a file descriptor, then causing that file descriptor to exceed
	the kernel's maximum recursion depth (itself introduced to fix
	a DoS) before dbus-daemon forwards the message to the victim
	process. Most services and applications exit when disconnected
	from the system bus, leading to a denial of service.</p>
	<p>Additionally, Alban discovered that bug fd.o#79694, a bug
	previously reported by Alejandro Martínez Suárez which was n
	believed to be security flaw, could be used for a similar denial
	of service, by causing dbus-daemon to attempt to forward invalid
	file descriptors to a victim process when file descriptors become
	associated with the wrong message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3532</cvename>
	<cvename>CVE-2014-3533</cvename>
	<url>http://lists.freedesktop.org/archives/dbus/2014-July/016235.html</url>
	</references>
	<dates>
	<discovery>2014-07-02</discovery>
	<entry>2014-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="17dfd984-feba-11e3-b938-5404a68ad561">
	<topic>mencoder -- potential buffer overrun when processing malicious lzo compressed input</topic>
	<affects>
	<package>
	<name>mencoder</name>
	<range><lt>1.1.r20140418_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Niedermayer and Luca Barbato report in upstream ffmpeg:</p>
	<blockquote>
	<p>avutil/lzo: Fix integer overflow</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
	<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
	<cvename>CVE-2014-4610</cvename>
	</references>
	<dates>
	<discovery>2014-06-24</discovery>
	<entry>2014-06-28</entry>
	</dates>
	</vuln>

	<vuln vid="9ab3a22c-feb8-11e3-b938-5404a68ad561">
	<topic>mplayer -- potential buffer overrun when processing malicious lzo compressed input</topic>
	<affects>
	<package>
	<name>mplayer</name>
	<range><lt>1.1.r20140418_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Niedermayer and Luca Barbato report in upstream ffmpeg:</p>
	<blockquote>
	<p>avutil/lzo: Fix integer overflow</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
	<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
	<cvename>CVE-2014-4610</cvename>
	</references>
	<dates>
	<discovery>2014-06-24</discovery>
	<entry>2014-06-28</entry>
	</dates>
	</vuln>

	<vuln vid="d1f5e12a-fd5a-11e3-a108-080027ef73ec">
	<topic>LZO -- potential buffer overrun when processing malicious input data</topic>
	<affects>
	<package>
	<name>lzo2</name>
	<range><lt>2.07</lt></range>
	</package>
	<package>
	<name>busybox</name>
	<range><lt>1.22.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:</p>
	<blockquote>
	<p>Fixed a potential integer overflow condition in the "safe"
	decompressor variants which could result in a possible buffer
	overrun when processing maliciously crafted compressed input
	data.</p>

	<p>As this issue only affects 32-bit systems and also can only happen
	if you use uncommonly huge buffer sizes where you have to decompress
	more than 16 MiB (2^24 bytes) compressed bytes within a single
	function call, the practical implications are limited.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz</url>
	<cvename>CVE-2014-4608</cvename>
	</references>
	<dates>
	<discovery>2014-06-25</discovery>
	<entry>2014-06-26</entry>
	<modified>2015-01-06</modified>
	</dates>
	</vuln>

	<vuln vid="1c840eb9-fb32-11e3-866e-b499baab0cbe">
	<topic>gnupg -- possible DoS using garbled compressed data packets</topic>
	<affects>
	<package>
	<name>gnupg1</name>
	<range><lt>1.4.17</lt></range>
	</package>
	<package>
	<name>gnupg</name>
	<range><lt>2.0.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html">
	<p>This release includes a security fix to stop
	a possible DoS using garbled compressed data packets which can be used
	to put gpg into an infinite loop.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html</url>
	<url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html</url>
	</references>
	<dates>
	<discovery>2014-06-23</discovery>
	<entry>2014-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="6ad309d9-fb03-11e3-bebd-000c2980a9f3">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba36</name>
	<range><lt>3.6.24</lt></range>
	</package>
	<package>
	<name>samba4</name>
	<range><lt>4.0.19</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><lt>4.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The samba project reports:</p>
	<blockquote cite="https://www.samba.org/samba/history/">
	<p>A malformed packet can cause the nmbd server to loop the CPU and
	prevent any further NetBIOS name service.</p>
	<p>Valid unicode path names stored on disk can cause smbd to
	crash if an authenticated client attempts to read them
	using a non-unicode request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0244</cvename>
	<cvename>CVE-2014-3493</cvename>
	<url>https://www.samba.org/samba/security/CVE-2014-0244</url>
	<url>https://www.samba.org/samba/security/CVE-2014-3493</url>
	</references>
	<dates>
	<discovery>2014-06-23</discovery>
	<entry>2014-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="c4892644-f8c6-11e3-9f45-6805ca0b3d42">
	<topic>phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.1.0</ge><lt>4.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php">
	<p>Self-XSS due to unescaped HTML output in recent/favorite
	tables navigation.</p>

	<p>When marking a crafted database or table name as
	favorite or having it in recent tables, it is possible to
	trigger an XSS.</p>


	<p>This vulnerability can be triggered only by someone who
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	form.</p>

	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php">
	<p>Self-XSS due to unescaped HTML output in navigation items
	hiding feature.</p>

	<p>When hiding or unhiding a crafted table name in the
	navigation, it is possible to trigger an XSS.</p>

	<p>This vulnerability can be triggered only by someone who
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	form.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4348</cvename>
	<cvename>CVE-2014-4349</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php</url>
	</references>
	<dates>
	<discovery>2014-06-20</discovery>
	<entry>2014-06-20</entry>
	<modified>2014-06-24</modified>
	</dates>
	</vuln>

	<vuln vid="0981958a-f733-11e3-8276-071f1604ef8a">
	<topic>iodined -- authentication bypass</topic>
	<affects>
	<package>
	<name>iodine</name>
	<range><lt>0.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Erik Ekman of the iodine project reports:</p>
	<blockquote cite="https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850">
	<p>The client could bypass the password check by continuing after
	getting error from the server and guessing the network parameters.
	The server would still accept the rest of the setup and also network
	traffic.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850</url>
	</references>
	<dates>
	<discovery>2014-06-16</discovery>
	<entry>2014-06-18</entry>
	</dates>
	</vuln>

	<vuln vid="f109b02f-f5a4-11e3-82e9-00a098b18457">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.10.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><lt>1.8.28.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Asterisk Manager User Unauthorized Shell Access. Manager users can
	execute arbitrary shell commands with the MixMonitor manager action.
	Asterisk does not require system class authorization for a manager
	user to use the MixMonitor action, so any manager user who is
	permitted to use manager commands can potentially execute shell
	commands as the user executing the Asterisk process.</p>
	<p>Exhaustion of Allowed Concurrent HTTP Connections. Establishing a
	TCP or TLS connection to the configured HTTP or HTTPS port
	respectively in http.conf and then not sending or completing a HTTP
	request will tie up a HTTP session. By doing this repeatedly until the
	maximum number of open HTTP sessions is reached, legitimate requests
	are blocked.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-4046</cvename>
	<cvename>CVE-2014-4047</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-006.pdf</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-007.pdf</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2014-06-12</discovery>
	<entry>2014-06-17</entry>
	</dates>
	</vuln>

	<vuln vid="52bbc7e8-f13c-11e3-bc09-bcaec565249c">
	<topic>dbus -- local DoS</topic>
	<affects>
	<package>
	<name>dbus</name>
	<range><ge>1.8.0</ge><lt>1.8.4</lt></range>
	<range><lt>1.6.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon MvVittie reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-June/016220.html">
	<p>Alban Crequy at Collabora Ltd. discovered and fixed a
	denial-of-service flaw in dbus-daemon, part of the reference
	implementation of D-Bus. Additionally, in highly unusual
	environments the same flaw could lead to a side channel between
	processes that should not be able to communicate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3477</cvename>
	<url>http://lists.freedesktop.org/archives/dbus/2014-June/016220.html</url>
	</references>
	<dates>
	<discovery>2014-06-10</discovery>
	<entry>2014-06-14</entry>
	</dates>
	</vuln>

	<vuln vid="888a0262-f0d9-11e3-ba0c-b4b52fce4ce8">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>30.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>24.6.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.26.1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>30.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.26.1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.6.0</lt></range>
	</package>
	<package>
	<name>nspr</name>
	<range><lt>4.10.6</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2014-48 Miscellaneous memory safety hazards
	(rv:30.0 / rv:24.6)</p>
	<p>MFSA 2014-49 Use-after-free and out of bounds
	issues found using Address Sanitizer</p>
	<p>MFSA 2014-51 Use-after-free in Event Listener
	Manager</p>
	<p>MFSA 2014-52 Use-after-free with SMIL Animation
	Controller</p>
	<p>MFSA 2014-53 Buffer overflow in Web Audio Speex
	resampler</p>
	<p>MFSA 2014-54 Buffer overflow in Gamepad API</p>
	<p>MFSA 2014-55 Out of bounds write in NSPR</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1533</cvename>
	<cvename>CVE-2014-1534</cvename>
	<cvename>CVE-2014-1536</cvename>
	<cvename>CVE-2014-1537</cvename>
	<cvename>CVE-2014-1540</cvename>
	<cvename>CVE-2014-1541</cvename>
	<cvename>CVE-2014-1542</cvename>
	<cvename>CVE-2014-1543</cvename>
	<cvename>CVE-2014-1545</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-48.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-49.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-51.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-52.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-53.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-54.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-55.html</url>
	</references>
	<dates>
	<discovery>2014-06-10</discovery>
	<entry>2014-06-10</entry>
	</dates>
	</vuln>

	<vuln vid="5ac53801-ec2e-11e3-9cf3-3c970e169bc2">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_13</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1h</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.0</ge><lt>8.4_12</lt></range>
	<range><ge>9.1</ge><lt>9.1_15</lt></range>
	<range><ge>9.2</ge><lt>9.2_8</lt></range>
	<range><ge>10.0</ge><lt>10.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL Project reports:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20140605.txt">
	<p>An attacker using a carefully crafted handshake can force
	the use of weak keying material in OpenSSL SSL/TLS clients
	and servers. This can be exploited by a Man-in-the-middle
	(MITM) attack where the attacker can decrypt and modify
	traffic from the attacked client and server. [CVE-2014-0224]</p>
	<p>By sending an invalid DTLS handshake to an OpenSSL DTLS
	client the code can be made to recurse eventually crashing
	in a DoS attack. [CVE-2014-0221]</p>
	<p>A buffer overrun attack can be triggered by sending invalid
	DTLS fragments to an OpenSSL DTLS client or server. This is
	potentially exploitable to run arbitrary code on a vulnerable
	client or server. [CVE-2014-0195]</p>
	<p>OpenSSL TLS clients enabling anonymous ECDH ciphersuites are
	subject to a denial of service attack. [CVE-2014-3470]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0195</cvename>
	<cvename>CVE-2014-0221</cvename>
	<cvename>CVE-2014-0224</cvename>
	<cvename>CVE-2014-3470</cvename>
	<freebsdsa>SA-14:14.openssl</freebsdsa>
	<url>http://www.openssl.org/news/secadv_20140605.txt</url>
	</references>
	<dates>
	<discovery>2014-06-05</discovery>
	<entry>2014-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="9733c480-ebff-11e3-970b-206a8a720317">
	<topic>gnutls -- client-side memory corruption</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.12.23_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuTLS project reports:</p>
	<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
	<p>This vulnerability affects the client side of the gnutls library.
	A server that sends a specially crafted ServerHello could corrupt
	the memory of a requesting client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3466</cvename>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
	</references>
	<dates>
	<discovery>2014-05-14</discovery>
	<entry>2014-06-04</entry>
	</dates>
	</vuln>

	<vuln vid="027af74d-eb56-11e3-9032-000c2980a9f3">
	<topic>gnutls -- client-side memory corruption</topic>
	<affects>
	<package>
	<name>gnutls3</name>
	<range><ge>3.1</ge><lt>3.1.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuTLS project reports:</p>
	<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
	<p>This vulnerability affects the client side of the gnutls library.
	A server that sends a specially crafted ServerHello could corrupt
	the memory of a requesting client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-3466</cvename>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
	</references>
	<dates>
	<discovery>2014-05-14</discovery>
	<entry>2014-06-03</entry>
	</dates>
	</vuln>

	<vuln vid="77e2e631-e742-11e3-9a25-5404a6a6412c">
	<topic>mumble -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mumble</name>
	<range><ge>1.2.0</ge><lt>1.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mumble reports:</p>
	<blockquote cite="http://blog.mumble.info/mumble-1-2-6/">
	<p>SVG images with local file references could trigger client DoS</p>
	<p>The Mumble client did not properly HTML-escape some external strings
	before using them in a rich-text (HTML) context.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mumble.info/security/Mumble-SA-2014-005.txt</url>
	<url>http://mumble.info/security/Mumble-SA-2014-006.txt</url>
	</references>
	<dates>
	<discovery>2014-04-16</discovery>
	<entry>2014-05-29</entry>
	</dates>
	</vuln>

	<vuln vid="c2c8c84b-e734-11e3-9a25-5404a6a6412c">
	<topic>mumble -- NULL pointer dereference and heap-based buffer overflow</topic>
	<affects>
	<package>
	<name>mumble</name>
	<range><ge>1.2.4</ge><le>1.2.4_6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mumble reports:</p>
	<blockquote cite="http://blog.mumble.info/mumble-1-2-5/">
	<p>A malformed Opus voice packet sent to a Mumble client could trigger
	a NULL pointer dereference or an out-of-bounds array access.</p>
	<p>A malformed Opus voice packet sent to a Mumble client could trigger a
	heap-based buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0044</cvename>
	<cvename>CVE-2014-0045</cvename>
	<url>http://mumble.info/security/Mumble-SA-2014-001.txt</url>
	<url>http://mumble.info/security/Mumble-SA-2014-002.txt</url>
	</references>
	<dates>
	<discovery>2014-01-25</discovery>
	<entry>2014-05-29</entry>
	</dates>
	</vuln>

	<vuln vid="f99a4686-e694-11e3-9032-000c2980a9f3">
	<cancelled/>
	</vuln>

	<vuln vid="688e73a2-e514-11e3-a52a-98fc11cdc4f5">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.359</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-14.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0510</cvename>
	<cvename>CVE-2014-0516</cvename>
	<cvename>CVE-2014-0517</cvename>
	<cvename>CVE-2014-0518</cvename>
	<cvename>CVE-2014-0519</cvename>
	<cvename>CVE-2014-0520</cvename>
	<url>https://helpx.adobe.com/security/products/flash-player/apsb14-14.html</url>
	</references>
	<dates>
	<discovery>2014-03-13</discovery>
	<entry>2014-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="02db20d7-e34a-11e3-bd92-bcaec565249c">
	<topic>openjpeg -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openjpeg</name>
	<range><lt>1.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Openjpeg release notes report:</p>
	<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS">
	<p>That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1
	release.</p>
	</blockquote>
	<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS">
	<p>That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045,
	CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887,
	where fixed in the 1.5.2 release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3358</cvename>
	<cvename>CVE-2012-3535</cvename>
	<cvename>CVE-2013-1447</cvename>
	<cvename>CVE-2013-4289</cvename>
	<cvename>CVE-2013-4290</cvename>
	<cvename>CVE-2013-6045</cvename>
	<cvename>CVE-2013-6052</cvename>
	<cvename>CVE-2013-6053</cvename>
	<cvename>CVE-2013-6054</cvename>
	<cvename>CVE-2013-6887</cvename>
	<url>http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS</url>
	<url>http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS</url>
	</references>
	<dates>
	<discovery>2012-05-13</discovery>
	<entry>2014-05-24</entry>
	</dates>
	</vuln>

	<vuln vid="b060ee50-daba-11e3-99f2-bcaec565249c">
	<topic>libXfont -- X Font Service Protocol and Font metadata file handling issues</topic>
	<affects>
	<package>
	<name>libXfont</name>
	<range><lt>1.4.7_3</lt></range>
	</package>
	<package>
	<name>linux-c6-xorg-libs</name>
	<range><lt>7.4_2</lt></range>
	</package>
	<package>
	<name>linux-f10-xorg-libs</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alan Coopersmith reports:</p>
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-May/002431.html">
	<p>Ilja van Sprundel, a security researcher with IOActive, has
	discovered several issues in the way the libXfont library
	handles the responses it receives from xfs servers, and has
	worked with X.Org's security team to analyze, confirm, and fix
	these issues.</p>
	<p>Most of these issues stem from libXfont trusting the font server
	to send valid protocol data, and not verifying that the values
	will not overflow or cause other damage. This code is commonly
	called from the X server when an X Font Server is active in the
	font path, so may be running in a setuid-root process depending
	on the X server in use. Exploits of this path could be used by
	a local, authenticated user to attempt to raise privileges; or
	by a remote attacker who can control the font server to attempt
	to execute code with the privileges of the X server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0209</cvename>
	<cvename>CVE-2014-0210</cvename>
	<cvename>CVE-2014-0211</cvename>
	<url>http://lists.x.org/archives/xorg-announce/2014-May/002431.html</url>
	</references>
	<dates>
	<discovery>2014-05-13</discovery>
	<entry>2014-05-13</entry>
	<modified>2015-07-15</modified>
	</dates>
	</vuln>

	<vuln vid="e7bb3885-da40-11e3-9ecb-2c4138874f7d">
	<topic>libxml2 -- lack of end-of-document check DoS</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.9.1</lt></range>
	</package>
	<package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_2</lt></range>
	</package>
	<package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE MITRE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877">
	<p>parser.c in libxml2 before 2.9.0, as used in Google
	Chrome before 28.0.1500.71 and other products, allows remote
	attackers to cause a denial of service (out-of-bounds read)
	via a document that ends abruptly, related to the lack of
	certain checks for the XML_PARSER_EOF state.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2877</cvename>
	<url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877</url>
	<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877</url>
	</references>
	<dates>
	<discovery>2013-04-11</discovery>
	<entry>2013-07-10</entry>
	<modified>2015-07-15</modified>
	</dates>
	</vuln>

	<vuln vid="efdd0edc-da3d-11e3-9ecb-2c4138874f7d">
	<topic>libxml2 -- entity substitution DoS</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.9.1</lt></range>
	</package>
	<package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_2</lt></range>
	</package>
	<package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Cornelius reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/06/4">
	<p>It was discovered that libxml2, a library providing
	support to read, modify and write XML files, incorrectly
	performs entity substitution in the doctype prolog, even if
	the application using libxml2 disabled any entity
	substitution. A remote attacker could provide a
	specially-crafted XML file that, when processed, would lead
	to the exhaustion of CPU and memory resources or file
	descriptors.</p>
	<p>This issue was discovered by Daniel Berrange of Red Hat.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0191</cvename>
	<url>http://www.openwall.com/lists/oss-security/2014/05/06/4</url>
	<url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191</url>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191</url>
	</references>
	<dates>
	<discovery>2013-12-03</discovery>
	<entry>2014-05-06</entry>
	<modified>2015-07-15</modified>
	</dates>
	</vuln>

	<vuln vid="1959e847-d4f0-11e3-84b0-0018fe623f2b">
	<topic>OpenSSL -- NULL pointer dereference / DoS</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_12</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenBSD and David Ramos reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/02/5">
	<p>Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache,
	are prone to a race condition which may allow a remote attacker to
	crash the current service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2014/05/02/5</url>
	<url>https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321</url>
	<freebsdsa>SA-14:10.openssl</freebsdsa>
	<cvename>CVE-2014-0198</cvename>
	</references>
	<dates>
	<discovery>2014-05-02</discovery>
	<entry>2014-05-03</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="89709e58-d497-11e3-a3d5-5453ed2e2b49">
	<topic>qt4-xml -- XML Entity Expansion Denial of Service</topic>
	<affects>
	<package>
	<name>qt4-xml</name>
	<range><lt>4.8.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Richard J. Moore reports:</p>
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2013-December/000036.html">
	<p>QXmlSimpleReader in Qt versions prior to 5.2 supports
	expansion of internal entities in XML documents without
	placing restrictions to ensure the document does not cause
	excessive memory usage. If an application using this API
	processes untrusted data then the application may use
	unexpected amounts of memory if a malicious document is
	processed.</p>
	<p>It is possible to construct XML documents using internal
	entities that consume large amounts of memory and other
	resources to process, this is known as the 'Billion Laughs'
	attack. Qt versions prior to 5.2 did not offer protection
	against this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4549</cvename>
	<url>http://lists.qt-project.org/pipermail/announce/2013-December/000036.html</url>
	</references>
	<dates>
	<discovery>2013-12-05</discovery>
	<entry>2014-05-05</entry>
	</dates>
	</vuln>

	<vuln vid="6fb521b0-d388-11e3-a790-000c2980a9f3">
	<topic>strongswan -- Remote Authentication Bypass</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><lt>5.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>strongSwan developers report:</p>
	<blockquote cite="www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-(cve-2014-2338).html">
	<p>Remote attackers are able to bypass authentication by rekeying an
	IKE_SA during (1) initiation or (2) re-authentication, which
	triggers the IKE_SA state to be set to established.</p>
	<p>Only installations that actively initiate or re-authenticate IKEv2
	IKE_SAs are affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2338</cvename>
	<url>http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html</url>
	</references>
	<dates>
	<discovery>2014-03-12</discovery>
	<entry>2014-05-04</entry>
	</dates>
	</vuln>

	<vuln vid="670d732a-cdd4-11e3-aac2-0022fb6fcf92">
	<topic>mohawk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mohawk</name>
	<range><lt>2.0.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The mohawk project reports:</p>
	<blockquote cite="http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351">
	<p>Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351</url>
	<url>http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e</url>
	</references>
	<dates>
	<discovery>2014-04-10</discovery>
	<entry>2014-04-30</entry>
	</dates>
	</vuln>

	<vuln vid="985d4d6c-cfbd-11e3-a003-b4b52fce4ce8">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>29.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>24.5.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>29.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.26</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.5.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.26</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2014-34 Miscellaneous memory safety hazards
	(rv:29.0 / rv:24.5)</p>
	<p>MFSA 2014-35 Privilege escalation through Mozilla Maintenance
	Service Installer</p>
	<p>MFSA 2014-36 Web Audio memory corruption issues</p>
	<p>MFSA 2014-37 Out of bounds read while decoding JPG images</p>
	<p>MFSA 2014-38 Buffer overflow when using non-XBL object as
	XBL</p>
	<p>MFSA 2014-39 Use-after-free in the Text Track Manager
	for HTML video</p>
	<p>MFSA 2014-41 Out-of-bounds write in Cairo</p>
	<p>MFSA 2014-42 Privilege escalation through Web Notification
	API</p>
	<p>MFSA 2014-43 Cross-site scripting (XSS) using history
	navigations</p>
	<p>MFSA 2014-44 Use-after-free in imgLoader while resizing
	images</p>
	<p>MFSA 2014-45 Incorrect IDNA domain name matching for
	wildcard certificates</p>
	<p>MFSA 2014-46 Use-after-free in nsHostResolve</p>
	<p>MFSA 2014-47 Debugger can bypass XrayWrappers
	with JavaScript</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1492</cvename>
	<cvename>CVE-2014-1518</cvename>
	<cvename>CVE-2014-1519</cvename>
	<cvename>CVE-2014-1520</cvename>
	<cvename>CVE-2014-1522</cvename>
	<cvename>CVE-2014-1523</cvename>
	<cvename>CVE-2014-1524</cvename>
	<cvename>CVE-2014-1525</cvename>
	<cvename>CVE-2014-1526</cvename>
	<cvename>CVE-2014-1527</cvename>
	<cvename>CVE-2014-1528</cvename>
	<cvename>CVE-2014-1529</cvename>
	<cvename>CVE-2014-1530</cvename>
	<cvename>CVE-2014-1531</cvename>
	<cvename>CVE-2014-1532</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-34.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-35.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-36.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-37.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-38.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-39.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-41.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-42.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-43.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-44.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-45.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-46.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-47.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2014-04-29</discovery>
	<entry>2014-04-29</entry>
	</dates>
	</vuln>

	<vuln vid="59e72db2-cae6-11e3-8420-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py26-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>py27-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>py31-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>py32-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>py33-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>py34-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
	</package>
	<package>
	<name>py26-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
	</package>
	<package>
	<name>py27-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
	</package>
	<package>
	<name>py31-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
	</package>
	<package>
	<name>py32-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
	</package>
	<package>
	<name>py33-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
	</package>
	<package>
	<name>py34-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
	</package>
	<package>
	<name>py26-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	</package>
	<package>
	<name>py27-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	</package>
	<package>
	<name>py31-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	</package>
	<package>
	<name>py32-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	</package>
	<package>
	<name>py33-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	</package>
	<package>
	<name>py34-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	</package>
	<package>
	<name>py26-django-devel</name>
	<range><lt>20140423,1</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20140423,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2014/apr/21/security/">
	<p>These releases address an unexpected code-execution issue, a
	caching issue which can expose CSRF tokens and a MySQL typecasting
	issue. While these issues present limited risk and may not affect
	all Django users, we encourage all users to evaluate their own
	risk and upgrade as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2014/apr/21/security/</url>
	<cvename>CVE-2014-0472</cvename>
	<cvename>CVE-2014-0473</cvename>
	<cvename>CVE-2014-0474</cvename>
	</references>
	<dates>
	<discovery>2014-04-21</discovery>
	<entry>2014-04-23</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="0b8d7194-ca88-11e3-9d8d-c80aa9043978">
	<topic>OpenSSL -- Remote Data Injection / DoS</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_11</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><le>1.0.1g</le></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are
	prone to a race condition which may allow a remote attacker to
	inject random data into other connections.</p>
	</body>
	</description>
	<references>
	<url>https://rt.openssl.org/Ticket/Display.html?id=2167</url>
	<url>http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse</url>
	<freebsdsa>SA-14:09.openssl</freebsdsa>
	<cvename>CVE-2010-5298</cvename>
	</references>
	<dates>
	<discovery>2010-02-09</discovery>
	<entry>2014-04-23</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="608ed765-c700-11e3-848c-20cf30e32f6d">
	<topic>bugzilla -- Cross-Site Request Forgery</topic>
	<affects>
	<package>
	<name>bugzilla40</name>
	<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
	</package>
	<package>
	<name>bugzilla42</name>
	<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
	</package>
	<package>
	<name>bugzilla44</name>
	<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
	<p>The login form had no CSRF protection, meaning that
	an attacker could force the victim to log in using the
	attacker's credentials. If the victim then reports a new
	security sensitive bug, the attacker would get immediate
	access to this bug.</p>
	<p>
	Due to changes involved in the Bugzilla API, this fix is
	not backported to the 4.0 and 4.2 branches, meaning that
	Bugzilla 4.0.12 and older, and 4.2.8 and older, will
	remain vulnerable to this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1517</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=713926</url>
	</references>
	<dates>
	<discovery>2014-04-17</discovery>
	<entry>2014-04-18</entry>
	<modified>2014-04-18</modified>
	</dates>
	</vuln>

	<vuln vid="60bfa396-c702-11e3-848c-20cf30e32f6d">
	<topic>bugzilla -- Social Engineering</topic>
	<affects>
	<package>
	<name>bugzilla40</name>
	<range><ge>2.0.0</ge><lt>4.0.12</lt></range>
	</package>
	<package>
	<name>bugzilla42</name>
	<range><ge>4.1.1</ge><lt>4.2.8</lt></range>
	</package>
	<package>
	<name>bugzilla44</name>
	<range><ge>4.4.0</ge><lt>4.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
	<p>Dangerous control characters can be inserted into
	Bugzilla, notably into bug comments. If the text, which
	may look safe, is copied into a terminal such as xterm or
	gnome-terminal, then unexpected commands could be executed
	on the local machine.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=968576</url>
	</references>
	<dates>
	<discovery>2014-04-17</discovery>
	<entry>2014-04-18</entry>
	<modified>2014-04-18</modified>
	</dates>
	</vuln>

	<vuln vid="abad20bf-c1b4-11e3-a5ac-001b21614864">
	<topic>OpenLDAP -- incorrect handling of NULL in certificate Common Name</topic>
	<affects>
	<package>
	<name>openldap24-client</name>
	<range><lt>2.4.18</lt></range>
	</package>
	<package>
	<name>linux-f10-openldap</name>
	<range><lt>2.4.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Lieskovsky reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767">
	<p>OpenLDAP does not properly handle a '\0' character in a domain name
	in the subject's Common Name (CN) field of an X.509 certificate,
	which allows man-in-the-middle attackers to spoof arbitrary SSL
	servers via a crafted certificate issued by a legitimate
	Certification Authority</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3767</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767</url>
	</references>
	<dates>
	<discovery>2009-08-07</discovery>
	<entry>2014-04-11</entry>
	</dates>
	</vuln>

	<vuln vid="9aecb94c-c1ad-11e3-a5ac-001b21614864">
	<topic>cURL -- inappropriate GSSAPI delegation</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.10.6</ge><le>7.21.6</le></range>
	</package>
	<package>
	<name>linux-f10-curl</name>
	<range><ge>7.10.6</ge><le>7.21.6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20110623.html">
	<p>When doing GSSAPI authentication, libcurl unconditionally performs
	credential delegation. This hands the server a copy of the client's
	security credentials, allowing the server to impersonate the client
	to any other using the same GSSAPI mechanism.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2192</cvename>
	<url>http://curl.haxx.se/docs/adv_20110623.html</url>
	</references>
	<dates>
	<discovery>2011-06-23</discovery>
	<entry>2014-04-11</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="77bb0541-c1aa-11e3-a5ac-001b21614864">
	<topic>dbus-glib -- privledge escalation</topic>
	<affects>
	<package>
	<name>dbus-glib</name>
	<range><lt>0.100.1</lt></range>
	</package>
	<package>
	<name>linux-f10-dbus-glib</name>
	<range><lt>0.100.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Krahmer reports:</p>
	<blockquote cite="https://bugs.freedesktop.org/show_bug.cgi?id=60916">
	<p>A privilege escalation flaw was found in the way dbus-glib, the
	D-Bus add-on library to integrate the standard D-Bus library with
	the GLib thread abstraction and main loop, performed filtering of
	the message sender (message source subject), when the
	NameOwnerChanged signal was received. A local attacker could use
	this flaw to escalate their privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0292</cvename>
	<url>https://bugs.freedesktop.org/show_bug.cgi?id=60916</url>
	</references>
	<dates>
	<discovery>2013-02-15</discovery>
	<entry>2014-04-11</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="bf7912f5-c1a8-11e3-a5ac-001b21614864">
	<topic>nas -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nas</name>
	<range><lt>1.9.4</lt></range>
	</package>
	<package>
	<name>linux-f10-nas-libs</name>
	<range><lt>1.9.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hamid Zamani reports:</p>
	<blockquote cite="http://radscan.com/pipermail/nas/2013-August/001270.html">
	<p>multiple security problems (buffer overflows, format string
	vulnerabilities and missing input sanitising), which could lead to
	the execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4256</cvename>
	<cvename>CVE-2013-4257</cvename>
	<cvename>CVE-2013-4258</cvename>
	<url>http://radscan.com/pipermail/nas/2013-August/001270.html</url>
	</references>
	<dates>
	<discovery>2013-08-07</discovery>
	<entry>2014-04-11</entry>
	</dates>
	</vuln>

	<vuln vid="09f47c51-c1a6-11e3-a5ac-001b21614864">
	<topic>libaudiofile -- heap-based overflow in Microsoft ADPCM compression module</topic>
	<affects>
	<package>
	<name>libaudiofile</name>
	<range><lt>0.2.7</lt></range>
	</package>
	<package>
	<name>linux-f10-libaudiofile</name>
	<range><lt>0.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205">
	<p>Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile
	0.2.6 allows context-dependent attackers to cause a denial of service
	(application crash) or possibly execute arbitrary code via a crafted
	WAV file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0159</cvename>
	<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205</url>
	</references>
	<dates>
	<discovery>2008-12-30</discovery>
	<entry>2014-04-11</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="972837fc-c304-11e3-8758-00262d5ed8ee">
	<topic>ChaSen -- buffer overflow</topic>
	<affects>
	<package>
	<name>chasen-base</name>
	<range><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>chasen</name>
	<range><lt>2.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>JVN iPedia reports:</p>
	<blockquote cite="http://jvn.jp/en/jp/JVN16901583/index.html">
	<p>ChaSen provided by Nara Institute of Science and Technology is a
	software for morphologically analyzing Japanese. ChaSen contains an
	issue when reading in strings, which may lead to a buffer
	overflow.</p>
	<p>An arbitrary script may be executed by an attacker with access to
	a system that is running a product listed in "Products
	Affected."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4000</cvename>
	<url>http://jvn.jp/en/jp/JVN16901583/index.html</url>
	</references>
	<dates>
	<discovery>2011-11-08</discovery>
	<entry>2014-04-13</entry>
	</dates>
	</vuln>

	<vuln vid="7ccd4def-c1be-11e3-9d09-000c2980a9f3">
	<topic>OpenSSL -- Local Information Disclosure</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_15</lt></range>
	<range><ge>8.4</ge><lt>8.4_8</lt></range>
	<range><ge>9.1</ge><lt>9.1_11</lt></range>
	<range><ge>9.2</ge><lt>9.2_4</lt></range>
	<range><ge>10.0</ge><lt>10.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL reports:</p>
	<blockquote cite="https://www.openssl.org/news/vulnerabilities.html#2014-0076">
	<p>A flaw in the implementation of Montgomery Ladder Approach would
	create a side-channel that leaks sensitive timing information.</p>
	<p>A local attacker might be able to snoop a signing process and
	might recover the signing key from it.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0076</cvename>
	<freebsdsa>SA-14:06.openssl</freebsdsa>
	<url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
	</references>
	<dates>
	<discovery>2014-04-07</discovery>
	<entry>2014-04-11</entry>
	</dates>
	</vuln>

	<vuln vid="c0c31b27-bff3-11e3-9d09-000c2980a9f3">
	<topic>openafs -- Denial of Service</topic>
	<affects>
	<package>
	<name>openafs</name>
	<range><ge>1.4.8</ge><lt>1.6.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenAFS development team reports:</p>
	<blockquote cite="http://openafs.org/security/OPENAFS-SA-2014-001.txt">
	<p>An attacker with the ability to connect to an OpenAFS fileserver can
	trigger a buffer overflow, crashing the server.</p>
	<p>The buffer overflow can be triggered by sending an unauthenticated
	request for file server statistical information.</p>
	<p>Clients are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0159</cvename>
	<url>http://openafs.org/security/OPENAFS-SA-2014-001.txt</url>
	</references>
	<dates>
	<discovery>2014-04-09</discovery>
	<entry>2014-04-09</entry>
	</dates>
	</vuln>

	<vuln vid="5631ae98-be9e-11e3-b5e3-c80aa9043978">
	<topic>OpenSSL -- Remote Information Disclosure</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
	</package>
	<package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL Reports:</p>
	<blockquote cite="https://www.openssl.org/news/secadv_20140407.txt">
	<p>A missing bounds check in the handling of the TLS heartbeat extension can be
	used to reveal up to 64k of memory to a connected client or server.</p>
	<p>Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
	upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.</p>
	</blockquote>
	<blockquote cite="http://www.heartbleed.com">
	<p>The bug allows anyone on the Internet to read the memory of the
	systems protected by the vulnerable versions of the OpenSSL software.
	This compromises the secret keys used to identify the service
	providers and to encrypt the traffic, the names and passwords of the
	users and the actual content. This allows attackers to eavesdrop
	communications, steal data directly from the services and users and
	to impersonate services and users.</p>
	</blockquote>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:06.openssl.asc">
	<p>The code used to handle the Heartbeat Extension does not do
	sufficient boundary checks on record length, which allows reading
	beyond the actual payload.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0160</cvename>
	<freebsdsa>SA-14:06.openssl</freebsdsa>
	<url>https://www.openssl.org/news/secadv_20140407.txt</url>
	<url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
	<url>http://www.heartbleed.com</url>
	</references>
	<dates>
	<discovery>2014-04-07</discovery>
	<entry>2014-04-07</entry>
	<modified>2014-04-11</modified>
	</dates>
	</vuln>

	<vuln vid="ffa7c6e4-bb29-11e3-8136-60a44c524f57">
	<topic>otrs -- Clickjacking issue</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.21</lt></range>
	<range><gt>3.2.*</gt><lt>3.2.16</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/">
	<p>An attacker could embed OTRS in a hidden iframe tag of another
	page, tricking the user into clicking links in OTRS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.w3.org/1999/xhtml</url>
	<cvename>CVE-2014-2554</cvename>
	</references>
	<dates>
	<discovery>2014-04-01</discovery>
	<entry>2014-04-03</entry>
	</dates>
	</vuln>

	<vuln vid="580cc46b-bb1e-11e3-b144-2c4138874f7d">
	<topic>LibYAML input sanitization errors</topic>
	<affects>
	<package>
	<name>libyaml</name>
	<range><lt>0.1.6</lt></range>
	</package>
	<package>
	<name>mingw32-libyaml</name>
	<range><lt>0.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-003.html">
	<p>The LibYAML project is an open source YAML 1.1 parser and
	emitter written in C.</p>
	<p>The library is affected by a heap-based buffer overflow
	which can lead to arbitrary code execution. The
	vulnerability is caused by lack of proper expansion for the
	string passed to the yaml_parser_scan_uri_escapes()
	function.</p>
	<p>A specially crafted YAML file, with a long sequence of
	percent-encoded characters in a URL, can be used to trigger
	the overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2525</cvename>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525</url>
	</references>
	<dates>
	<discovery>2014-03-11</discovery>
	<entry>2014-03-26</entry>
	</dates>
	</vuln>

	<vuln vid="4e95eb4e-b737-11e3-87cd-f0def10dca57">
	<topic>Icinga -- buffer overflow in classic web interface</topic>
	<affects>
	<package>
	<name>icinga</name>
	<range><lt>1.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Icinga Team reports:</p>
	<blockquote cite="https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d">
	<p>Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2386</cvename>
	<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386</url>
	</references>
	<dates>
	<discovery>2014-02-18</discovery>
	<entry>2014-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="7e61a839-b714-11e3-8195-001966155bea">
	<topic>file -- out-of-bounds access in search rules with offsets from input file</topic>
	<affects>
	<package>
	<name>file</name>
	<range><lt>5.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aaron Reffett reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270">
	<p>softmagic.c in file ... and libmagic allows context-dependent
	attackers to cause a denial of service (out-of-bounds memory access and
	crash) via crafted offsets in the softmagic of a PE executable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2270</cvename>
	<url>http://bugs.gw.com/view.php?id=31</url>
	</references>
	<dates>
	<discovery>2013-12-20</discovery>
	<entry>2014-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="9fa1a0ac-b2e0-11e3-bb07-6cf0490a8c18">
	<topic>Joomla! -- Core - Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla2</name>
	<range><ge>2.5.*</ge><le>2.5.18</le></range>
	</package>
	<package>
	<name>joomla3</name>
	<range><ge>3.0.*</ge><le>3.2.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security/578-20140301-core-sql-injection.html">
	<h2>[20140301] - Core - SQL Injection</h2>
	<p>Inadequate escaping leads to SQL injection vulnerability.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html">
	<h2>[20140302] - Core - XSS Vulnerability</h2>
	<p>Inadequate escaping leads to XSS vulnerability in com_contact.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html">
	<h2>[20140303] - Core - XSS Vulnerability</h2>
	<p>Inadequate escaping leads to XSS vulnerability.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html">
	<h2>[20140304] - Core - Unauthorised Logins</h2>
	<p>Inadequate checking allowed unauthorised logins via GMail authentication.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://developer.joomla.org/security/578-20140301-core-sql-injection.html</url>
	<url>http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html</url>
	<url>http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html</url>
	<url>http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html</url>
	</references>
	<dates>
	<discovery>2014-03-01</discovery>
	<entry>2014-03-23</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="36f9ac43-b2ac-11e3-8752-080027ef73ec">
	<topic>mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection</topic>
	<affects>
	<package>
	<name>trojita</name>
	<range><lt>0.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Kundrát reports:</p>
	<blockquote cite="http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html">
	<p>An SSL stripping vulnerability was discovered in Trojitá, a fast Qt
	IMAP e-mail client. User's credentials are never leaked, but if a
	user tries to send an e-mail, the automatic saving into the "sent"
	or "draft" folders could happen over a plaintext connection even if
	the user's preferences specify STARTTLS as a requirement.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2567</cvename>
	<url>http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html</url>
	</references>
	<dates>
	<discovery>2014-03-20</discovery>
	<entry>2014-03-23</entry>
	</dates>
	</vuln>

	<vuln vid="da4b89ad-b28f-11e3-99ca-f0def16c5c1b">
	<topic>nginx-devel -- SPDY heap buffer overflow</topic>
	<affects>
	<package>
	<name>nginx-devel</name>
	<range><ge>1.3.15</ge><lt>1.5.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
	<p>A bug in the experimental SPDY implementation in nginx was found, which
	might allow an attacker to cause a heap memory buffer overflow in a
	worker process by using a specially crafted request, potentially
	resulting in arbitrary code execution (CVE-2014-0133).</p>

	<p>The problem affects nginx 1.3.15 - 1.5.11, compiled with the
	ngx_http_spdy_module module (which is not compiled by default) and
	without --with-debug configure option, if the "spdy" option of the
	"listen" directive is used in a configuration file.</p>

	<p>The problem is fixed in nginx 1.5.12, 1.4.7.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0133</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
	</references>
	<dates>
	<discovery>2014-03-18</discovery>
	<entry>2014-03-23</entry>
	</dates>
	</vuln>

	<vuln vid="fc28df92-b233-11e3-99ca-f0def16c5c1b">
	<topic>nginx -- SPDY heap buffer overflow</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><lt>1.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
	<p>A bug in the experimental SPDY implementation in nginx was found, which
	might allow an attacker to cause a heap memory buffer overflow in a
	worker process by using a specially crafted request, potentially
	resulting in arbitrary code execution (CVE-2014-0133).</p>

	<p>The problem affects nginx 1.3.15 - 1.5.11, compiled with the
	ngx_http_spdy_module module (which is not compiled by default) and
	without --with-debug configure option, if the "spdy" option of the
	"listen" directive is used in a configuration file.</p>

	<p>The problem is fixed in nginx 1.5.12, 1.4.7.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0133</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
	</references>
	<dates>
	<discovery>2014-03-18</discovery>
	<entry>2014-03-23</entry>
	</dates>
	</vuln>

	<vuln vid="91ecb546-b1e6-11e3-980f-20cf30e32f6d">
	<topic>apache -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><gt>2.4.0</gt><lt>2.4.9</lt></range>
	</package>
	<package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
	</package>
	<package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
	</package>
	<package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
	</package>
	<package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
	</package>
	<package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.27">
	<p>Clean up cookie logging with fewer redundant string parsing passes.
	Log only cookies with a value assignment. Prevents segfaults when
	logging truncated cookies.</p>
	<p>mod_dav: Keep track of length of cdata properly when removing leading
	spaces. Eliminates a potential denial of service from specifically
	crafted DAV WRITE requests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0098</cvename>
	<cvename>CVE-2013-6438</cvename>
	</references>
	<dates>
	<discovery>2014-02-25</discovery>
	<entry>2014-03-22</entry>
	</dates>
	</vuln>

	<vuln vid="610de647-af8d-11e3-a25b-b4b52fce4ce8">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>28.0,1</lt></range>
	</package>
	<package>
	<name>firefox-esr</name>
	<range><lt>24.4.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>28.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.25</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.4.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.25</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2014-15 Miscellaneous memory safety hazards
	(rv:28.0 / rv:24.4)</p>
	<p>MFSA 2014-16 Files extracted during updates are not always
	read only</p>
	<p>MFSA 2014-17 Out of bounds read during WAV file decoding</p>
	<p>MFSA 2014-18 crypto.generateCRMFRequest does not validate
	type of key</p>
	<p>MFSA 2014-19 Spoofing attack on WebRTC permission prompt</p>
	<p>MFSA 2014-20 onbeforeunload and Javascript navigation DOS</p>
	<p>MFSA 2014-21 Local file access via Open Link in new tab</p>
	<p>MFSA 2014-22 WebGL content injection from one domain to
	rendering in another</p>
	<p>MFSA 2014-23 Content Security Policy for data: documents
	not preserved by session restore</p>
	<p>MFSA 2014-24 Android Crash Reporter open to manipulation</p>
	<p>MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable
	to relative path escape</p>
	<p>MFSA 2014-26 Information disclosure through polygon
	rendering in MathML</p>
	<p>MFSA 2014-27 Memory corruption in Cairo during PDF font
	rendering</p>
	<p>MFSA 2014-28 SVG filters information disclosure through
	feDisplacementMap</p>
	<p>MFSA 2014-29 Privilege escalation using WebIDL-implemented
	APIs</p>
	<p>MFSA 2014-30 Use-after-free in TypeObject</p>
	<p>MFSA 2014-31 Out-of-bounds read/write through neutering
	ArrayBuffer objects</p>
	<p>MFSA 2014-32 Out-of-bounds write through TypedArrayObject
	after neutering</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1493</cvename>
	<cvename>CVE-2014-1494</cvename>
	<cvename>CVE-2014-1496</cvename>
	<cvename>CVE-2014-1497</cvename>
	<cvename>CVE-2014-1498</cvename>
	<cvename>CVE-2014-1499</cvename>
	<cvename>CVE-2014-1500</cvename>
	<cvename>CVE-2014-1501</cvename>
	<cvename>CVE-2014-1502</cvename>
	<cvename>CVE-2014-1504</cvename>
	<cvename>CVE-2014-1505</cvename>
	<cvename>CVE-2014-1506</cvename>
	<cvename>CVE-2014-1507</cvename>
	<cvename>CVE-2014-1508</cvename>
	<cvename>CVE-2014-1509</cvename>
	<cvename>CVE-2014-1510</cvename>
	<cvename>CVE-2014-1511</cvename>
	<cvename>CVE-2014-1512</cvename>
	<cvename>CVE-2014-1513</cvename>
	<cvename>CVE-2014-1514</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-15.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-16.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-17.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-18.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-19.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-20.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-21.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-22.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-23.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-24.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-25.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-26.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-27.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-28.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-29.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-30.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-31.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-32.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2014-03-19</discovery>
	<entry>2014-03-19</entry>
	<modified>2014-03-20</modified>
	</dates>
	</vuln>

	<vuln vid="eb426e82-ab68-11e3-9d09-000c2980a9f3">
	<topic>mutt -- denial of service, potential remote code execution</topic>
	<affects>
	<package>
	<name>mutt</name>
	<range><lt>1.5.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Beatrice Torracca and Evgeni Golov report:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/531431">
	<p>A buffer overflow has been discovered that could result in
	denial of service or potential execution of arbitrary code.</p>
	<p>This condition can be triggered by malformed RFC2047 header
	lines</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0467</cvename>
	<url>http://packetstormsecurity.com/files/cve/CVE-2014-0467</url>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467</url>
	</references>
	<dates>
	<discovery>2014-03-12</discovery>
	<entry>2014-03-14</entry>
	</dates>
	</vuln>

	<vuln vid="777d7b9e-ab02-11e3-841e-60a44c524f57">
	<topic>wemux -- read-only can be bypassed</topic>
	<affects>
	<package>
	<name>wemux</name>
	<range><lt>3.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>JonApps reports:</p>
	<blockquote cite="https://github.com/zolrath/wemux/issues/36">
	<p>The read-only mode can be bypassed and any command sent to bash session</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/zolrath/wemux/issues/36</url>
	</references>
	<dates>
	<discovery>2013-12-24</discovery>
	<entry>2014-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="03e48bf5-a96d-11e3-a556-3c970e169bc2">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.23</lt></range>
	</package>
	<package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.16</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba project reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4496">
	<p>In Samba's SAMR server we neglect to ensure that attempted
	password changes will update the bad password count, nor set
	the lockout flags. This would allow a user unlimited attempts
	against the password by simply calling ChangePasswordUser2
	repeatedly.</p>
	<p>This is available without any other authentication.</p>
	</blockquote>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-6442">
	<p>smbcacls can remove a file or directory ACL by mistake.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4496</cvename>
	<cvename>CVE-2013-6442</cvename>
	<url>http://www.samba.org/samba/security/CVE-2013-4496</url>
	<url>http://www.samba.org/samba/security/CVE-2013-6442</url>
	</references>
	<dates>
	<discovery>2014-03-11</discovery>
	<entry>2014-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="03159886-a8a3-11e3-8f36-0025905a4771">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><lt>11.8.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><lt>1.8.26.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP
	request that is handled by Asterisk with a large number of Cookie
	headers could overflow the stack. You could even exhaust memory if you
	sent an unlimited number of headers in the request.</p>
	<p>Denial of Service Through File Descriptor Exhaustion with chan_sip
	Session-Timers. An attacker can use all available file descriptors
	using SIP INVITE requests. Asterisk will respond with code 400, 420,
	or 422 for INVITEs meeting this criteria.
	Each INVITE meeting these conditions will leak a channel and several
	file descriptors. The file descriptors cannot be released without
	restarting Asterisk which may allow intrusion detection systems to be
	bypassed by sending the requests slowly.</p>
	<p>Remote Crash Vulnerability in PJSIP channel driver. A remotely
	exploitable crash vulnerability exists in the PJSIP channel driver if
	the "qualify_frequency" configuration option is enabled on an AOR and
	the remote SIP server challenges for authentication of the resulting
	OPTIONS request. The response handling code wrongly assumes that a
	PJSIP endpoint will always be associated with an outgoing request which
	is incorrect.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-2286</cvename>
	<cvename>CVE-2014-2287</cvename>
	<cvename>CVE-2014-2288</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-001.pdf</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-002.pdf</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2014-003.pdf</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2014-03-10</discovery>
	<entry>2014-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="1a0de610-a761-11e3-95fe-bcaec565249c">
	<topic>freetype2 -- Out of bounds read/write</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mateusz Jurczyk reports:</p>
	<blockquote cite="http://savannah.nongnu.org/bugs/?41697">
	<p>Out of bounds stack-based read/write in
	cf2_hintmap_build.</p>
	<p>This is a critical vulnerability in the CFF Rasterizer
	code recently contributed by Adobe, leading to potential
	arbitrary code execution in the context of the FreeType2
	library client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://savannah.nongnu.org/bugs/?41697</url>
	</references>
	<dates>
	<discovery>2014-02-25</discovery>
	<entry>2014-03-09</entry>
	</dates>
	</vuln>

	<vuln vid="20e23b65-a52e-11e3-ae3a-00224d7c32a2">
	<topic>xmms -- Integer Overflow And Underflow Vulnerabilities</topic>
	<affects>
	<package>
	<name>xmms</name>
	<range><le>1.2.11_20</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2007-47/advisory/">
	<p>Secunia Research has discovered two vulnerabilities in XMMS, which can
	be exploited by malicious people to compromise a user's system.</p>

	<p>1) An integer underflow error exists in the processing of skin bitmap
	images. This can be exploited to cause a stack-based buffer overflow
	via specially crafted skin images containing manipulated header
	information.</p>

	<p>Successful exploitation allows execution of arbitrary code.</p>

	<p>2) An integer overflow error exists in the processing of skin bitmap
	images. This can be exploited to cause memory corruption via specially
	crafted skin images containing manipulated header information.</p>

	<p>Successful exploitation may allow the execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-0653</cvename>
	<cvename>CVE-2007-0654</cvename>
	</references>
	<dates>
	<discovery>2007-02-06</discovery>
	<entry>2014-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="89db3b31-a4c3-11e3-978f-f0def16c5c1b">
	<topic>nginx -- SPDY memory corruption</topic>
	<affects>
	<package>
	<name>nginx-devel</name>
	<range><eq>1.5.10</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html">
	<p>A bug in the experimental SPDY implementation in nginx 1.5.10 was found,
	which might allow an attacker to corrupt worker process memory by using
	a specially crafted request, potentially resulting in arbitrary code
	execution (CVE-2014-0088).</p>

	<p>The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with
	the ngx_http_spdy_module module (which is not compiled by default), if
	the "spdy" option of the "listen" directive is used in a configuration
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0088</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html</url>
	</references>
	<dates>
	<discovery>2014-03-04</discovery>
	<entry>2014-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="f645aa90-a3e8-11e3-a422-3c970e169bc2">
	<topic>gnutls -- multiple certificate verification issues</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.12.23_4</lt></range>
	</package>
	<package>
	<name>linux-f10-gnutls</name>
	<range><lt>2.12.23_4</lt></range>
	</package>
	<package>
	<name>gnutls-devel</name>
	<range><lt>3.1.22</lt></range>
	<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
	</package>
	<package>
	<name>gnutls3</name>
	<range><lt>3.1.22</lt></range>
	<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuTLS project reports:</p>
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-2">
	<p>A vulnerability was discovered that affects the
	certificate verification functions of all gnutls
	versions. A specially crafted certificate could
	bypass certificate validation checks. The
	vulnerability was discovered during an audit of
	GnuTLS for Red Hat.</p>
	</blockquote>
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-1">
	<p>Suman Jana reported a vulnerability that affects
	the certificate verification functions of
	gnutls 2.11.5 and later versions. A version 1
	intermediate certificate will be considered as
	a CA certificate by default (something that
	deviates from the documented behavior).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0092</cvename>
	<cvename>CVE-2014-1959</cvename>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-1</url>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-2</url>
	</references>
	<dates>
	<discovery>2014-03-03</discovery>
	<entry>2014-03-04</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="815dbcf9-a2d6-11e3-8088-002590860428">
	<topic>file -- denial of service</topic>
	<affects>
	<package>
	<name>file</name>
	<range><lt>5.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Fine Free file project reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943">
	<p>file before 5.17 allows context-dependent attackers to
	cause a denial of service (infinite recursion, CPU consumption, and
	crash) via a crafted indirect offset value in the magic of a file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1943</cvename>
	<mlist>http://mx.gw.com/pipermail/file/2014/001327.html</mlist>
	</references>
	<dates>
	<discovery>2014-02-16</discovery>
	<entry>2014-03-03</entry>
	</dates>
	</vuln>

	<vuln vid="8e5e6d42-a0fa-11e3-b09a-080027f2d077">
	<topic>Python -- buffer overflow in socket.recvfrom_into()</topic>
	<affects>
	<package>
	<name>python27</name>
	<range><le>2.7.6_3</le></range>
	</package>
	<package>
	<name>python31</name>
	<range><le>3.1.5_10</le></range>
	</package>
	<package>
	<name>python32</name>
	<range><le>3.2.5_7</le></range>
	</package>
	<package>
	<name>python33</name>
	<range><le>3.3.3_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vincent Danen via Red Hat Issue Tracker reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1062370">
	<p>A vulnerability was reported in Python's socket module, due to a
	boundary error within the sock_recvfrom_into() function, which could be
	exploited to cause a buffer overflow. This could be used to crash a
	Python application that uses the socket.recvfrom_info() function or,
	possibly, execute arbitrary code with the permissions of the user
	running vulnerable Python code.</p>

	<p>This vulnerable function, socket.recvfrom_into(), was introduced in
	Python 2.5. Earlier versions are not affected by this flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>65379</bid>
	<cvename>CVE-2014-1912</cvename>
	<mlist>https://mail.python.org/pipermail/python-dev/2014-February/132758.html</mlist>
	<url>http://bugs.python.org/issue20246</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1062370</url>
	</references>
	<dates>
	<discovery>2014-01-14</discovery>
	<entry>2014-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="1839f78c-9f2b-11e3-980f-20cf30e32f6d">
	<topic>subversion -- mod_dav_svn vulnerability</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.8</lt></range>
	</package>
	<package>
	<name>subversion16</name>
	<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
	</package>
	<package>
	<name>subversion17</name>
	<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
	receives an OPTIONS request against the server root and Subversion is
	configured to handle the server root and SVNListParentPath is on.
	This can lead to a DoS. There are no known instances of this
	problem being exploited in the wild, but the details of how to exploit
	it have been disclosed on the Subversion development mailing list.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>CVE-2014-0032</url>
	<url>https://subversion.apache.org/security/CVE-2014-0032-advisory.txt</url>
	</references>
	<dates>
	<discovery>2014-01-10</discovery>
	<entry>2014-02-26</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="70b72a52-9e54-11e3-babe-60a44c524f57">
	<topic>otrs -- XSS Issue</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.20</lt></range>
	<range><gt>3.2.*</gt><lt>3.2.15</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="https://www.otrs.com/security-advisory-2014-03-xss-issue/">
	<p>An attacker could send a specially prepared HTML email to OTRS. If
	he can then trick an agent into following a special link to display this email,
	JavaScript code would be executed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.otrs.com/security-advisory-2014-03-xss-issue/</url>
	<cvename>CVE-2014-1695</cvename>
	</references>
	<dates>
	<discovery>2014-02-25</discovery>
	<entry>2014-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="42d42090-9a4d-11e3-b029-08002798f6ff">
	<topic>PostgreSQL -- multiple privilege issues</topic>
	<affects>
	<package>
	<name>postgresql-server</name>
	<range><lt>8.4.20</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.16</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.12</lt></range>
	<range><ge>9.2.0</ge><lt>9.2.7</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL Project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1506/">
	<p>This update fixes CVE-2014-0060, in which PostgreSQL did not
	properly enforce the WITH ADMIN OPTION permission for ROLE management.
	Before this fix, any member of a ROLE was able to grant others access
	to the same ROLE regardless if the member was given the WITH ADMIN
	OPTION permission. It also fixes multiple privilege escalation issues,
	including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,
	CVE-2014-0065, and CVE-2014-0066. More information on these issues can
	be found on our security page and the security issue detail wiki page.
	</p>
	<p>
	With this release, we are also alerting users to a known security hole
	that allows other users on the same machine to gain access to an
	operating system account while it is doing "make check":
	CVE-2014-0067. "Make check" is normally part of building PostgreSQL
	from source code. As it is not possible to fix this issue without
	causing significant issues to our testing infrastructure, a patch will
	be released separately and publicly. Until then, users are strongly
	advised not to run "make check" on machines where untrusted users have
	accounts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0060</cvename>
	<cvename>CVE-2014-0061</cvename>
	<cvename>CVE-2014-0062</cvename>
	<cvename>CVE-2014-0063</cvename>
	<cvename>CVE-2014-0064</cvename>
	<cvename>CVE-2014-0065</cvename>
	<cvename>CVE-2014-0066</cvename>
	<cvename>CVE-2014-0067</cvename>
	</references>
	<dates>
	<discovery>2014-02-20</discovery>
	<entry>2014-02-20</entry>
	</dates>
	</vuln>

	<vuln vid="0871d18b-9638-11e3-a371-6805ca0b3d42">
	<topic>phpMyAdmin -- Self-XSS due to unescaped HTML output in import.</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>3.3.1</ge><lt>4.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php">
	<p> When importing a file with crafted filename, it is
	possible to trigger an XSS. We consider this vulnerability
	to be non critical.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php</url>
	<cvename>CVE-2014-1879</cvename>
	</references>
	<dates>
	<discovery>2014-02-15</discovery>
	<entry>2014-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="3e0507c6-9614-11e3-b3a5-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.551</lt></range>
	</package>
	<package>
	<name>jenkins-lts</name>
	<range><lt>1.532.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14">
	<p>This advisory announces multiple security vulnerabilities that
	were found in Jenkins core.</p>
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14</url>
	<cvename>CVE-2013-5573</cvename>
	<cvename>CVE-2013-7285</cvename>
	</references>
	<dates>
	<discovery>2014-02-14</discovery>
	<entry>2014-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="90b27045-9530-11e3-9d09-000c2980a9f3">
	<topic>lighttpd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.34</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>lighttpd security advisories report:</p>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt">
	<p>It is possible to inadvertantly enable vulnerable ciphers when using
	ssl.cipher-list.</p>
	</blockquote>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt">
	<p>In certain cases setuid() and similar can fail, potentially triggering
	lighttpd to restart running as root.</p>
	</blockquote>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt">
	<p>If FAMMonitorDirectory fails, the memory intended to store the context is
	released; some lines below the "version" compoment of that context is read.
	Reading invalid data doesn't matter, but the memory access could trigger a
	segfault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt</url>
	<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt</url>
	<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt</url>
	<cvename>CVE-2013-4508</cvename>
	<cvename>CVE-2013-4559</cvename>
	<cvename>CVE-2013-4560</cvename>
	</references>
	<dates>
	<discovery>2013-11-28</discovery>
	<entry>2014-02-14</entry>
	</dates>
	</vuln>

	<vuln vid="4dd575b8-8f82-11e3-bb11-0025905a4771">
	<topic>phpmyfaq -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><lt>2.8.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyFAQ team reports:</p>
	<blockquote cite="http://www.phpmyfaq.de/advisory_2014-02-04.php">
	<p> An arbitrary script may be executed on the user's Internet
	Explorer when using an older version of the browser. If a user views
	a malicious page while logged in, settings may be changed
	unintentionally.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0813</cvename>
	<cvename>CVE-2014-0814</cvename>
	<url>http://www.phpmyfaq.de/advisory_2014-02-04.php</url>
	</references>
	<dates>
	<discovery>2014-02-04</discovery>
	<entry>2014-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="b7a7576d-8e0a-11e3-9976-9c4e36909cc0">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.336</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb14-04.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0497</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb14-04.html</url>
	</references>
	<dates>
	<discovery>2014-02-04</discovery>
	<entry>2014-02-04</entry>
	<modified>2014-02-05</modified>
	</dates>
	</vuln>

	<vuln vid="1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>25.0,1</gt><lt>27.0,1</lt></range>
	<range><lt>24.3.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>27.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.24</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.3.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.24</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2014-01 Miscellaneous memory safety hazards
	(rv:27.0 / rv:24.3)</p>
	<p>MFSA 2014-02 Clone protected content with XBL scopes</p>
	<p>MFSA 2014-03 UI selection timeout missing on download
	prompts</p>
	<p>MFSA 2014-04 Incorrect use of discarded images by
	RasterImage</p>
	<p>MFSA 2014-05 Information disclosure with *FromPoint on
	iframes</p>
	<p>MFSA 2014-06 Profile path leaks to Android system log</p>
	<p>MFSA 2014-07 XSLT stylesheets treated as styles in Content
	Security Policy</p>
	<p>MFSA 2014-08 Use-after-free with imgRequestProxy and image
	proccessing</p>
	<p>MFSA 2014-09 Cross-origin information leak through web
	workers</p>
	<p>MFSA 2014-10 Firefox default start page UI content invokable
	by script</p>
	<p>MFSA 2014-11 Crash when using web workers with asm.js</p>
	<p>MFSA 2014-12 NSS ticket handling issues</p>
	<p>MFSA 2014-13 Inconsistent JavaScript handling of access to
	Window objects</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1477</cvename>
	<cvename>CVE-2014-1478</cvename>
	<cvename>CVE-2014-1479</cvename>
	<cvename>CVE-2014-1480</cvename>
	<cvename>CVE-2014-1481</cvename>
	<cvename>CVE-2014-1482</cvename>
	<cvename>CVE-2014-1483</cvename>
	<cvename>CVE-2014-1484</cvename>
	<cvename>CVE-2014-1485</cvename>
	<cvename>CVE-2014-1486</cvename>
	<cvename>CVE-2014-1487</cvename>
	<cvename>CVE-2014-1488</cvename>
	<cvename>CVE-2014-1489</cvename>
	<cvename>CVE-2014-1490</cvename>
	<cvename>CVE-2014-1491</cvename>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-01.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-02.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-03.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-04.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-05.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-06.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-07.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-08.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-09.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-10.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-11.html</url>
	<url>https://www.mozilla.org/security/announce/2014/mfsa2014-12.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2014-02-04</discovery>
	<entry>2014-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="111f1f84-1d14-4ff2-a9ea-cf07119c0d3b">
	<topic>libyaml heap overflow resulting in possible code execution</topic>
	<affects>
	<package>
	<name>libyaml</name>
	<range><lt>0.1.4_3</lt></range>
	</package>
	<package>
	<name>pkg</name>
	<range><lt>1.2.6</lt></range>
	</package>
	<package>
	<name>pkg-devel</name>
	<range><lt>1.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libyaml was prone to a heap overflow that could result in
	arbitrary code execution. Pkg uses libyaml to parse
	the package manifests in some cases. Pkg also used libyaml
	to parse the remote repository until 1.2.</p>
	<p>RedHat Product Security Team reports on libyaml:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1033990">
	<p>A heap-based buffer overflow flaw was found in the way libyaml
	parsed YAML tags. A remote attacker could provide a
	specially-crafted YAML document that, when parsed by an application
	using libyaml, would cause the application to crash or, potentially,
	execute arbitrary code with the privileges of the user running the
	application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6393</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1033990</url>
	</references>
	<dates>
	<discovery>2013-11-24</discovery>
	<entry>2014-02-01</entry>
	<modified>2014-02-01</modified>
	</dates>
	</vuln>

	<vuln vid="a4c9e12d-88b7-11e3-8ada-10bf48e1088e">
	<topic>socat -- buffer overflow with data from command line</topic>
	<affects>
	<package>
	<name>socat</name>
	<range><lt>1.7.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Weimer of the Red Hat Product Security Team reports:</p>
	<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt">
	<p>Due to a missing check during assembly of the HTTP request line a long
	target server name in the PROXY-CONNECT address can cause a stack buffer
	overrun. Exploitation requires that the attacker is able to provide the
	target server name to the PROXY-CONNECT address in the command line.
	This can happen for example in scripts that receive data from untrusted
	sources.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0019</cvename>
	<url>http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt</url>
	</references>
	<dates>
	<discovery>2014-01-24</discovery>
	<entry>2014-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="c7b5d72b-886a-11e3-9533-60a44c524f57">
	<topic>otrs -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.19</lt></range>
	<range><gt>3.2.*</gt><lt>3.2.14</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/">
	<p>SQL injection issue</p>
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/">
	<p>An attacker that managed to take over the session of a logged in customer
	could create tickets and/or send follow-ups to existing tickets due to
	missing challenge token checks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1471</cvename>
	<url>https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/</url>
	<url>https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/</url>
	</references>
	<dates>
	<discovery>2014-01-28</discovery>
	<entry>2014-01-28</entry>
	<modified>2014-02-06</modified>
	</dates>
	</vuln>

	<vuln vid="080c5370-886a-11e3-9533-60a44c524f57">
	<cancelled superseded="c7b5d72b-886a-11e3-9533-60a44c524f57"/>
	</vuln>

	<vuln vid="d1dfc4c7-8791-11e3-a371-6805ca0b3d42">
	<topic>rt42 -- denial-of-service attack via the email gateway</topic>
	<affects>
	<package>
	<name>rt42</name>
	<range><ge>4.2</ge><lt>4.2.1_3</lt></range>
	<range><ge>4.2.2</ge><lt>4.2.2_2</lt></range>
	</package>
	<package>
	<name>p5-Email-Address-List</name>
	<range><lt>0.02</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The RT development team reports:</p>
	<blockquote cite="http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html">
	<p>Versions of RT between 4.2.0 and 4.2.2 (inclusive) are
	vulnerable to a denial-of-service attack via the email
	gateway; any installation which accepts mail from untrusted
	sources is vulnerable, regardless of the permissions
	configuration inside RT. This vulnerability is assigned
	CVE-2014-1474.</p>
	<p>This vulnerability is caused by poor parsing performance
	in the Email::Address::List module, which RT depends on. We
	recommend that affected users upgrade their version of
	Email::Address::List to v0.02 or above, which resolves the
	issue. Due to a communications mishap, the release on CPAN
	will temporarily appear as "unauthorized," and the
	command-line cpan client will hence not install it. We
	expect this to be resolved shortly; in the meantime, the
	release is also available from our server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-1474</cvename>
	<url>http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html</url>
	</references>
	<dates>
	<discovery>2014-01-27</discovery>
	<entry>2014-01-27</entry>
	</dates>
	</vuln>

	<vuln vid="efa663eb-8754-11e3-9a47-00163e1ed244">
	<topic>strongswan -- multiple DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><lt>5.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>strongSwan Project reports:</p>
	<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html">
	<p>A DoS vulnerability triggered by crafted IKEv1 fragmentation
	payloads was discovered in strongSwan's IKE daemon charon. All
	versions since 5.0.2 are affected.</p>
	</blockquote>
	<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html">
	<p>A DoS vulnerability and potential authorization bypass triggered
	by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan.
	All versions since 4.3.3 are affected.</p>
	</blockquote>
	<blockquote cite="http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html">
	<p>A DoS vulnerability in strongSwan was discovered, which is
	triggered by XAuth usernames and EAP identities in versions
	5.0.3 and 5.0.4.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5018</cvename>
	<cvename>CVE-2013-6075</cvename>
	<cvename>CVE-2013-6076</cvename>
	<url>http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html</url>
	<url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html</url>
	<url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html</url>
	</references>
	<dates>
	<discovery>2013-11-01</discovery>
	<entry>2014-01-27</entry>
	</dates>
	</vuln>

	<vuln vid="d9dbe6e8-84da-11e3-98bd-080027f2d077">
	<topic>varnish -- DoS vulnerability in Varnish HTTP cache</topic>
	<affects>
	<package>
	<name>varnish</name>
	<range><lt>3.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Varnish Cache Project reports:</p>
	<blockquote cite="https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html">
	<p>If Varnish receives a certain illegal request, and the subroutine
	'vcl_error{}' restarts the request, the varnishd worker process
	will crash with an assert.
	</p>
	<p>The varnishd management process will restart the worker process, but
	there will be a brief interruption of service and the cache will be
	emptied, causing more traffic to go to the backend.
	</p>
	<p>We are releasing this advisory because restarting from vcl_error{} is
	both fairly common and documented.</p>
	<p>This is purely a denial of service vulnerability, there is no risk of
	privilege escalation.</p>
	<p>Workaround</p>
	<p>Insert this at the top of your VCL file:</p>
	<pre>
	sub vcl_error {
	if (obj.status == 400 \|\| obj.status == 413) {
	return(deliver);
	}
	}

	Or add this test at the top of your existing vcl_error{}.
	</pre>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4484</cvename>
	<mlist>https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html</mlist>
	</references>
	<dates>
	<discovery>2013-10-30</discovery>
	<entry>2014-01-25</entry>
	</dates>
	</vuln>

	<vuln vid="c0ef849e-84ac-11e3-bec4-9c4e36909cc0">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.335</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb14-02.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0491</cvename>
	<cvename>CVE-2014-0492</cvename>
	<url>http://helpx.adobe.com/security/products/flash-player/apsb14-02.html</url>
	</references>
	<dates>
	<discovery>2014-01-14</discovery>
	<entry>2014-01-24</entry>
	</dates>
	</vuln>

	<vuln vid="6d08fa63-83bf-11e3-bdba-080027ef73ec">
	<topic>HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes</topic>
	<affects>
	<package>
	<name>htmldoc</name>
	<range><lt>1.8.28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Sweet reports:</p>
	<blockquote cite="http://www.msweet.org/projects.php?Z1">
	<p>HTMLDOC 1.8.28 fixes some known security issues and
	formatting bugs. Changes include:</p>
	<ul>
	<li>SECURITY: Fixed three buffer overflow issues when
	reading AFM files and parsing page sizes.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.msweet.org/projects.php?Z1</url>
	</references>
	<dates>
	<discovery>2014-01-06</discovery>
	<entry>2014-01-22</entry>
	<modified>2014-01-23</modified>
	</dates>
	</vuln>

	<vuln vid="81f1fdc2-7ec7-11e3-a6c6-00163e1ed244">
	<topic>virtualbox-ose -- local vulnerability</topic>
	<affects>
	<package>
	<name>virtualbox-ose</name>
	<range><lt>4.2.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html">
	<p>Unspecified vulnerability in the Oracle VM VirtualBox
	component in Oracle Virtualization VirtualBox prior to
	3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local
	users to affect confidentiality, integrity, and availability
	via unknown vectors related to Core.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5892</cvename>
	<url>http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</url>
	</references>
	<dates>
	<discovery>2014-01-15</discovery>
	<entry>2014-01-16</entry>
	</dates>
	</vuln>

	<vuln vid="3d95c9a7-7d5c-11e3-a8c1-206a8a720317">
	<topic>ntpd DRDoS / Amplification Attack using ntpdc monlist command</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.7p26</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_14</lt></range>
	<range><ge>8.4</ge><lt>8.4_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_10</lt></range>
	<range><ge>9.2</ge><lt>9.2_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ntp.org reports:</p>
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using">
	<p>Unrestricted access to the monlist feature in
	ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote
	attackers to cause a denial of service (traffic
	amplification) via forged (1) REQ_MON_GETLIST or (2)
	REQ_MON_GETLIST_1 requests, as exploited in the wild in
	December 2013</p>
	<p>Use noquery to your default restrictions to block all
	status queries.</p>
	<p>Use disable monitor to disable the ``ntpdc -c monlist''
	command while still allowing other status queries.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5211</cvename>
	<freebsdsa>SA-14:02.ntpd</freebsdsa>
	<url>http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using</url>
	</references>
	<dates>
	<discovery>2014-01-01</discovery>
	<entry>2014-01-14</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="ba04a373-7d20-11e3-8992-00132034b086">
	<topic>nagios -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>nagios</name>
	<range><lt>3.5.1_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Eric Stanley reports:</p>
	<blockquote cite="http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/">
	<p>Most CGIs previously incremented the input variable counter twice
	when it encountered a long key value. This could cause the CGI to
	read past the end of the list of CGI variables.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-7108</cvename>
	<cvename>CVE-2013-7205</cvename>
	<url>http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1046113</url>
	</references>
	<dates>
	<discovery>2013-12-20</discovery>
	<entry>2014-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="cb252f01-7c43-11e3-b0a6-005056a37f68">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.4.2</lt></range>
	</package>
	<package>
	<name>bind99-base</name>
	<range><lt>9.9.4.2</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.6.2</lt></range>
	</package>
	<package>
	<name>bind98-base</name>
	<range><lt>9.8.6.2</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.2.ESV.R10.2</lt></range>
	</package>
	<package>
	<name>bind96-base</name>
	<range><lt>9.6.3.2.ESV.R10.2</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.2</ge><lt>9.2_3</lt></range>
	<range><ge>9.1</ge><lt>9.1_10</lt></range>
	<range><ge>8.4</ge><lt>8.4_7</lt></range>
	<range><ge>8.3</ge><lt>8.3_14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01078/74/">
	<p>Because of a defect in handling queries for NSEC3-signed zones,
	BIND can crash with an "INSIST" failure in name.c when processing
	queries possessing certain properties. By exploiting this defect
	an attacker deliberately constructing a query with the right
	properties could achieve denial of service against an authoritative
	nameserver serving NSEC3-signed zones.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2014-0591</cvename>
	<freebsdsa>SA-14:04.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-01078/74/</url>
	</references>
	<dates>
	<discovery>2014-01-08</discovery>
	<entry>2014-01-13</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="28c575fa-784e-11e3-8249-001cc0380077">
	<topic>libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont</topic>
	<affects>
	<package>
	<name>libXfont</name>
	<range><lt>1.4.7,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>freedesktop.org reports:</p>
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-January/002389.html">
	<p>A BDF font file containing a longer than expected string can cause
	a buffer overflow on the stack. Testing in X servers built with
	Stack Protector restulted in an immediate crash when reading a
	user-proveded specially crafted font.</p>
	<p>As libXfont is used to read user-specified font files in all X
	servers distributed by X.Org, including the Xorg server which is
	often run with root privileges or as setuid-root in order to access
	hardware, this bug may lead to an unprivileged user acquiring root
	privileges in some systems.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6462</cvename>
	<url>http://lists.x.org/archives/xorg-announce/2014-January/002389.html</url>
	</references>
	<dates>
	<discovery>2013-12-24</discovery>
	<entry>2014-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="5aaa257e-772d-11e3-a65a-3c970e169bc2">
	<topic>openssl -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.1_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL development team reports:</p>
	<blockquote cite="http://www.openssl.org/news/openssl-1.0.1-notes.html">
	<p>Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:</p>
	<ul>
	<li>Fix for TLS record tampering bug [CVE-2013-4353]</li>
	<li>Fix for TLS version checking bug [CVE-2013-6449]</li>
	<li>Fix for DTLS retransmission bug [CVE-2013-6450]</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-14:03.openssl</freebsdsa>
	<cvename>CVE-2013-4353</cvename>
	<cvename>CVE-2013-6449</cvename>
	<cvename>CVE-2013-6450</cvename>
	<url>http://www.openssl.org/news/openssl-1.0.1-notes.html</url>
	</references>
	<dates>
	<discovery>2014-01-06</discovery>
	<entry>2014-01-06</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="3e33a0bb-6b2f-11e3-b042-20cf30e32f6d">
	<topic>OpenX -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>openx</name>
	<range><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Revive reports:</p>
	<blockquote cite="http://www.revive-adserver.com/security/revive-sa-2013-001/">
	<p>An SQL-injection vulnerability was recently discovered and reported
	to the Revive Adserver team by Florian Sander. The vulnerability is
	known to be already exploited to gain unauthorised access to the
	application using brute force mechanisms, however other kind of
	attacks might be possible and/or already in use. The risk is rated
	to be critical as the most common end goal of the attackers is to
	spread malware to the visitors of all the websites and ad networks
	that the ad server is being used on.</p>
	<p>The vulnerability is also present and exploitable in OpenX Source
	2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.revive-adserver.com/security/revive-sa-2013-001/</url>
	<url>http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/</url>
	<cvename>CVE-2013-7149</cvename>
	</references>
	<dates>
	<discovery>2013-12-20</discovery>
	<entry>2013-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="4e1f4abc-6837-11e3-9cda-3c970e169bc2">
	<topic>cURL library -- cert name check ignore with GnuTLS</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.21.4</ge><lt>7.33.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL project reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20131217.html">
	<p>libcurl is vulnerable to a case of missing out the checking
	of the certificate CN or SAN name field when the digital
	signature verification is turned off.</p>
	<p>libcurl offers two separate and independent options for
	verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER
	and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to
	verify the trust chain using a CA cert bundle, while the
	second tells libcurl to make sure that the name fields in
	the server certificate meets the criteria. Both options are
	enabled by default.</p>
	<p>This flaw had the effect that when an application disabled
	CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the
	CURLOPT_SSL_VERIFYHOST check. Applications can disable
	CURLOPT_SSL_VERIFYPEER and still achieve security by doing
	the check on its own using other means.</p>
	<p>The curl command line tool is not affected by this problem
	as it either enables both options or disables both at the
	same time.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://curl.haxx.se/docs/adv_20131217.html</url>
	<cvename>CVE-2013-6422</cvename>
	</references>
	<dates>
	<discovery>2013-12-17</discovery>
	<entry>2013-12-18</entry>
	</dates>
	</vuln>

	<vuln vid="2e5715f8-67f7-11e3-9811-b499baab0cbe">
	<topic>gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack</topic>
	<affects>
	<package>
	<name>gnupg</name>
	<range><lt>1.4.16</lt></range>
	</package>
	<package>
	<name>gnupg1</name>
	<range><lt>1.4.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html">
	<p>CVE-2013-4576 has been assigned to this security bug.</p>
	<p>The paper describes two attacks. The first attack allows
	to distinguish keys: An attacker is able to notice which key is
	currently used for decryption. This is in general not a problem but
	may be used to reveal the information that a message, encrypted to a
	commonly not used key, has been received by the targeted machine. We
	do not have a software solution to mitigate this attack.</p>
	<p>The second attack is more serious. It is an adaptive
	chosen ciphertext attack to reveal the private key. A possible
	scenario is that the attacker places a sensor (for example a standard
	smartphone) in the vicinity of the targeted machine. That machine is
	assumed to do unattended RSA decryption of received mails, for example
	by using a mail client which speeds up browsing by opportunistically
	decrypting mails expected to be read soon. While listening to the
	acoustic emanations of the targeted machine, the smartphone will send
	new encrypted messages to that machine and re-construct the private
	key bit by bit. A 4096 bit RSA key used on a laptop can be revealed
	within an hour.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4576</cvename>
	<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html</url>
	</references>
	<dates>
	<discovery>2013-12-18</discovery>
	<entry>2013-12-18</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="0c39bafc-6771-11e3-868f-0025905a4771">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk10</name>
	<range><lt>10.12.4</lt></range>
	</package>
	<package>
	<name>asterisk11</name>
	<range><lt>11.6.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><lt>1.8.24.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>A 16 bit SMS message that contains an odd message length value will
	cause the message decoding loop to run forever. The message buffer is
	not on the stack but will be overflowed resulting in corrupted memory
	and an immediate crash.</p>
	<p>External control protocols, such as the Asterisk Manager Interface,
	often have the ability to get and set channel variables; this allows
	the execution of dialplan functions. Dialplan functions within
	Asterisk are incredibly powerful, which is wonderful for building
	applications using Asterisk. But during the read or write execution,
	certain diaplan functions do much more. For example, reading the SHELL()
	function can execute arbitrary commands on the system Asterisk is
	running on. Writing to the FILE() function can change any file that
	Asterisk has write access to. When these functions are executed from an
	external protocol, that execution could result in a privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-7100</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-006.pdf</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-007.pdf</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2013-12-16</discovery>
	<entry>2013-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="3b86583a-66a7-11e3-868f-0025905a4771">
	<topic>phpmyfaq -- arbitrary PHP code execution vulnerability</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><lt>2.8.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyFAQ team reports:</p>
	<blockquote cite="http://www.phpmyfaq.de/advisory_2013-11-26.php">
	<p>Secunia noticed while analysing the advisory that authenticated
	users with "Right to add attachments" are able to exploit an already
	publicly known issue in the bundled Ajax File Manager of phpMyFAQ version
	2.8.3, which leads to arbitrary PHP code execution for authenticated
	users with the permission "Right to add attachments".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://en.securitylab.ru/lab/PT-2013-41</url>
	<url>http://www.phpmyfaq.de/advisory_2013-11-26.php</url>
	</references>
	<dates>
	<discovery>2013-11-26</discovery>
	<entry>2013-12-16</entry>
	<modified>2013-12-17</modified>
	</dates>
	</vuln>

	<vuln vid="44d0f8dc-6607-11e3-bb11-0025900931f8">
	<topic>zabbix -- shell command injection vulnerability</topic>
	<affects>
	<package>
	<name>zabbix2-agent</name>
	<range><lt>2.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Recurity Labs Team project reports:</p>
	<blockquote cite="https://support.zabbix.com/browse/ZBX-7479">
	<p>Zabbix agent is vulnerable to remote command execution
	from the Zabbix server in some cases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6824</cvename>
	<url>https://support.zabbix.com/browse/ZBX-7479</url>
	</references>
	<dates>
	<discovery>2013-12-03</discovery>
	<entry>2013-12-16</entry>
	</dates>
	</vuln>

	<vuln vid="47b4e713-6513-11e3-868f-0025905a4771">
	<topic>PHP5 -- memory corruption in openssl_x509_parse()</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><ge>5.4.0</ge><lt>5.4.23</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.28</lt></range>
	</package>
	<package>
	<name>php55</name>
	<range><ge>5.5.0</ge><lt>5.5.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html">
	<p>The PHP function openssl_x509_parse() uses a helper function
	called asn1_time_to_time_t() to convert timestamps from ASN1
	string format into integer timestamp values. The parser within
	this helper function is not binary safe and can therefore be
	tricked to write up to five NUL bytes outside of an allocated
	buffer.</p>
	<p>This problem can be triggered by x509 certificates that contain
	NUL bytes in their notBefore and notAfter timestamp fields and
	leads to a memory corruption that might result in arbitrary
	code execution.</p>
	<p>Depending on how openssl_x509_parse() is used within a PHP
	application the attack requires either a malicious cert signed
	by a compromised/malicious CA or can be carried out with a
	self-signed cert.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6420</cvename>
	<url>https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html</url>
	</references>
	<dates>
	<discovery>2013-12-13</discovery>
	<entry>2013-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="dd116b19-64b3-11e3-868f-0025905a4771">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>25.0,1</gt><lt>26.0,1</lt></range>
	<range><lt>24.2.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>26.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.23</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.2.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.23</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-116 JPEG information leak</p>
	<p>MFSA 2013-105 Application Installation doorhanger persists on
	navigation</p>
	<p>MFSA 2013-106 Character encoding cross-origin XSS attack</p>
	<p>MFSA 2013-107 Sandbox restrictions not applied to nested object
	elements</p>
	<p>MFSA 2013-108 Use-after-free in event listeners</p>
	<p>MFSA 2013-109 Use-after-free during Table Editing</p>
	<p>MFSA 2013-110 Potential overflow in JavaScript binary search
	algorithms</p>
	<p>MFSA 2013-111 Segmentation violation when replacing ordered list
	elements</p>
	<p>MFSA 2013-112 Linux clipboard information disclosure though
	selection paste</p>
	<p>MFSA 2013-113 Trust settings for built-in roots ignored during EV
	certificate validation</p>
	<p>MFSA 2013-114 Use-after-free in synthetic mouse movement</p>
	<p>MFSA 2013-115 GetElementIC typed array stubs can be generated
	outside observed typesets</p>
	<p>MFSA 2013-116 JPEG information leak</p>
	<p>MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5609</cvename>
	<cvename>CVE-2013-5610</cvename>
	<cvename>CVE-2013-5611</cvename>
	<cvename>CVE-2013-5612</cvename>
	<cvename>CVE-2013-5613</cvename>
	<cvename>CVE-2013-5614</cvename>
	<cvename>CVE-2013-5615</cvename>
	<cvename>CVE-2013-5616</cvename>
	<cvename>CVE-2013-5618</cvename>
	<cvename>CVE-2013-5619</cvename>
	<cvename>CVE-2013-6629</cvename>
	<cvename>CVE-2013-6630</cvename>
	<cvename>CVE-2013-6671</cvename>
	<cvename>CVE-2013-6672</cvename>
	<cvename>CVE-2013-6673</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-104.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-105.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-106.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-107.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-108.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-109.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-110.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-111.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-112.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-113.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-114.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-115.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-116.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-117.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-12-09</discovery>
	<entry>2013-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="613e45d1-6154-11e3-9b62-000c292e4fd8">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.22</lt></range>
	</package>
	<package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba project reports:</p>
	<blockquote cite="http://www.samba.org/samba/latest_news.html#4.1.3">
	<p>These are security releases in order to address CVE-2013-4408
	(DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150
	(pam_winbind login without require_membership_of restrictions).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-6150</cvename>
	<cvename>CVE-2013-4408</cvename>
	<url>http://www.samba.org/samba/security/CVE-2012-6150</url>
	<url>http://www.samba.org/samba/security/CVE-2013-4408</url>
	</references>
	<dates>
	<discovery>2012-06-12</discovery>
	<entry>2013-12-11</entry>
	</dates>
	</vuln>

	<vuln vid="6a806960-3016-44ed-8575-8614a7cb57c7">
	<topic>rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-actionmailer</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-activemodel</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-activeresource</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-railties</name>
	<range><lt>3.2.16</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack4</name>
	<range><lt>4.0.2</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport4</name>
	<range><lt>4.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rails weblog:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/">
	<p>Rails 3.2.16 and 4.0.2 have been released! These two
	releases contain important security fixes, so please upgrade
	as soon as possible! In order to make upgrading as smooth as
	possible, we've only included commits directly related to
	each security issue.</p>
	<p>The security fixes in 3.2.16 are:</p>
	<ul>
	<li>CVE-2013-4491</li>
	<li>CVE-2013-6414</li>
	<li>CVE-2013-6415</li>
	<li>CVE-2013-6417</li>
	</ul>
	<p>The security fixes in 4.0.2 are:</p>
	<ul>
	<li>CVE-2013-4491</li>
	<li>CVE-2013-6414</li>
	<li>CVE-2013-6415</li>
	<li>CVE-2013-6416</li>
	<li>CVE-2013-6417</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4491</cvename>
	<cvename>CVE-2013-6414</cvename>
	<cvename>CVE-2013-6415</cvename>
	<cvename>CVE-2013-6416</cvename>
	<cvename>CVE-2013-6417</cvename>
	<url>http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/</url>
	</references>
	<dates>
	<discovery>2013-12-03</discovery>
	<entry>2013-12-08</entry>
	<modified>2014-04-23</modified>
	</dates>
	</vuln>

	<vuln vid="d9649816-5e0d-11e3-8d23-3c970e169bc2">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.29</lt></range>
	</package>
	<package>
	<name>drupal7</name>
	<range><lt>7.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://drupal.org/SA-CORE-2013-003">
	<p>Multiple vulnerabilities were fixed in the supported Drupal
	core versions 6 and 7.</p>
	<ul>
	<li>Multiple vulnerabilities due to optimistic cross-site
	request forgery protection (Form API validation - Drupal 6
	and 7)</li>
	<li>Multiple vulnerabilities due to weakness in pseudorandom
	number generation using mt_rand() (Form API, OpenID and
	random password generation - Drupal 6 and 7)</li>
	<li>Code execution prevention (Files directory .htaccess for
	Apache - Drupal 6 and 7)</li>
	<li>Access bypass (Security token validation - Drupal 6 and 7)</li>
	<li>Cross-site scripting (Image module - Drupal 7)</li>
	<li>Cross-site scripting (Color module - Drupal 7)</li>
	<li>Open redirect (Overlay module - Drupal 7)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://drupal.org/SA-CORE-2013-003</url>
	</references>
	<dates>
	<discovery>2013-11-20</discovery>
	<entry>2013-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="4158c57e-5d39-11e3-bc1e-6cf0490a8c18">
	<topic>Joomla! -- Core XSS Vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla2</name>
	<range><ge>2.5.*</ge><le>2.5.14</le></range>
	</package>
	<package>
	<name>joomla3</name>
	<range><ge>3.0.*</ge><le>3.1.5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security/570-core-xss-20131101.html">
	<h2>[20131101] Core XSS Vulnerability</h2>
	<p>Inadequate filtering leads to XSS vulnerability in com_contact.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/571-core-xss-20131102.html">
	<h2>[20131102] Core XSS Vulnerability</h2>
	<p>Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/572-core-xss-20131103.html">
	<h2>[20131103] Core XSS Vulnerability</h2>
	<p>Inadequate filtering leads to XSS vulnerability in com_contact.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://developer.joomla.org/security/570-core-xss-20131101.html</url>
	<url>http://developer.joomla.org/security/571-core-xss-20131102.html</url>
	<url>http://developer.joomla.org/security/572-core-xss-20131103.html</url>
	</references>
	<dates>
	<discovery>2013-11-01</discovery>
	<entry>2013-12-04</entry>
	<modified>2014-04-23</modified>
	</dates>
	</vuln>

	<vuln vid="d2073237-5b52-11e3-80f7-c86000cbc6ec">
	<topic>OpenTTD -- Denial of service using forcefully crashed aircrafts</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>0.3.6</ge><lt>1.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="https://security.openttd.org/en/CVE-2013-6411">
	<p>The problem is caused by incorrectly handling the fact that
	the aircraft circling the corner airport will be outside of the
	bounds of the map. In the 'out of fuel' crash code the height
	of the tile under the aircraft is determined. In this case
	that means a tile outside of the allocated map array, which
	could occasionally trigger invalid reads.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6411</cvename>
	<url>https://security.openttd.org/en/CVE-2013-6411</url>
	<url>http://bugs.openttd.org/task/5820</url>
	<url>http://vcs.openttd.org/svn/changeset/26134</url>
	</references>
	<dates>
	<discovery>2013-11-28</discovery>
	<entry>2013-11-28</entry>
	</dates>
	</vuln>

	<vuln vid="620cf713-5a99-11e3-878d-20cf30e32f6d">
	<topic>monitorix -- serious bug in the built-in HTTP server</topic>
	<affects>
	<package>
	<name>monitorix</name>
	<range><lt>3.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Monitorix Project reports:</p>
	<blockquote cite="http://www.monitorix.org/news.html#N331">
	<p>A serious bug in the built-in HTTP server. It was discovered that the
	handle_request() routine did not properly perform input sanitization
	which led into a number of security vulnerabilities. An unauthenticated,
	remote attacker could exploit this flaw to execute arbitrary commands on
	the remote host. All users still using older versions are advised to
	upgrade to this version, which resolves this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.monitorix.org/news.html#N331</url>
	<url>https://github.com/mikaku/Monitorix/issues/30</url>
	</references>
	<dates>
	<discovery>2013-11-21</discovery>
	<entry>2013-12-01</entry>
	</dates>
	</vuln>

	<vuln vid="e3244a7b-5603-11e3-878d-20cf30e32f6d">
	<topic>subversion -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.4.0</ge><lt>1.7.14</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/">
	<p>mod_dontdothat does not restrict requests from serf based clients</p>
	<p>mod_dontdothat allows you to block update REPORT requests against certain
	paths in the repository. It expects the paths in the REPORT request
	to be absolute URLs. Serf based clients send relative URLs instead
	of absolute URLs in many cases. As a result these clients are not blocked
	as configured by mod_dontdothat.</p>
	<p>mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits</p>
	<p>When SVNAutoversioning is enabled via SVNAutoversioning on
	commits can be made by single HTTP requests such as MKCOL and
	PUT. If Subversion is built with assertions enabled any such
	requests that have non-canonical URLs, such as URLs with a
	trailing /, may trigger an assert. An assert will cause the
	Apache process to abort.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4505</cvename>
	<cvename>CVE-2013-4558</cvename>
	<url>http://subversion.apache.org/security/CVE-2013-4505-advisory.txt</url>
	<url>http://subversion.apache.org/security/CVE-2013-4558-advisory.txt</url>
	</references>
	<dates>
	<discovery>2013-11-15</discovery>
	<entry>2013-11-25</entry>
	</dates>
	</vuln>

	<vuln vid="742eb9e4-e3cb-4f5a-b94e-0e9a39420600">
	<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
	<affects>
	<package>
	<name>ruby19-gems</name>
	<range><lt>1.8.27</lt></range>
	</package>
	<package>
	<name>ruby20-gems</name>
	<range><lt>1.8.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Gem developers report:</p>
	<blockquote cite="http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html">
	<p>The patch for CVE-2013-4363 was insufficiently verified so the
	combined regular expression for verifying gem version remains
	vulnerable following CVE-2013-4363.</p>
	<p>RubyGems validates versions with a regular expression that is
	vulnerable to denial of service due to backtracking. For specially
	crafted RubyGems versions attackers can cause denial of service
	through CPU consumption.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4363</cvename>
	</references>
	<dates>
	<discovery>2013-09-24</discovery>
	<entry>2013-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="54237182-9635-4a8b-92d7-33bfaeed84cd">
	<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
	<affects>
	<package>
	<name>ruby19-gems</name>
	<range><lt>1.8.26</lt></range>
	</package>
	<package>
	<name>ruby20-gems</name>
	<range><lt>1.8.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Gem developers report:</p>
	<blockquote cite="http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html">
	<p>RubyGems validates versions with a regular expression that is
	vulnerable to denial of service due to backtracking. For specially
	crafted RubyGems versions attackers can cause denial of service
	through CPU consumption.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4287</cvename>
	</references>
	<dates>
	<discovery>2013-09-09</discovery>
	<entry>2013-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="cc9043cf-7f7a-426e-b2cc-8d1980618113">
	<topic>ruby -- Heap Overflow in Floating Point Parsing</topic>
	<affects>
	<package>
	<name>ruby19</name>
	<range><lt>1.9.3.484,1</lt></range>
	</package>
	<package>
	<name>ruby20</name>
	<range><lt>2.0.0.353,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby developers report:</p>
	<blockquote cite="https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/">
	<p>Any time a string is converted to a floating point value, a
	specially crafted string can cause a heap overflow. This can lead
	to a denial of service attack via segmentation faults and possibly
	arbitrary code execution. Any program that converts input of
	unknown origin to floating point values (especially common when
	accepting JSON) are vulnerable.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/</url>
	<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/</url>
	<cvename>CVE-2013-4164</cvename>
	</references>
	<dates>
	<discovery>2013-11-22</discovery>
	<entry>2013-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="479efd57-516e-11e3-9b62-000c292e4fd8">
	<topic>samba -- Private key in key.pem world readable</topic>
	<affects>
	<package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba project reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4476">
	<p>Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is
	provided over SSL, uses world-readable permissions for a private key,
	which allows local users to obtain sensitive information by reading the
	key file, as demonstrated by access to the local filesystem on an AD
	domain controller.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4476</cvename>
	<url>http://www.samba.org/samba/security/CVE-2013-4476</url>
	</references>
	<dates>
	<discovery>2013-06-12</discovery>
	<entry>2013-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="a4f08579-516c-11e3-9b62-000c292e4fd8">
	<topic>samba -- ACLs are not checked on opening an alternate data stream on a file or directory</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.20</lt></range>
	</package>
	<package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
	</package>
	<package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba project reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4475">
	<p>Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
	3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
	file or directory ACL when opening an alternate data stream.</p>
	<p>According to the SMB1 and SMB2+ protocols the ACL on an underlying
	file or directory should control what access is allowed to alternate
	data streams that are associated with the file or directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4475</cvename>
	<url>http://www.samba.org/samba/security/CVE-2013-4475</url>
	</references>
	<dates>
	<discovery>2013-06-12</discovery>
	<entry>2013-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="94b6264a-5140-11e3-8b22-f0def16c5c1b">
	<topic>nginx -- Request line parsing vulnerability</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><ge>0.8.41</ge><lt>1.4.4,1</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><ge>0.8.41</ge><lt>1.5.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html">
	<p>Ivan Fratric of the Google Security Team discovered a bug in nginx, which might
	allow an attacker to bypass security restrictions in certain configurations by
	using a specially crafted request, or might have potential other impact
	(CVE-2013-4547).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4547</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url>
	</references>
	<dates>
	<discovery>2013-11-19</discovery>
	<entry>2013-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="adcbdba2-4c27-11e3-9848-98fc11cdc4f5">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.327</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-26.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5329</cvename>
	<cvename>CVE-2013-5330</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb13-26.html</url>
	</references>
	<dates>
	<discovery>2013-11-12</discovery>
	<entry>2013-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="5709d244-4873-11e3-8a46-000d601460a4">
	<topic>OpenSSH -- Memory corruption in sshd</topic>
	<affects>
	<package>
	<name>openssh-portable</name>
	<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
	</package>
	<package>
	<name>openssh-portable-base</name>
	<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSH development team reports:</p>
	<blockquote cite="http://www.openssh.com/txt/gcmrekey.adv">
	<p>A memory corruption vulnerability exists in the post-
	authentication sshd process when an AES-GCM cipher
	(aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
	selected during kex exchange.</p>
	<p>If exploited, this vulnerability might permit code execution
	with the privileges of the authenticated user and may
	therefore allow bypassing restricted shell/command
	configurations.</p>
	<p>Either upgrade to 6.4 or disable AES-GCM in the server
	configuration. The following sshd_config option will disable
	AES-GCM while leaving other ciphers active:</p>
	<p>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openssh.com/txt/gcmrekey.adv</url>
	</references>
	<dates>
	<discovery>2013-11-07</discovery>
	<entry>2013-11-08</entry>
	<modified>2013-11-13</modified>
	</dates>
	</vuln>

	<vuln vid="f969bad7-46fc-11e3-b6ee-00269ee29e57">
	<topic>Quassel IRC -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>quassel</name>
	<range><lt>0.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Quassel IRC developers report:</p>
	<blockquote cite="http://www.quassel-irc.org/node/120">
	<p>SQL injection vulnerability in Quassel IRC before 0.9.1,
	when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used,
	allows remote attackers to execute arbitrary SQL commands via
	a \ (backslash) in a message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4422</cvename>
	</references>
	<dates>
	<discovery>2013-10-07</discovery>
	<entry>2013-11-06</entry>
	</dates>
	</vuln>

	<vuln vid="81f866ad-41a4-11e3-a4af-0025905a4771">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>24.1.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>25.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.22</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>24.1.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.22</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.1.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p> MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 /
	rv:24.1 / rv:17.0.10)</p>
	<p> MFSA 2013-94 Spoofing addressbar though SELECT element</p>
	<p> MFSA 2013-95 Access violation with XSLT and uninitialized data</p>
	<p> MFSA 2013-96 Improperly initialized memory and overflows in some
	JavaScript functions</p>
	<p> MFSA 2013-97 Writing to cycle collected object during image
	decoding</p>
	<p> MFSA 2013-98 Use-after-free when updating offline cache</p>
	<p> MFSA 2013-99 Security bypass of PDF.js checks using iframes</p>
	<p> MFSA 2013-100 Miscellaneous use-after-free issues found through
	ASAN fuzzing</p>
	<p> MFSA 2013-101 Memory corruption in workers</p>
	<p> MFSA 2013-102 Use-after-free in HTML document templates</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1739</cvename>
	<cvename>CVE-2013-5590</cvename>
	<cvename>CVE-2013-5591</cvename>
	<cvename>CVE-2013-5592</cvename>
	<cvename>CVE-2013-5593</cvename>
	<cvename>CVE-2013-5595</cvename>
	<cvename>CVE-2013-5596</cvename>
	<cvename>CVE-2013-5597</cvename>
	<cvename>CVE-2013-5598</cvename>
	<cvename>CVE-2013-5599</cvename>
	<cvename>CVE-2013-5600</cvename>
	<cvename>CVE-2013-5601</cvename>
	<cvename>CVE-2013-5602</cvename>
	<cvename>CVE-2013-5603</cvename>
	<cvename>CVE-2013-5604</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-93.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-94.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-95.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-96.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-97.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-98.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-99.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-100.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-101.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-102.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-10-29</discovery>
	<entry>2013-10-30</entry>
	<modified>2013-10-31</modified>
	</dates>
	</vuln>

	<vuln vid="4e23644c-cb93-4f83-9e20-5bc07ad9b39f">
	<topic>mod_pagespeed -- critical cross-site scripting (XSS) vulnerability</topic>
	<affects>
	<package>
	<name>mod_pagespeed</name>
	<range><lt>1.2.24.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mod_pagespeed developers report:</p>
	<blockquote cite="https://groups.google.com/forum/#!msg/mod-pagespeed-announce/oo015UHRxMc/JcAuf1hE8L8J">
	<p>Various versions of mod_pagespeed are subject to critical
	cross-site scripting (XSS) vulnerability, CVE-2013-6111. This
	permits a hostile third party to execute JavaScript in users'
	browsers in context of the domain running mod_pagespeed, which
	could permit theft of users' cookies or data on the site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-6111</cvename>
	</references>
	<dates>
	<discovery>2013-10-04</discovery>
	<entry>2013-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="cd082cc6-1548-4b8d-a3aa-a007be611a29">
	<cancelled/>
	</vuln>

	<vuln vid="9065b930-3d8b-11e3-bd1a-e840f2096bd0">
	<topic>gnutls -- denial of service</topic>
	<affects>
	<package>
	<name>gnutls3</name>
	<range><lt>3.1.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Salvatore Bonaccorso reports:</p>
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2013-3">
	<p>This vulnerability affects the DANE library of gnutls 3.1.x and
	gnutls 3.2.x. A server that returns more 4 DANE entries could
	corrupt the memory of a requesting client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4466</cvename>
	<url>http://www.gnutls.org/security.html#GNUTLS-SA-2013-3</url>
	</references>
	<dates>
	<discovery>2013-10-25</discovery>
	<entry>2013-10-25</entry>
	<modified>2013-11-01</modified>
	</dates>
	</vuln>

	<vuln vid="9a57c607-3cab-11e3-b4d9-bcaec565249c">
	<topic>xorg-server -- use-after-free</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><ge>1.7.0</ge><lt>1.7.7_11</lt></range>
	<range><ge>1.12.0</ge><lt>1.12.4_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alan Coopersmith reports:</p>
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2013-October/002332.html">
	<p>Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org
	security team in which an authenticated X client can cause an X
	server to use memory after it was freed, potentially leading to
	crash and/or memory corruption.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4396</cvename>
	<url>http://lists.x.org/archives/xorg-announce/2013-October/002332.html</url>
	</references>
	<dates>
	<discovery>2013-10-08</discovery>
	<entry>2013-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="c0f122e2-3897-11e3-a084-3c970e169bc2">
	<topic>pycrypto -- PRNG reseed race condition</topic>
	<affects>
	<package>
	<name>py26-pycrypto</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>py27-pycrypto</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>py31-pycrypto</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>py32-pycrypto</name>
	<range><lt>2.6.1</lt></range>
	</package>
	<package>
	<name>py33-pycrypto</name>
	<range><lt>2.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dwayne Litzenberger reports:</p>
	<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html">
	<p>In PyCrypto before v2.6.1, the Crypto.Random pseudo-random
	number generator (PRNG) exhibits a race condition that may cause
	it to generate the same 'random' output in multiple processes that
	are forked from each other. Depending on the application, this
	could reveal sensitive information or cryptographic keys to remote
	attackers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1445</cvename>
	<url>http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html</url>
	</references>
	<dates>
	<discovery>2013-10-17</discovery>
	<entry>2013-10-19</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="043d3a78-f245-4938-9bc7-3d0d35dd94bf">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>3.6.1</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.6.1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>3.6.1</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>3.6.1</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>3.6.1</lt></range>
	</package>
	<package>
	<name>wordpress</name>
	<range><lt>3.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The wordpress development team reports:</p>
	<blockquote cite="http://wordpress.org/news/2013/09/wordpress-3-6-1/">
	<ul>
	<li>Block unsafe PHP unserialization that could occur in limited
	situations and setups, which can lead to remote code
	execution.</li>
	<li>Prevent a user with an Author role, using a specially crafted
	request, from being able to create a post "written by" another
	user.</li>
	<li>Fix insufficient input validation that could result in
	redirecting or leading a user to another website.</li>
	</ul>
	<p>Additionally, we've adjusted security restrictions around file
	uploads to mitigate the potential for cross-site scripting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4338</cvename>
	<cvename>CVE-2013-4339</cvename>
	<cvename>CVE-2013-4340</cvename>
	<cvename>CVE-2013-5738</cvename>
	<cvename>CVE-2013-5739</cvename>
	<url>http://wordpress.org/news/2013/09/wordpress-3-6-1/</url>
	</references>
	<dates>
	<discovery>2013-09-11</discovery>
	<entry>2013-10-19</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="206f9826-a06d-4927-9a85-771c37010b32">
	<topic>node.js -- DoS Vulnerability</topic>
	<affects>
	<package>
	<name>node</name>
	<range><lt>0.10.21</lt></range>
	</package>
	<package>
	<name>node-devel</name>
	<range><lt>0.11.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>node.js developers report</p>
	<blockquote cite="http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/">
	<p>This release contains a security fix for the http server implementation, please upgrade as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url>
	</references>
	<dates>
	<discovery>2013-10-19</discovery>
	<entry>2013-10-19</entry>
	</dates>
	</vuln>

	<vuln vid="e135f0c9-375f-11e3-80b7-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
	</package>
	<package>
	<name>bugzilla40</name>
	<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
	</package>
	<package>
	<name>bugzilla42</name>
	<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
	</package>
	<package>
	<name>bugzilla44</name>
	<range><ge>4.4</ge><lt>4.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.10/">
	<h1>Cross-Site Request Forgery</h1>
	<p>When a user submits changes to a bug right after another
	user did, a midair collision page is displayed to inform
	the user about changes recently made. This page contains
	a token which can be used to validate the changes if the
	user decides to submit his changes anyway. A regression
	in Bugzilla 4.4 caused this token to be recreated if a
	crafted URL was given, even when no midair collision page
	was going to be displayed, allowing an attacker to bypass
	the token check and abuse a user to commit changes on his
	behalf.</p>
	<h1>Cross-Site Request Forgery</h1>
	<p>When an attachment is edited, a token is generated to
	validate changes made by the user. Using a crafted URL,
	an attacker could force the token to be recreated,
	allowing him to bypass the token check and abuse a user
	to commit changes on his behalf.</p>
	<h1>Cross-Site Scripting</h1>
	<p>Some parameters passed to editflagtypes.cgi were not
	correctly filtered in the HTML page, which could lead
	to XSS.</p>
	<h1>Cross-Site Scripting</h1>
	<p>Due to an incomplete fix for CVE-2012-4189, some
	incorrectly filtered field values in tabular reports
	could lead to XSS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1733</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=911593</url>
	<cvename>CVE-2013-1734</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=913904</url>
	<cvename>CVE-2013-1742</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924802</url>
	<cvename>CVE-2013-1743</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924932</url>
	</references>
	<dates>
	<discovery>2013-10-16</discovery>
	<entry>2013-10-17</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="8c9b48d1-3715-11e3-a624-00262d8b701d">
	<topic>dropbear -- exposure of sensitive information, DoS</topic>
	<affects>
	<package>
	<name>dropbear</name>
	<range><ge>2012.55</ge><lt>2013.59</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Dropbear project reports:</p>
	<blockquote cite="http://secunia.com/advisories/55173/">
	<p>A weakness and a vulnerability have been reported in Dropbear
	SSH Server, which can be exploited by malicious people to disclose
	certain sensitive information and cause a DoS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>62958</bid>
	<bid>62993</bid>
	<cvename>CVE-2013-4421</cvename>
	<cvename>CVE-2013-4434</cvename>
	<url>http://secunia.com/advisories/55173</url>
	</references>
	<dates>
	<discovery>2013-05-08</discovery>
	<!-- discovery>2013-10-03</discovery -->
	<entry>2013-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="9003b500-31e3-11e3-b0d0-20cf30e32f6d">
	<topic>mod_fcgid -- possible heap buffer overwrite</topic>
	<affects>
	<package>
	<name>ap22-mod_fcgid</name>
	<range><lt>2.3.9</lt></range>
	</package>
	<package>
	<name>ap24-mod_fcgid</name>
	<range><lt>2.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Project reports:</p>
	<blockquote cite="https://mail-archives.apache.org/mod_mbox/httpd-cvs/201309.mbox/%3C20130929174048.13B962388831@eris.apache.org%3E">
	<p>Fix possible heap buffer overwrite.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4365</cvename>
	</references>
	<dates>
	<discovery>2013-09-29</discovery>
	<entry>2013-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="749b5587-2da1-11e3-b1a9-b499baab0cbe">
	<topic>gnupg -- possible infinite recursion in the compressed packet parser</topic>
	<affects>
	<package>
	<name>gnupg</name>
	<range><lt>1.4.15</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html">
	<p>Special crafted input data may be used to cause a denial of service
	against GPG (GnuPG's OpenPGP part) and some other OpenPGP
	implementations. All systems using GPG to process incoming data are
	affected..</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4402</cvename>
	</references>
	<dates>
	<discovery>2013-10-05</discovery>
	<entry>2013-10-05</entry>
	</dates>
	</vuln>

	<vuln vid="5c34664f-2c2b-11e3-87c2-00215af774f0">
	<topic>xinetd -- ignores user and group directives for TCPMUX services</topic>
	<affects>
	<package>
	<name>xinetd</name>
	<range><lt>2.3.15_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xinetd would execute configured TCPMUX services without dropping
	privilege to match the service configuration allowing the service to
	run with same privilege as the xinetd process (root).</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4342</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=1006100</url>
	</references>
	<dates>
	<discovery>2005-08-23</discovery>
	<entry>2013-10-03</entry>
	</dates>
	</vuln>

	<vuln vid="ccefac3e-2aed-11e3-af10-000c29789cb5">
	<topic>polarssl -- Timing attack against protected RSA-CRT implementation</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><lt>1.2.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PolarSSL Project reports:</p>
	<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05">
	<p>The researchers Cyril Arnaud and Pierre-Alain Fouque
	investigated the PolarSSL RSA implementation and discovered
	a bias in the implementation of the Montgomery multiplication
	that we used. For which they then show that it can be used to
	mount an attack on the RSA key. Although their test attack is
	done on a local system, there seems to be enough indication
	that this can properly be performed from a remote system as
	well.</p>
	<p>All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected
	if a third party can send arbitrary handshake messages to your
	server.</p>
	<p>If correctly executed, this attack reveals the entire private
	RSA key after a large number of attack messages (> 600.000 on
	a local machine) are sent to show the timing differences.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5915</cvename>
	<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05</url>
	<url>https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released</url>
	</references>
	<dates>
	<discovery>2013-10-01</discovery>
	<entry>2013-10-02</entry>
	</dates>
	</vuln>

	<vuln vid="e1f99d59-81aa-4662-bf62-c1076f5016c8">
	<topic>py-graphite-web -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py26-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
	</package>
	<package>
	<name>py27-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
	</package>
	<package>
	<name>py31-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
	</package>
	<package>
	<name>py32-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
	</package>
	<package>
	<name>py33-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Graphite developers report:</p>
	<blockquote cite="http://graphite.readthedocs.org/en/0.9.11/releases/0_9_11.html">
	<p>This release contains several security fixes for cross-site
	scripting (XSS) as well as a fix for a remote-execution exploit in
	graphite-web (CVE-2013-5903).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5093</cvename>
	<url>https://github.com/rapid7/metasploit-framework/pull/2260</url>
	</references>
	<dates>
	<discovery>2013-08-21</discovery>
	<entry>2013-09-30</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="05dc6efa-2370-11e3-95b7-00e0814cab4e">
	<topic>django -- denial-of-service via large passwords</topic>
	<affects>
	<package>
	<name>py26-django</name>
	<range><ge>1.5</ge><lt>1.5.4</lt></range>
	<range><ge>1.4</ge><lt>1.4.8</lt></range>
	</package>
	<package>
	<name>py27-django</name>
	<range><ge>1.5</ge><lt>1.5.4</lt></range>
	<range><ge>1.4</ge><lt>1.4.8</lt></range>
	</package>
	<package>
	<name>py26-django-devel</name>
	<range><lt>20130922,1</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20130922,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/15/security/">
	<p>These releases address a denial-of-service attack against Django's
	authentication framework. All users of Django are encouraged to
	upgrade immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1443</cvename>
	<url>https://www.djangoproject.com/weblog/2013/sep/15/security/</url>
	</references>
	<dates>
	<discovery>2013-09-15</discovery>
	<entry>2013-09-22</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="b72bad1c-20ed-11e3-be06-000c29ee3065">
	<topic>FreeBSD -- Cross-mount links between nullfs(5) mounts</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.1</ge><lt>9.1_7</lt></range>
	<range><ge>8.4</ge><lt>8.4_4</lt></range>
	<range><ge>8.3</ge><lt>8.3_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem Description:</p>
	<p>The nullfs(5) implementation of the VOP_LINK(9) VFS
	operation does not check whether the source and target of
	the link are both in the same nullfs instance. It is
	therefore possible to create a hardlink from a location in
	one nullfs instance to a file in another, as long as the
	underlying (source) filesystem is the same.</p>
	<p>Impact:</p>
	<p>If multiple nullfs views into the same filesystem are
	mounted in different locations, a user with read access to
	one of these views and write access to another will be able
	to create a hard link from the latter to a file in the
	former, even though they are, from the user's perspective,
	different filesystems. The user may thereby gain write
	access to files which are nominally on a read-only
	filesystem.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5710</cvename>
	<freebsdsa>SA-13:13.nullfs</freebsdsa>
	</references>
	<dates>
	<discovery>2013-09-10</discovery>
	<entry>2013-09-19</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="4d87d357-202c-11e3-be06-000c29ee3065">
	<topic>FreeBSD -- Insufficient credential checks in network ioctl(2)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.1</ge><lt>9.1_7</lt></range>
	<range><ge>8.4</ge><lt>8.4_4</lt></range>
	<range><ge>8.3</ge><lt>8.3_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem Description:</p>
	<p>As is commonly the case, the IPv6 and ATM network layer
	ioctl request handlers are written in such a way that an
	unrecognized request is passed on unmodified to the link
	layer, which will either handle it or return an error
	code.</p>
	<p>Network interface drivers, however, assume that the
	SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and
	SIOCSIFNETMASK requests have been handled at the network
	layer, and therefore do not perform input validation or
	verify the caller's credentials. Typical link-layer actions
	for these requests may include marking the interface as "up"
	and resetting the underlying hardware.</p>
	<p>Impact:</p>
	<p>An unprivileged user with the ability to run arbitrary code
	can cause any network interface in the system to perform the
	link layer actions associated with a SIOCSIFADDR,
	SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl
	request; or trigger a kernel panic by passing a specially
	crafted address structure which causes a network interface
	driver to dereference an invalid pointer.</p>
	<p>Although this has not been confirmed, the possibility that
	an attacker may be able to execute arbitrary code in kernel
	context cannot be ruled out.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5691</cvename>
	<freebsdsa>SA-13:12.ifioctl</freebsdsa>
	</references>
	<dates>
	<discovery>2013-09-10</discovery>
	<entry>2013-09-19</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="7dfed67b-20aa-11e3-b8d8-0025905a4771">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>24.0,1</lt></range>
	<range><lt>17.0.9,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.9,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.21</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.9</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.21</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>24.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p> MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
	rv:17.0.9)</p>
	<p> MFSA 2013-77 Improper state in HTML5 Tree Builder with templates</p>
	<p> MFSA 2013-78 Integer overflow in ANGLE library</p>
	<p> MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
	cloning</p>
	<p> MFSA 2013-80 NativeKey continues handling key messages after
	widget is destroyed</p>
	<p> MFSA 2013-81 Use-after-free with select element</p>
	<p> MFSA 2013-82 Calling scope for new Javascript objects can lead to
	memory corruption</p>
	<p> MFSA 2013-83 Mozilla Updater does not lock MAR file after
	signature verification</p>
	<p> MFSA 2013-84 Same-origin bypass through symbolic links</p>
	<p> MFSA 2013-85 Uninitialized data in IonMonkey</p>
	<p> MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA
	graphic drivers</p>
	<p> MFSA 2013-87 Shared object library loading from writable location</p>
	<p> MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes</p>
	<p> MFSA 2013-89 Buffer overflow with multi-column, lists, and floats</p>
	<p> MFSA 2013-90 Memory corruption involving scrolling</p>
	<p> MFSA 2013-91 User-defined properties on DOM proxies get the wrong
	"this" object</p>
	<p> MFSA 2013-92 GC hazard with default compartments and frame chain
	restoration</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1718</cvename>
	<cvename>CVE-2013-1719</cvename>
	<cvename>CVE-2013-1720</cvename>
	<cvename>CVE-2013-1721</cvename>
	<cvename>CVE-2013-1722</cvename>
	<cvename>CVE-2013-1723</cvename>
	<cvename>CVE-2013-1724</cvename>
	<cvename>CVE-2013-1725</cvename>
	<cvename>CVE-2013-1726</cvename>
	<cvename>CVE-2013-1727</cvename>
	<cvename>CVE-2013-1728</cvename>
	<cvename>CVE-2013-1729</cvename>
	<cvename>CVE-2013-1730</cvename>
	<cvename>CVE-2013-1731</cvename>
	<cvename>CVE-2013-1732</cvename>
	<cvename>CVE-2013-1735</cvename>
	<cvename>CVE-2013-1736</cvename>
	<cvename>CVE-2013-1737</cvename>
	<cvename>CVE-2013-1738</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-76.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-77.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-78.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-79.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-80.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-81.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-82.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-83.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-84.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-85.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-86.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-87.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-88.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-89.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-90.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-91.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-92.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-08-17</discovery>
	<entry>2013-08-18</entry>
	<modified>2013-09-19</modified>
	</dates>
	</vuln>

	<vuln vid="5bd6811f-1c75-11e3-ba72-98fc11cdc4f5">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.310</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-21.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3361</cvename>
	<cvename>CVE-2013-3362</cvename>
	<cvename>CVE-2013-3363</cvename>
	<cvename>CVE-2013-5324</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb13-21.html</url>
	</references>
	<dates>
	<discovery>2013-09-10</discovery>
	<entry>2013-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="a851b305-1bc3-11e3-95b7-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py26-django</name>
	<range><ge>1.5</ge><lt>1.5.3</lt></range>
	<range><ge>1.4</ge><lt>1.4.7</lt></range>
	</package>
	<package>
	<name>py27-django</name>
	<range><ge>1.5</ge><lt>1.5.3</lt></range>
	<range><ge>1.4</ge><lt>1.4.7</lt></range>
	</package>
	<package>
	<name>py26-django-devel</name>
	<range><lt>20130912,1</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20130912,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/">
	<p>These releases address a directory-traversal vulnerability in one
	of Django's built-in template tags. While this issue requires some
	fairly specific factors to be exploitable, we encourage all users
	of Django to upgrade promptly.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4315</cvename>
	<url>https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/</url>
	</references>
	<dates>
	<discovery>2013-09-10</discovery>
	<entry>2013-09-12</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="f8a913cc-1322-11e3-8ffa-20cf30e32f6d">
	<topic>svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.4.0</ge><lt>1.6.23_2</lt></range>
	<range><ge>1.7.0</ge><lt>1.7.13</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-4277-advisory.txt">
	<p>svnserve takes a --pid-file option which creates a file containing the
	process id it is running as. It does not take steps to ensure that the file
	it has been directed at is not a symlink. If the pid file is in a directory
	writeable by unprivileged users, the destination could be replaced by a
	symlink allowing for privilege escalation. svnserve does not create a pid
	file by default.</p>
	<p>All versions are only vulnerable when the --pid-file=ARG option is used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4277</cvename>
	<url>http://subversion.apache.org/security/CVE-2013-4277-advisory.txt</url>
	</references>
	<dates>
	<discovery>2013-08-30</discovery>
	<entry>2013-09-02</entry>
	</dates>
	</vuln>

	<vuln vid="b3b8d491-0fbb-11e3-8c50-1c6f65c11ee6">
	<topic>cacti -- allow remote attackers to execute arbitrary SQL commands</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.8b</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cacti release reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8b.php">
	<p>Multiple security vulnerabilities have been fixed:</p>
	<ul>
	<li>SQL injection vulnerabilities</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1434</cvename>
	<cvename>CVE-2013-1435</cvename>
	<url>http://www.cacti.net/release_notes_0_8_8b.php</url>
	</references>
	<dates>
	<discovery>2013-08-06</discovery>
	<entry>2013-08-29</entry>
	</dates>
	</vuln>

	<vuln vid="fd2bf3b5-1001-11e3-ba94-0025905a4771">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><gt>11.*</gt><lt>11.5.1</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.12.3</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.21.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Remote Crash From Late Arriving SIP ACK With SDP</p>
	<p>Remote Crash when Invalid SDP is sent in SIP Request</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-5641</cvename>
	<cvename>CVE-2013-5642</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-004.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-005.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2013-08-27</discovery>
	<entry>2013-08-28</entry>
	<modified>2013-08-29</modified>
	</dates>
	</vuln>

	<vuln vid="4d087b35-0990-11e3-a9f4-bcaec565249c">
	<topic>gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav</topic>
	<affects>
	<package>
	<name>gstreamer-ffmpeg</name>
	<range><lt>0.10.13_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://libav.org/releases/libav-0.7.7.changelog">
	<p>Bundled version of libav in gstreamer-ffmpeg contains a number of
	vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3892</cvename>
	<cvename>CVE-2011-3893</cvename>
	<cvename>CVE-2011-3895</cvename>
	<cvename>CVE-2011-3929</cvename>
	<cvename>CVE-2011-3936</cvename>
	<cvename>CVE-2011-3937</cvename>
	<cvename>CVE-2011-3940</cvename>
	<cvename>CVE-2011-3945</cvename>
	<cvename>CVE-2011-3947</cvename>
	<cvename>CVE-2011-3951</cvename>
	<cvename>CVE-2011-3952</cvename>
	<cvename>CVE-2011-4031</cvename>
	<cvename>CVE-2011-4351</cvename>
	<cvename>CVE-2011-4352</cvename>
	<cvename>CVE-2011-4353</cvename>
	<cvename>CVE-2011-4364</cvename>
	<cvename>CVE-2011-4579</cvename>
	<cvename>CVE-2012-0848</cvename>
	<cvename>CVE-2012-0850</cvename>
	<cvename>CVE-2012-0851</cvename>
	<cvename>CVE-2012-0852</cvename>
	<cvename>CVE-2012-0853</cvename>
	<cvename>CVE-2012-0858</cvename>
	<cvename>CVE-2012-0947</cvename>
	<cvename>CVE-2012-2772</cvename>
	<cvename>CVE-2012-2775</cvename>
	<cvename>CVE-2012-2777</cvename>
	<cvename>CVE-2012-2779</cvename>
	<cvename>CVE-2012-2783</cvename>
	<cvename>CVE-2012-2784</cvename>
	<cvename>CVE-2012-2786</cvename>
	<cvename>CVE-2012-2787</cvename>
	<cvename>CVE-2012-2788</cvename>
	<cvename>CVE-2012-2790</cvename>
	<cvename>CVE-2012-2791</cvename>
	<cvename>CVE-2012-2793</cvename>
	<cvename>CVE-2012-2794</cvename>
	<cvename>CVE-2012-2798</cvename>
	<cvename>CVE-2012-2800</cvename>
	<cvename>CVE-2012-2801</cvename>
	<cvename>CVE-2012-2803</cvename>
	<cvename>CVE-2012-5144</cvename>
	<url>http://libav.org/releases/libav-0.7.7.changelog</url>
	</references>
	<dates>
	<discovery>2013-08-20</discovery>
	<entry>2013-08-20</entry>
	</dates>
	</vuln>

	<vuln vid="689c2bf7-0701-11e3-9a25-002590860428">
	<topic>GnuPG and Libgcrypt -- side-channel attack vulnerability</topic>
	<affects>
	<package>
	<name>libgcrypt</name>
	<range><lt>1.5.3</lt></range>
	</package>
	<package>
	<name>linux-f10-libgcrypt</name>
	<range><lt>1.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch of the GNU project reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html">
	<p>Noteworthy changes in version 1.5.3:</p>
	<p>Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...</p>
	<p>Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above
	problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG
	1.4.14.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4242</cvename>
	<url>http://eprint.iacr.org/2013/448</url>
	<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html</url>
	<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
	</references>
	<dates>
	<discovery>2013-07-18</discovery>
	<entry>2013-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="2b2f6092-0694-11e3-9e8e-000c29f6ae42">
	<topic>puppet -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>puppet</name>
	<range><ge>2.7</ge><lt>2.7.23</lt></range>
	<range><ge>3.0</ge><lt>3.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Puppet Labs reports:</p>
	<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-4761/">
	<p>By using the `resource_type` service, an attacker could
	cause puppet to load arbitrary Ruby files from the puppet
	master node's file system. While this behavior is not
	enabled by default, `auth.conf` settings could be modified
	to allow it. The exploit requires local file system access
	to the Puppet Master.</p>
	<p>Puppet Module Tool (PMT) did not correctly control
	permissions of modules it installed, instead transferring
	permissions that existed when the module was built.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4761</cvename>
	<cvename>CVE-2013-4956</cvename>
	<url>http://puppetlabs.com/security/cve/cve-2013-4761/</url>
	<url>http://puppetlabs.com/security/cve/cve-2013-4956/</url>
	</references>
	<dates>
	<discovery>2013-07-05</discovery>
	<entry>2013-08-16</entry>
	</dates>
	</vuln>

	<vuln vid="9a0a892e-05d8-11e3-ba09-000c29784fd1">
	<topic>lcms2 -- Null Pointer Dereference Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>lcms2</name>
	<range><lt>2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mageia security team reports:</p>
	<blockquote cite="http://advisories.mageia.org/MGASA-2013-0240.html">
	<p>It was discovered that Little CMS did not properly verify certain
	memory allocations. If a user or automated system using Little CMS
	were tricked into opening a specially crafted file, an attacker
	could cause Little CMS to crash (CVE-2013-4160).
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4160</cvename>
	<url>http://advisories.mageia.org/MGASA-2013-0240.html</url>
	<url>https://bugs.mageia.org/show_bug.cgi?id=10816</url>
	</references>
	<dates>
	<discovery>2013-07-22</discovery>
	<entry>2013-08-15</entry>
	<modified>2013-08-19</modified>
	</dates>
	</vuln>

	<vuln vid="72bf9e21-03df-11e3-bd8d-080027ef73ec">
	<topic>polarssl -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>polarssl</name>
	<range><lt>1.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Paul Bakker reports:</p>
	<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03">
	<p>A bug in the logic of the parsing of PEM encoded certificates in
	x509parse_crt() can result in an infinite loop, thus hogging processing
	power.</p>
	<p>While parsing a Certificate message during the SSL/TLS handshake,
	PolarSSL extracts the presented certificates and sends them on to
	be parsed. As the RFC specifies that the certificates in the
	Certificate message are always X.509 certificates in DER format,
	bugs in the decoding of PEM certificates should normally not be
	triggerable via the SSL/TLS handshake.</p>
	<p>Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior
	to 1.2.8 in the 1.2 branch call the generic x509parse_crt()
	function for parsing during the handshake. x509parse_crt() is a
	generic functions that wraps parsing of both PEM-encoded and
	DER-formatted certificates. As a result it is possible to craft
	a Certificate message that includes a PEM encoded certificate in
	the Certificate message that triggers the infinite loop.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4623</cvename>
	<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03</url>
	</references>
	<dates>
	<discovery>2013-06-21</discovery>
	<entry>2013-08-13</entry>
	<modified>2013-08-15</modified>
	</dates>
	</vuln>

	<vuln vid="e21c7c7a-0116-11e3-9e83-3c970e169bc2">
	<topic>samba -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.17</lt></range>
	</package>
	<package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba project reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4124">
	<p>All current released versions of Samba are vulnerable to
	a denial of service on an authenticated or guest connection.
	A malformed packet can cause the smbd server to loop the CPU
	performing memory allocations and preventing any further service.</p>
	<p>A connection to a file share, or a local account is needed
	to exploit this problem, either authenticated or unauthenticated
	if guest connections are allowed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4124</cvename>
	<url>http://www.samba.org/samba/security/CVE-2013-4124</url>
	</references>
	<dates>
	<discovery>2013-08-05</discovery>
	<entry>2013-08-09</entry>
	<modified>2013-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="0998e79d-0055-11e3-905b-0025905a4771">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>23.0,1</lt></range>
	<range><lt>17.0.8,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.8,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.20</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.8</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.20</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 /
	rv:17.0.8)</p>
	<p>MFSA 2013-64 Use after free mutating DOM during SetBody</p>
	<p>MFSA 2013-65 Buffer underflow when generating CRMF requests</p>
	<p>MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and
	Mozilla Updater</p>
	<p>MFSA 2013-67 Crash during WAV audio file decoding</p>
	<p>MFSA 2013-68 Document URI misrepresentation and masquerading</p>
	<p>MFSA 2013-69 CRMF requests allow for code execution and XSS
	attacks</p>
	<p>MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes</p>
	<p>MFSA 2013-71 Further Privilege escalation through Mozilla Updater</p>
	<p>MFSA 2013-72 Wrong principal used for validating URI for some
	Javascript components</p>
	<p>MFSA 2013-73 Same-origin bypass with web workers and
	XMLHttpRequest</p>
	<p>MFSA 2013-74 Firefox full and stub installer DLL hijacking</p>
	<p>MFSA 2013-75 Local Java applets may read contents of local file
	system</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1701</cvename>
	<cvename>CVE-2013-1702</cvename>
	<cvename>CVE-2013-1704</cvename>
	<cvename>CVE-2013-1705</cvename>
	<cvename>CVE-2013-1706</cvename>
	<cvename>CVE-2013-1707</cvename>
	<cvename>CVE-2013-1708</cvename>
	<cvename>CVE-2013-1709</cvename>
	<cvename>CVE-2013-1710</cvename>
	<cvename>CVE-2013-1711</cvename>
	<cvename>CVE-2013-1712</cvename>
	<cvename>CVE-2013-1713</cvename>
	<cvename>CVE-2013-1714</cvename>
	<cvename>CVE-2013-1715</cvename>
	<cvename>CVE-2013-1717</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-63.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-64.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-65.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-66.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-67.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-68.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-69.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-70.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-71.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-72.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-08-06</discovery>
	<entry>2013-08-08</entry>
	</dates>
	</vuln>

	<vuln vid="4b448a96-ff73-11e2-b28d-080027ef73ec">
	<topic>PuTTY -- Four security holes in versions before 0.63</topic>
	<affects>
	<package>
	<name>putty</name>
	<range><lt>0.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Tatham reports:</p>
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html">
	<p>This [0.63] release fixes multiple security holes in previous versions of
	PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
	underrun buffers and crash. [...]
	</p><p>
	These vulnerabilities can be triggered before host key verification,
	which means that you are not even safe if you trust the server you
	<em>think</em> you're connecting to, since it could be spoofed over the
	network and the host key check would not detect this before the attack
	could take place.
	</p><p>
	Additionally, when PuTTY authenticated with a user's private key, the
	private key or information equivalent to it was accidentally kept in
	PuTTY's memory for the rest of its run, where it could be retrieved by
	other processes reading PuTTY's memory, or written out to swap files
	or crash dumps. This release fixes that as well.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4206</cvename>
	<cvename>CVE-2013-4207</cvename>
	<cvename>CVE-2013-4208</cvename>
	<cvename>CVE-2013-4852</cvename>
	<mlist msgid="E1V6lUs-0007kP-40@atreus.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html</mlist>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html</url>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html</url>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html</url>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html</url>
	</references>
	<dates>
	<discovery>2013-07-08</discovery>
	<entry>2013-08-07</entry>
	</dates>
	</vuln>

	<vuln vid="e6839625-fdfa-11e2-9430-20cf30e32f6d">
	<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.29</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.14</lt></range>
	<range><ge>6.1.0</ge><lt>6.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo Security Team reports:</p>
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002/">
	<p>It has been discovered that TYPO3 Core is vulnerable to
	Cross-Site Scripting and Remote Code Execution.</p>
	<p>TYPO3 bundles flash files for video and audio playback. Old
	versions of FlowPlayer and flashmedia are susceptible to
	Cross-Site Scripting. No authentication is required to exploit
	this vulnerability.</p>
	<p>The file upload component and the File Abstraction Layer are
	failing to check for denied file extensions, which allows
	authenticated editors (even with limited permissions) to
	upload php files with arbitrary code, which can then be
	executed in web server's context.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3642</cvename>
	<cvename>CVE-2013-1464</cvename>
	</references>
	<dates>
	<discovery>2013-07-30</discovery>
	<entry>2013-08-05</entry>
	</dates>
	</vuln>

	<vuln vid="17326fd5-fcfb-11e2-9bb9-6805ca0b3d42">
	<topic>phpMyAdmin -- clickJacking protection can be bypassed</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>4.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php">
	<p> phpMyAdmin has a number of mechanisms to avoid a
	clickjacking attack, however these mechanisms either work
	only in modern browser versions, or can be bypassed.</p>
	<p>"We have no solution for 3.5.x, due to the proposed
	solution requiring JavaScript. We don't want to introduce a
	dependency to JavaScript in the 3.5.x family."</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php</url>
	</references>
	<dates>
	<discovery>2013-08-04</discovery>
	<entry>2013-08-04</entry>
	</dates>
	</vuln>

	<vuln vid="f4a0212f-f797-11e2-9bb9-6805ca0b3d42">
	<topic>phpMyAdmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.0</ge><lt>4.0.4.2</lt></range>
	</package>
	<package>
	<name>phpMyAdmin35</name>
	<range><ge>3.5</ge><lt>3.5.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php">
	<p>XSS due to unescaped HTML Output when executing a SQL query.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php">
	<p>5 XSS vulnerabilities in setup, chart display, process
	list, and logo link.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php">
	<p>If a crafted version.json would be presented, an XSS
	could be introduced.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php">
	<p>Full path disclosure vulnerabilities.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php">
	<p> XSS vulnerability when a text to link transformation is
	used.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php">
	<p>Self-XSS due to unescaped HTML output in schema
	export.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php">
	<p>SQL injection vulnerabilities, producing a privilege
	escalation (control user).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php</url>
	<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view</url>
	<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view</url>
	</references>
	<dates>
	<discovery>2013-07-28</discovery>
	<entry>2013-07-28</entry>
	<modified>2013-07-29</modified>
	</dates>
	</vuln>

	<vuln vid="049332d2-f6e1-11e2-82f3-000c29ee3065">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.5.2,1</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>3.5.2</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.5.2</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>3.5.2</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>3.5.2</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>3.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The wordpress development team reports:</p>
	<blockquote cite="https://wordpress.org/news/2013/06/wordpress-3-5-2/">
	<ul>
	<li>Blocking server-side request forgery attacks, which could
	potentially enable an attacker to gain access to a site</li>
	<li>Disallow contributors from improperly publishing posts</li>
	<li>An update to the SWFUpload external library to fix cross-site
	scripting vulnerabilities</li>
	<li>Prevention of a denial of service attack, affecting sites
	using password-protected posts</li>
	<li>An update to an external TinyMCE library to fix a cross-site
	scripting vulnerability</li>
	<li>Multiple fixes for cross-site scripting</li>
	<li>Avoid disclosing a full file path when a upload fails</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2199</cvename>
	<cvename>CVE-2013-2200</cvename>
	<cvename>CVE-2013-2201</cvename>
	<cvename>CVE-2013-2202</cvename>
	<cvename>CVE-2013-2203</cvename>
	<cvename>CVE-2013-2204</cvename>
	<cvename>CVE-2013-2205</cvename>
	<url>https://wordpress.org/news/2013/06/wordpress-3-5-2/</url>
	</references>
	<dates>
	<discovery>2013-06-21</discovery>
	<entry>2013-07-27</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="7943e521-f648-11e2-8607-3c970e169bc2">
	<topic>bind -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
	</package>
	<package>
	<name>bind99-base</name>
	<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
	</package>
	<package>
	<name>bind98-base</name>
	<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.1_5</lt></range>
	<range><ge>8.4</ge><lt>8.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-01015/0">
	<p>A specially crafted query that includes malformed
	rdata can cause named to terminate with an assertion
	failure while rejecting the malformed query.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4854</cvename>
	<freebsdsa>SA-13:07.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-01015/0</url>
	</references>
	<dates>
	<discovery>2013-07-26</discovery>
	<entry>2013-07-26</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="80771b89-f57b-11e2-bf21-b499baab0cbe">
	<topic>gnupg -- side channel attack on RSA secret keys</topic>
	<affects>
	<package>
	<name>gnupg</name>
	<range><lt>1.4.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Yarom and Falkner paper reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html">
	<p>Flush+Reload is a cache side-channel attack that monitors access to
	data in shared pages. In this paper we demonstrate how to use the
	attack to extract private encryption keys from GnuPG. The high
	resolution and low noise of the Flush+Reload attack enables a spy
	program to recover over 98% of the bits of the private key in a
	single decryption or signing round. Unlike previous attacks, the
	attack targets the last level L3 cache. Consequently, the spy
	program and the victim do not need to share the execution core of
	the CPU. The attack is not limited to a traditional OS and can be
	used in a virtualised environment, where it can attack programs
	executing in a different VM.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://eprint.iacr.org/2013/448</url>
	<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
	</references>
	<dates>
	<discovery>2013-07-18</discovery>
	<entry>2013-07-25</entry>
	<modified>2013-07-26</modified>
	</dates>
	</vuln>

	<vuln vid="c4d412c8-f4d1-11e2-b86c-000c295229d5">
	<topic>openafs -- single-DES cell-wide key brute force vulnerability</topic>
	<affects>
	<package>
	<name>openafs</name>
	<range><lt>1.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenAFS Project reports:</p>
	<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt">
	<p>The small size of the DES key space permits an attacker to brute
	force a cell's service key and then forge traffic from any user
	within the cell. The key space search can be performed in under 1
	day at a cost of around $100 using publicly available services.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4134</cvename>
	<url>http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt</url>
	<url>http://openafs.org/pages/security/how-to-rekey.txt</url>
	<url>http://openafs.org/pages/security/install-rxkad-k5-1.6.txt</url>
	</references>
	<dates>
	<discovery>2013-07-24</discovery>
	<entry>2013-07-25</entry>
	</dates>
	</vuln>

	<vuln vid="2ae24334-f2e6-11e2-8346-001e8c75030d">
	<topic>subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
	<range><ge>1.7.0</ge><lt>1.7.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion Project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-4131-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion
	on some requests made against a revision root. This can lead to a DoS.
	If assertions are disabled it will trigger a read overflow which may cause a
	SEGFAULT (or equivalent) or undefined behavior.</p>
	<p>Commit access is required to exploit this.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4131</cvename>
	<url>http://subversion.apache.org/security/CVE-2013-4131-advisory.txt</url>
	</references>
	<dates>
	<discovery>2013-07-19</discovery>
	<entry>2013-07-24</entry>
	<modified>2013-07-25</modified>
	</dates>
	</vuln>

	<vuln vid="2fbfd455-f2d0-11e2-8a46-000d601460a4">
	<topic>suPHP -- Privilege escalation</topic>
	<affects>
	<package>
	<name>suphp</name>
	<range><lt>0.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>suPHP developer Sebastian Marsching reports:</p>
	<blockquote cite="https://lists.marsching.com/pipermail/suphp/2013-May/002552.html">
	<p>When the suPHP_PHPPath was set, mod_suphp would use the specified PHP
	executable to pretty-print PHP source files (MIME type
	x-httpd-php-source or application/x-httpd-php-source).</p>
	<p>However, it would not sanitize the environment. Thus a user that was
	allowed to use the SetEnv directive in a .htaccess file (AllowOverride
	FileInfo) could make PHP load a malicious configuration file (e.g.
	loading malicious extensions).</p>
	<p>As the PHP process for highlighting the source file was run with the
	privileges of the user Apache HTTPd was running as, a local attacker
	could probably execute arbitrary code with the privileges of this user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://lists.marsching.com/pipermail/suphp/2013-May/002552.html</url>
	</references>
	<dates>
	<discovery>2013-05-20</discovery>
	<entry>2013-07-22</entry>
	</dates>
	</vuln>

	<vuln vid="ca4d63fb-f15c-11e2-b183-20cf30e32f6d">
	<topic>apache24 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache24</name>
	<range><lt>2.4.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache HTTP SERVER PROJECT reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
	<p>mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn
	with the source href (sent as part of the request body as XML) pointing
	to a URI that is not configured for DAV will trigger a segfault.</p>
	<p>mod_session_dbd: Make sure that dirty flag is respected when saving
	sessions, and ensure the session ID is changed each time the session
	changes. This changes the format of the updatesession SQL statement.
	Existing configurations must be changed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1896</cvename>
	<cvename>CVE-2013-2249</cvename>
	<url>http://www.apache.org/dist/httpd/Announcement2.4.html</url>
	</references>
	<dates>
	<discovery>2013-07-11</discovery>
	<entry>2013-07-20</entry>
	<modified>2013-07-21</modified>
	</dates>
	</vuln>

	<vuln vid="9b037a0d-ef2c-11e2-b4a0-8c705af55518">
	<topic>gallery -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gallery3</name>
	<range><lt>3.0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Red Hat Security Response Team reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2013/07/04/7">
	<p>Gallery upstream has released 3.0.9 version, correcting two
	security flaws:</p>
	<p>Issue #1 - Improper stripping of URL fragments in flowplayer
	SWF file might lead to reply attacks (a different flaw than
	CVE-2013-2138).</p>
	<p>Issue #2 - gallery3: Multiple information exposure flaws in
	data rest core module.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2240</cvename>
	<cvename>CVE-2013-2241</cvename>
	<url>http://sourceforge.net/apps/trac/gallery/ticket/2073</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=981197</url>
	<url>http://sourceforge.net/apps/trac/gallery/ticket/2074</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=981198</url>
	<url>http://galleryproject.org/gallery_3_0_9</url>
	</references>
	<dates>
	<discovery>2013-06-28</discovery>
	<entry>2013-07-17</entry>
	</dates>
	</vuln>

	<vuln vid="31b145f2-d9d3-49a9-8023-11cf742205dc">
	<topic>PHP5 -- Heap corruption in XML parser</topic>
	<affects>
	<package>
	<name>php53</name>
	<range><lt>5.3.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP development team reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113">
	<p>ext/xml/xml.c in PHP before 5.3.27 does not properly
	consider parsing depth, which allows remote attackers to
	cause a denial of service (heap memory corruption) or
	possibly have unspecified other impact via a crafted
	document that is processed by the xml_parse_into_struct
	function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4113</cvename>
	<url>https://bugs.php.net/bug.php?id=65236</url>
	</references>
	<dates>
	<discovery>2013-07-10</discovery>
	<entry>2013-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="5def3175-f3f9-4476-ba40-b46627cc638c">
	<topic>PHP5 -- Integer overflow in Calendar module</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><ge>5.4.0</ge><lt>5.4.16</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP development team reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635">
	<p>Integer overflow in the SdnToJewish function in jewish.c
	in the Calendar component in PHP before 5.3.26 and 5.4.x
	before 5.4.16 allows context-dependent attackers to cause a
	denial of service (application hang) via a large argument to
	the jdtojewish function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4635</cvename>
	<url>https://bugs.php.net/bug.php?id=64895</url>
	</references>
	<dates>
	<discovery>2013-05-22</discovery>
	<entry>2013-07-16</entry>
	</dates>
	</vuln>

	<vuln vid="df428c01-ed91-11e2-9466-98fc11cdc4f5">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.297</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-17.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3344</cvename>
	<cvename>CVE-2013-3345</cvename>
	<cvename>CVE-2013-3347</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb13-17.html</url>
	</references>
	<dates>
	<discovery>2013-07-09</discovery>
	<entry>2013-07-15</entry>
	<modified>2013-07-18</modified>
	</dates>
	</vuln>

	<vuln vid="30a04ab4-ed7b-11e2-8643-8c705af55518">
	<topic>squid -- denial of service</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.2</ge><lt>3.2.12</lt></range>
	<range><ge>3.3</ge><lt>3.3.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid project reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2013_3.txt">
	<p>Due to incorrect data validation Squid is vulnerable to a
	denial of service attack when processing specially crafted
	HTTP requests</p>
	<p>This problem allows any client who can generate HTTP requests
	to perform a denial of service attack on the Squid service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4123</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2013_3.txt</url>
	</references>
	<dates>
	<discovery>2013-07-13</discovery>
	<entry>2013-07-15</entry>
	</dates>
	</vuln>

	<vuln vid="04320e7d-ea66-11e2-a96e-60a44c524f57">
	<topic>libzrtpcpp -- multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>libzrtpcpp</name>
	<range><lt>2.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Dowd reports:</p>
	<blockquote cite="http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html">
	<p>Vulnerability 1. Remote Heap Overflow: If an attacker sends a
	packet larger than 1024 bytes that gets stored temporarily (which
	occurs many times - such as when sending a ZRTP Hello packet), a
	heap overflow will occur, leading to potential arbitrary code
	execution on the vulnerable host.</p>
	<p>Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains
	multiple stack overflows that arise when preparing a response
	to a client's ZRTP Hello packet.</p>
	<p>Vulnerability 3. Information Leaking / Out of Bounds Reads:
	The ZRTPCPP library performs very little validation regarding the
	expected size of a packet versus the actual amount of data
	received. This can lead to both information leaking and out
	of bounds data reads (usually resulting in a crash).
	Information leaking can be performed for example by sending
	a malformed ZRTP Ping packet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2221</cvename>
	<cvename>CVE-2013-2222</cvename>
	<cvename>CVE-2013-2223</cvename>
	</references>
	<dates>
	<discovery>2013-06-27</discovery>
	<entry>2013-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="ebd877b9-7ef4-4375-b1fd-c67780581898">
	<topic>ruby -- Hostname check bypassing vulnerability in SSL client</topic>
	<affects>
	<package>
	<name>ruby19</name>
	<range><lt>1.9.3.448,1</lt></range>
	</package>
	<package>
	<name>ruby18</name>
	<range><lt>1.8.7.374,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Developers report:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/">
	<p>Ruby's SSL client implements hostname identity check but it does
	not properly handle hostnames in the certificate that contain null
	bytes.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4073</cvename>
	<url>http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/</url>
	</references>
	<dates>
	<discovery>2013-06-27</discovery>
	<entry>2013-07-11</entry>
	<modified>2013-09-24</modified>
	</dates>
	</vuln>

	<vuln vid="e3e788aa-e9fd-11e2-a96e-60a44c524f57">
	<topic>otrs -- Sql Injection + Xss Issue</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.2.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/">
	<p>An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4717</cvename>
	<cvename>CVE-2013-4718</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/</url>
	</references>
	<dates>
	<discovery>2013-07-09</discovery>
	<entry>2013-07-11</entry>
	</dates>
	</vuln>

	<vuln vid="f3d24aee-e5ad-11e2-b183-20cf30e32f6d">
	<topic>apache22 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
	</package>
	<package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
	</package>
	<package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
	</package>
	<package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
	</package>
	<package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.25">
	<p>The mod_rewrite module in the Apache HTTP Server 2.2.x before
	2.2.25 writes data to a log file without sanitizing
	non-printable characters, which might allow remote attackers to
	execute arbitrary commands via an HTTP request containing an
	escape sequence for a terminal emulator.</p>
	<p>mod_dav: Sending a MERGE request against a URI handled by
	mod_dav_svn with the source href (sent as part of the request
	body as XML) pointing to a URI that is not configured for DAV
	will trigger a segfault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1862</cvename>
	<cvename>CVE-2013-1896</cvename>
	</references>
	<dates>
	<discovery>2013-06-21</discovery>
	<entry>2013-07-05</entry>
	<modified>2013-07-10</modified>
	</dates>
	</vuln>

	<vuln vid="1b93f6fe-e1c1-11e2-948d-6805ca0b3d42">
	<topic>phpMyAdmin -- Global variable scope injection</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.0</ge><lt>4.0.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php">
	<p>The import.php script was vulnerable to GLOBALS variable
	injection. Therefore, an attacker could manipulate any
	configuration parameter.</p>
	<p>This vulnerability can be triggered only by someone who
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	form.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php</url>
	<cvename>CVE-2013-4729</cvename>
	</references>
	<dates>
	<discovery>2013-06-30</discovery>
	<entry>2013-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="81da673e-dfe1-11e2-9389-08002798f6ff">
	<topic>apache-xml-security-c -- heap overflow during XPointer evaluation</topic>
	<affects>
	<package>
	<name>apache-xml-security-c</name>
	<range><lt>1.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2210.txt">
	<p>The attempted fix to address CVE-2013-2154 introduced the
	possibility of a heap overflow, possibly leading to arbitrary code
	execution, in the processing of malformed XPointer expressions in the
	XML Signature Reference processing code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2210</cvename>
	<url>http://santuario.apache.org/secadv.data/CVE-2013-2210.txt</url>
	</references>
	<dates>
	<discovery>2013-06-27</discovery>
	<entry>2013-06-28</entry>
	</dates>
	</vuln>

	<vuln vid="b3fcb387-de4b-11e2-b1c6-0025905a4771">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>22.0,1</lt></range>
	<range><lt>17.0.7,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.7,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.19</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.7</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.19</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)</p>
	<p>Title: Memory corruption found using Address Sanitizer</p>
	<p>Privileged content access and execution via XBL</p>
	<p>Arbitrary code execution within Profiler</p>
	<p>Execution of unmapped memory through onreadystatechange</p>
	<p>Data in the body of XHR HEAD requests leads to CSRF attacks</p>
	<p>SVG filters can lead to information disclosure</p>
	<p>PreserveWrapper has inconsistent behavior</p>
	<p>Sandbox restrictions not applied to nested frame elements</p>
	<p>X-Frame-Options ignored when using server push with multi-part
	responses</p>
	<p>XrayWrappers can be bypassed to run user defined methods in a
	privileged context</p>
	<p>getUserMedia permission dialog incorrectly displays location</p>
	<p>Homograph domain spoofing in .com, .net and .name</p>
	<p>Inaccessible updater can lead to local privilege escalation</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1682</cvename>
	<cvename>CVE-2013-1683</cvename>
	<cvename>CVE-2013-1684</cvename>
	<cvename>CVE-2013-1685</cvename>
	<cvename>CVE-2013-1686</cvename>
	<cvename>CVE-2013-1687</cvename>
	<cvename>CVE-2013-1688</cvename>
	<cvename>CVE-2013-1690</cvename>
	<cvename>CVE-2013-1692</cvename>
	<cvename>CVE-2013-1693</cvename>
	<cvename>CVE-2013-1694</cvename>
	<cvename>CVE-2013-1695</cvename>
	<cvename>CVE-2013-1696</cvename>
	<cvename>CVE-2013-1697</cvename>
	<cvename>CVE-2013-1698</cvename>
	<cvename>CVE-2013-1699</cvename>
	<cvename>CVE-2013-1700</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-49.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-50.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-51.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-52.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-53.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-54.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-55.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-56.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-57.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-58.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-59.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-60.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-61.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-62.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-06-25</discovery>
	<entry>2013-06-26</entry>
	</dates>
	</vuln>

	<vuln vid="01cf67b3-dc3b-11e2-a6cd-c48508086173">
	<topic>cURL library -- heap corruption in curl_easy_unescape</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>7.7</ge><lt>7.24.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cURL developers report:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20130622.html">
	<p>libcurl is vulnerable to a case of bad checking of the
	input data which may lead to heap corruption.</p>
	<p>The function curl_easy_unescape() decodes URL-encoded
	strings to raw binary data. URL-encoded octets are
	represented with %HH combinations where HH is a two-digit
	hexadecimal number. The decoded string is written to an
	allocated memory area that the function returns to the
	caller.</p>
	<p>The function takes a source string and a length
	parameter, and if the length provided is 0 the function will
	instead use strlen() to figure out how much data to
	parse.</p>
	<p>The "%HH" parser wrongly only considered the case where a
	zero byte would terminate the input. If a length-limited
	buffer was passed in which ended with a '%' character which
	was followed by two hexadecimal digits outside of the buffer
	libcurl was allowed to parse alas without a terminating
	zero, libcurl would still parse that sequence as well. The
	counter for remaining data to handle would then be decreased
	too much and wrap to become a very large integer and the
	copying would go on too long and the destination buffer that
	is allocated on the heap would get overwritten.</p>
	<p>We consider it unlikely that programs allow user-provided
	strings unfiltered into this function. Also, only the not
	zero-terminated input string use case is affected by this
	flaw. Exploiting this flaw for gain is probably possible for
	specific circumstances but we consider the general risk for
	this to be low.</p>
	<p>The curl command line tool is not affected by this
	problem as it doesn't use this function.</p>
	<p>There are no known exploits available at this time.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2174</cvename>
	<url>http://curl.haxx.se/docs/adv_20130622.html</url>
	</references>
	<dates>
	<discovery>2013-06-22</discovery>
	<entry>2013-06-23</entry>
	<modified>2013-07-01</modified>
	</dates>
	</vuln>

	<vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
	<topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
	<affects>
	<package>
	<name>puppet</name>
	<range><ge>2.7</ge><lt>2.7.22</lt></range>
	<range><ge>3.0</ge><lt>3.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Puppet Developers report:</p>
	<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
	<p>When making REST api calls, the puppet master takes YAML from an
	untrusted client, deserializes it, and then calls methods on the
	resulting object. A YAML payload can be crafted to cause the
	deserialization to construct an instance of any class available in
	the ruby process, which allows an attacker to execute code
	contained in the payload.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3567</cvename>
	</references>
	<dates>
	<discovery>2013-06-13</discovery>
	<entry>2013-06-22</entry>
	<modified>2013-08-01</modified>
	</dates>
	</vuln>

	<vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
	<topic>otrs -- information disclosure</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/">
	<p>An attacker with a valid agent login could manipulate URLs in the ticket
	watch mechanism to see contents of tickets they are not permitted to see.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-4088</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/</url>
	</references>
	<dates>
	<discovery>2013-06-18</discovery>
	<entry>2013-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="abef280d-d829-11e2-b71c-8c705af55518">
	<topic>FreeBSD -- Privilege escalation via mmap</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.1_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a06.mmap.asc">
	<p>Due to insufficient permission checks in the virtual memory
	system, a tracing process (such as a debugger) may be able to
	modify portions of the traced process's address space to which
	the traced process itself does not have write access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2171</cvename>
	<freebsdsa>SA-13:06.mmap</freebsdsa>
	</references>
	<dates>
	<discovery>2013-06-18</discovery>
	<entry>2013-06-18</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="279e5f4b-d823-11e2-928e-08002798f6ff">
	<topic>apache-xml-security-c -- heap overflow</topic>
	<affects>
	<package>
	<name>apache-xml-security-c</name>
	<range><lt>1.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2156.txt">
	<p>A heap overflow exists in the processing of the PrefixList
	attribute optionally used in conjunction with Exclusive
	Canonicalization, potentially allowing arbitary code execution.
	If verification of the signature occurs prior to actual evaluation of a
	signing key, this could be exploited by an unauthenticated attacker.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2156</cvename>
	<url>http://santuario.apache.org/secadv.data/CVE-2013-2156.txt</url>
	</references>
	<dates>
	<discovery>2013-06-18</discovery>
	<entry>2013-06-18</entry>
	</dates>
	</vuln>

	<vuln vid="80af2677-d6c0-11e2-8f5e-001966155bea">
	<topic>tor -- guard discovery</topic>
	<affects>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.4.13.a_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Project reports:</p>
	<blockquote cite="https://gitweb.torproject.org/tor.git/commit/2a95f3171681ee53c97ccba9d80f4454b462aaa7">
	<p>Disable middle relay queue overfill detection code due to possible guard discovery attack</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://trac.torproject.org/projects/tor/ticket/9072</url>
	</references>
	<dates>
	<discovery>2013-06-15</discovery>
	<entry>2013-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="4e9e410b-d462-11e2-8d57-080027019be0">
	<topic>dbus -- local dos</topic>
	<affects>
	<package>
	<name>dbus</name>
	<range><lt>1.6.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon McVittie reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2013-June/015696.html">
	<p>Alexandru Cornea discovered a vulnerability in libdbus caused
	by an implementation bug in _dbus_printf_string_upper_bound().
	This vulnerability can be exploited by a local user to crash
	system services that use libdbus, causing denial of service.
	It is platform-specific: x86-64 Linux is known to be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2168</cvename>
	<url>http://lists.freedesktop.org/archives/dbus/2013-June/015696.html</url>
	</references>
	<dates>
	<discovery>2013-06-13</discovery>
	<entry>2013-06-13</entry>
	</dates>
	</vuln>

	<vuln vid="fce67546-d2e7-11e2-a9bf-98fc11cdc4f5">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.291</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-16.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3343</cvename>
	</references>
	<dates>
	<discovery>2013-06-11</discovery>
	<entry>2013-06-14</entry>
	<modified>2013-06-18</modified>
	</dates>
	</vuln>

	<vuln vid="d7a43ee6-d2d5-11e2-9894-002590082ac6">
	<topic>owncloud -- Multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>owncloud</name>
	<range><lt>5.0.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ownCloud development team reports:</p>
	<blockquote cite="http://owncloud.org/about/security/advisories/">
	<p>oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections.
	Credit to Mateusz Goik (aliantsoft.pl).</p>
	<p>oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals.
	Credit to Mateusz Goik (aliantsoft.pl).</p>
	<p>oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities.
	Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).</p>
	<p>oC-SA-2013-022 / CVE-2013-2044: Open redirector.
	Credit to Mateusz Goik (aliantsoft.pl).</p>
	<p>oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.</p>
	<p>oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application.
	Credit to Mateusz Goik (aliantsoft.pl).</p>
	<p>oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.</p>
	<p>oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.</p>
	<p>oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.</p>
	<p>oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-019/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-020/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-021/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-022/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-023/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-024/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-025/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-026/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-027/</url>
	<url>http://owncloud.org/about/security/advisories/oC-SA-2013-028/</url>
	<cvename>CVE-2013-2039</cvename>
	<cvename>CVE-2013-2040</cvename>
	<cvename>CVE-2013-2041</cvename>
	<cvename>CVE-2013-2042</cvename>
	<cvename>CVE-2013-2043</cvename>
	<cvename>CVE-2013-2044</cvename>
	<cvename>CVE-2013-2045</cvename>
	<cvename>CVE-2013-2047</cvename>
	<cvename>CVE-2013-2048</cvename>
	<cvename>CVE-2013-2085</cvename>
	<cvename>CVE-2013-2086</cvename>
	<cvename>CVE-2013-2089</cvename>
	<cvename>CVE-2013-2149</cvename>
	<cvename>CVE-2013-2150</cvename>
	</references>
	<dates>
	<discovery>2013-05-14</discovery>
	<entry>2013-06-11</entry>
	</dates>
	</vuln>

	<vuln vid="59e7163c-cf84-11e2-907b-0025905a4770">
	<topic>php5 -- Heap based buffer overflow in quoted_printable_encode</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.4.16</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP development team reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	<p>A Heap-based buffer overflow flaw was found in the php
	quoted_printable_encode() function. A remote attacker could use
	this flaw to cause php to crash or execute arbirary code with the
	permission of the user running php</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2110</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=964969</url>
	</references>
	<dates>
	<discovery>2013-06-06</discovery>
	<entry>2013-06-07</entry>
	</dates>
	</vuln>

	<vuln vid="72f35727-ce83-11e2-be04-005056a37f68">
	<topic>dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
	</package>
	<package>
	<name>bind99-base</name>
	<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
	</package>
	<package>
	<name>bind98-base</name>
	<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
	</package>
	<package>
	<name>bind96-base</name>
	<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-00967">
	<p>A bug has been discovered in the most recent releases of
	BIND 9 which has the potential for deliberate exploitation
	as a denial-of-service attack. By sending a recursive
	resolver a query for a record in a specially malformed zone,
	an attacker can cause BIND 9 to exit with a fatal
	"RUNTIME_CHECK" error in resolver.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3919</cvename>
	</references>
	<dates>
	<discovery>2013-06-04</discovery>
	<entry>2013-06-06</entry>
	<modified>2013-06-07</modified>
	</dates>
	</vuln>

	<vuln vid="6b97436c-ce1e-11e2-9cb2-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS due to unescaped HTML output in Create View page</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>4.0</ge><lt>4.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php">
	<p>When creating a view with a crafted name and an incorrect
	CREATE statement, it is possible to trigger an XSS.</p>
	<p>This vulnerability can be triggered only by someone who
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users from accessing the required
	form.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php</url>
	<cvename>CVE-2013-3742</cvename>
	</references>
	<dates>
	<discovery>2013-06-05</discovery>
	<entry>2013-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="a3c2dee5-cdb9-11e2-b9ce-080027019be0">
	<topic>telepathy-gabble -- TLS verification bypass</topic>
	<affects>
	<package>
	<name>telepathy-gabble</name>
	<range><lt>0.16.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon McVittie reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html">
	<p>This release fixes a man-in-the-middle attack.</p>
	<p>If you use an unencrypted connection to a "legacy Jabber"
	(pre-XMPP) server, this version of Gabble will not connect
	until you make one of these configuration changes:</p>
	<p>. upgrade the server software to something that supports XMPP 1.0; or</p>
	<p>. use an encrypted "old SSL" connection, typically on port 5223
	(old-ssl); or</p>
	<p>. turn off "Encryption required (TLS/SSL)" (require-encryption).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1431</cvename>
	<url>http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html</url>
	</references>
	<dates>
	<discovery>2013-05-27</discovery>
	<entry>2013-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="2eebebff-cd3b-11e2-8f09-001b38c3836c">
	<topic>xorg -- protocol handling issues in X Window System client libraries</topic>
	<affects>
	<package>
	<name>libX11</name>
	<range><lt>1.6.0</lt></range>
	</package>
	<package>
	<name>libXext</name>
	<range><lt>1.3.2</lt></range>
	</package>
	<package>
	<name>libXfixes</name>
	<range><lt>5.0.1</lt></range>
	</package>
	<package>
	<name>libXi</name>
	<range><lt>1.7_1</lt></range>
	</package>
	<package>
	<name>libXinerama</name>
	<range><lt>1.1.3</lt></range>
	</package>
	<package>
	<name>libXp</name>
	<range><lt>1.0.2</lt></range>
	</package>
	<package>
	<name>libXrandr</name>
	<range><lt>1.4.1</lt></range>
	</package>
	<package>
	<name>libXrender</name>
	<range><lt>0.9.7_1</lt></range>
	</package>
	<package>
	<name>libXres</name>
	<range><lt>1.0.7</lt></range>
	</package>
	<package>
	<name>libXtst</name>
	<range><lt>1.2.2</lt></range>
	</package>
	<package>
	<name>libXv</name>
	<range><lt>1.0.8</lt></range>
	</package>
	<package>
	<name>libXvMC</name>
	<range><lt>1.0.7_1</lt></range>
	</package>
	<package>
	<name>libXxf86dga</name>
	<range><lt>1.1.4</lt></range>
	</package>
	<package>
	<name>libdmx</name>
	<range><lt>1.1.3</lt></range>
	</package>
	<package>
	<name>libxcb</name>
	<range><lt>1.9.1</lt></range>
	</package>
	<package>
	<name>libGL</name>
	<range><lt>7.6.1_4</lt></range>
	<range><gt>7.8.0</gt><lt>8.0.5_4</lt></range>
	</package>
	<package>
	<name>xf86-video-openchrome</name>
	<range><lt>0.3.3</lt></range>
	</package>
	<package>
	<name>libFS</name>
	<range><lt>1.0.5</lt></range>
	</package>
	<package>
	<name>libXxf86vm</name>
	<range><lt>1.1.3</lt></range>
	</package>
	<package>
	<name>libXt</name>
	<range><lt>1.1.4</lt></range>
	</package>
	<package>
	<name>libXcursor</name>
	<range><lt>1.1.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>freedesktop.org reports:</p>
	<blockquote cite="http://www.x.org/wiki/Development/Security/Advisory-2013-05-23">
	<p>Ilja van Sprundel, a security researcher with IOActive, has
	discovered a large number of issues in the way various X client
	libraries handle the responses they receive from servers, and has
	worked with X.Org's security team to analyze, confirm, and fix
	these issues.</p>
	<p>Most of these issues stem from the client libraries trusting the
	server to send correct protocol data, and not verifying that the
	values will not overflow or cause other damage. Most of the time X
	clients & servers are run by the same user, with the server
	more privileged from the clients, so this is not a problem, but
	there are scenarios in which a privileged client can be connected
	to an unprivileged server, for instance, connecting a setuid X
	client (such as a screen lock program) to a virtual X server (such
	as Xvfb or Xephyr) which the user has modified to return invalid
	data, potentially allowing the user to escalate their privileges.</p>
	<p>The vulnerabilities include:</p>
	<p>Integer overflows calculating memory needs for replies.</p>
	<p>Sign extension issues calculating memory needs for replies.</p>
	<p>Buffer overflows due to not validating length or offset values in
	replies.</p>
	<p>Integer overflows parsing user-specified files.</p>
	<p>Unbounded recursion parsing user-specified files.</p>
	<p>Memory corruption due to unchecked return values.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1981</cvename>
	<cvename>CVE-2013-1982</cvename>
	<cvename>CVE-2013-1983</cvename>
	<cvename>CVE-2013-1984</cvename>
	<cvename>CVE-2013-1985</cvename>
	<cvename>CVE-2013-1986</cvename>
	<cvename>CVE-2013-1987</cvename>
	<cvename>CVE-2013-1988</cvename>
	<cvename>CVE-2013-1989</cvename>
	<cvename>CVE-2013-1990</cvename>
	<cvename>CVE-2013-1991</cvename>
	<cvename>CVE-2013-1992</cvename>
	<cvename>CVE-2013-1993</cvename>
	<cvename>CVE-2013-1994</cvename>
	<cvename>CVE-2013-1995</cvename>
	<cvename>CVE-2013-1996</cvename>
	<cvename>CVE-2013-1997</cvename>
	<cvename>CVE-2013-1998</cvename>
	<cvename>CVE-2013-1999</cvename>
	<cvename>CVE-2013-2000</cvename>
	<cvename>CVE-2013-2001</cvename>
	<cvename>CVE-2013-2002</cvename>
	<cvename>CVE-2013-2003</cvename>
	<cvename>CVE-2013-2004</cvename>
	<cvename>CVE-2013-2005</cvename>
	<cvename>CVE-2013-2062</cvename>
	<cvename>CVE-2013-2063</cvename>
	<cvename>CVE-2013-2064</cvename>
	<cvename>CVE-2013-2066</cvename>
	</references>
	<dates>
	<discovery>2013-05-23</discovery>
	<entry>2013-06-04</entry>
	</dates>
	</vuln>

	<vuln vid="e3f64457-cccd-11e2-af76-206a8a720317">
	<topic>krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><le>1.11.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>No advisory has been released yet.</p>
	<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
	<p>schpw.c in the kpasswd service in kadmind in MIT Kerberos 5
	(aka krb5) before 1.11.3 does not properly validate UDP packets
	before sending responses, which allows remote attackers to cause
	a denial of service (CPU and bandwidth consumption) via a forged
	packet that triggers a communication loop, as demonstrated by
	krb_pingpong.nasl, a related issue to CVE-1999-0103.
	[CVE-2002-2443].</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2002-2443</cvename>
	<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
	</references>
	<dates>
	<discovery>2013-05-10</discovery>
	<entry>2013-06-03</entry>
	</dates>
	</vuln>

	<vuln vid="0bf376b7-cc6b-11e2-a424-14dae938ec40">
	<topic>net/openafs -- buffer overflow</topic>
	<affects>
	<package>
	<name>openafs</name>
	<range><lt>1.6.2.*</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nickolai Zeldovich reports:</p>
	<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt">
	<p>An attacker with the ability to manipulate AFS directory ACLs may
	crash the fileserver hosting that volume.
	In addition, once a corrupt ACL is placed on a fileserver, its
	existence may crash client utilities manipulating ACLs
	on that server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt</url>
	<cvename>CVE-2013-1794</cvename>
	</references>
	<dates>
	<discovery>2013-02-27</discovery>
	<entry>2013-06-03</entry>
	</dates>
	</vuln>

	<vuln vid="9dfb63b8-8f36-11e2-b34d-000c2957946c">
	<topic>www/mod_security -- NULL pointer dereference DoS</topic>
	<affects>
	<package>
	<name>mod_security</name>
	<range><lt>2.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/526746">
	<p>When ModSecurity receives a request body with a size bigger than the
	value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type"
	that has no request body processor mapped to it, ModSecurity will
	systematically crash on every call to "forceRequestBodyVariable".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2765</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765</url>
	</references>
	<dates>
	<discovery>2013-05-27</discovery>
	<entry>2013-06-03</entry>
	</dates>
	</vuln>

	<vuln vid="1225549f-ca91-11e2-b3b8-f0def16c5c1b">
	<topic>passenger -- security vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-passenger</name>
	<range><lt>4.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Phusion reports:</p>
	<blockquote cite="http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/">
	<p>A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2119</cvename>
	<url>http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/</url>
	</references>
	<dates>
	<discovery>2013-05-29</discovery>
	<entry>2013-06-01</entry>
	</dates>
	</vuln>

	<vuln vid="ce502902-ca39-11e2-9673-001e8c75030d">
	<topic>devel/subversion -- svnserve remotely triggerable DoS</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
	<range><ge>1.0.0</ge><lt>1.6.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion team reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-2112-advisory.txt">
	<p>Subversion's svnserve server process may exit when an incoming TCP connection
	is closed early in the connection process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2112</cvename>
	</references>
	<dates>
	<discovery>2013-05-31</discovery>
	<entry>2013-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="6d0bf320-ca39-11e2-9673-001e8c75030d">
	<topic>devel/subversion -- contrib hook-scripts can allow arbitrary code execution</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
	<range><ge>1.2.0</ge><lt>1.6.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion team reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-2088-advisory.txt">
	<p>The script contrib/hook-scripts/check-mime-type.pl does not escape
	argv arguments to 'svnlook' that start with a hyphen. This could be
	used to cause 'svnlook', and hence check-mime-type.pl, to error out.</p>
	<p>The script contrib/hook-scripts/svn-keyword-check.pl parses filenames
	from the output of 'svnlook changed' and passes them to a further
	shell command (equivalent to the 'system()' call of the C standard
	library) without escaping them. This could be used to run arbitrary
	shell commands in the context of the user whom the pre-commit script
	runs as (the user who owns the repository).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2088</cvename>
	</references>
	<dates>
	<discovery>2013-05-31</discovery>
	<entry>2013-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="787d21b9-ca38-11e2-9673-001e8c75030d">
	<topic>devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
	<range><ge>1.1.0</ge><lt>1.6.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion team reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1968-advisory.txt">
	<p>If a filename which contains a newline character (ASCII 0x0a) is
	committed to a repository using the FSFS format, the resulting
	revision is corrupt.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1968</cvename>
	</references>
	<dates>
	<discovery>2013-05-31</discovery>
	<entry>2013-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="0a799a8e-c9d4-11e2-a424-14dae938ec40">
	<topic>irc/bitchx -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>BitchX</name>
	<range><lt>1.2.*,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>bannedit reports:</p>
	<blockquote cite="http://www.cvedetails.com/cve/CVE-2007-4584/">
	<p>Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC
	servers to execute arbitrary code via a long string in a MODE
	command, related to the p_mode variable.</p>
	</blockquote>
	<p>Nico Golde reports:</p>
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449149">
	<p>There is a security issue in ircii-pana in bitchx' hostname
	command. The e_hostname function (commands.c) uses tmpnam to
	create a temporary file which is known to be insecure.</p>
	</blockquote>
	<p>Chris reports:</p>
	<blockquote cite="http://secunia.com/advisories/27556">
	<p>Chris has reported a vulnerability in the Cypress script for
	BitchX, which can be exploited by malicious people to disclose
	potentially sensitive information or to compromise a vulnerable
	system.</p>

	<p>The vulnerability is caused due to malicious code being present
	in the modules/mdop.m file. This can be exploited to disclose the
	content of various system files or to execute arbitrary shell
	commands.</p>

	<p>Successful exploitation allows execution of arbitrary code, but
	requires the control of the "lsyn.webhop.net" domain.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4584</cvename>
	<cvename>CVE-2007-5839</cvename>
	<cvename>CVE-2007-5922</cvename>
	</references>
	<dates>
	<discovery>2007-08-28</discovery>
	<entry>2013-05-31</entry>
	</dates>
	</vuln>

	<vuln vid="19751e06-c798-11e2-a373-000c29833058">
	<topic>znc -- null pointer dereference in webadmin module</topic>
	<affects>
	<package>
	<name>znc</name>
	<range><lt>1.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>No advisory has been released yet.</p>
	<blockquote cite="https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28">
	<p>Fix NULL pointer dereference in webadmin.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28</url>
	</references>
	<dates>
	<discovery>2013-05-27</discovery>
	<entry>2013-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="6d87c2e9-c64d-11e2-9c22-50465d9ff992">
	<topic>socat -- FD leak</topic>
	<affects>
	<package>
	<name>socat</name>
	<range><lt>1.7.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gerhard Rieger reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2013/q2/411">
	<p>Under certain circumstances an FD leak occurs and can be misused for
	denial of service attacks against socat running in server mode.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3571</cvename>
	<url>http://seclists.org/oss-sec/2013/q2/411</url>
	</references>
	<dates>
	<discovery>2013-05-26</discovery>
	<entry>2013-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="79789daa-8af8-4e21-a47f-e8a645752bdb">
	<topic>ruby -- Object taint bypassing in DL and Fiddle in Ruby</topic>
	<affects>
	<package>
	<name>ruby19</name>
	<range><lt>1.9.3.429,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby Developers report:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/">
	<p>There is a vulnerability in DL and Fiddle in Ruby where tainted
	strings can be used by system calls regardless of the $SAFE level
	set in Ruby.
	</p>
	<p>Native functions exposed to Ruby with DL or Fiddle do not check the
	taint values set on the objects passed in. This can result in
	tainted objects being accepted as input when a SecurityError
	exception should be raised.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2065</cvename>
	<url>http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/</url>
	</references>
	<dates>
	<discovery>2013-05-14</discovery>
	<entry>2013-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="4fb45a1c-c5d0-11e2-8400-001b216147b0">
	<topic>couchdb -- DOM based Cross-Site Scripting via Futon UI</topic>
	<affects>
	<package>
	<name>couchdb</name>
	<range><lt>1.2.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Lehnardt reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E">
	<p>Query parameters passed into the browser-based test suite
	are not sanitised, and can be used to load external resources.
	An attacker may execute JavaScript code in the browser, using
	the context of the remote user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5650</cvename>
	<url>http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E</url>
	</references>
	<dates>
	<discovery>2012-01-14</discovery>
	<entry>2013-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="a5b24a6b-c37c-11e2-addb-60a44c524f57">
	<topic>otrs -- information disclosure</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/">
	<p>An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3551</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/</url>
	</references>
	<dates>
	<discovery>2013-05-22</discovery>
	<entry>2013-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="661bd031-c37d-11e2-addb-60a44c524f57">
	<topic>otrs -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/">
	<p>An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2637</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/</url>
	</references>
	<dates>
	<discovery>2013-04-02</discovery>
	<entry>2013-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="3a429192-c36a-11e2-97a9-6805ca0b3d42">
	<topic>RT -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rt38</name>
	<range><ge>3.8</ge><lt>3.8.17</lt></range>
	</package>
	<package>
	<name>rt40</name>
	<range><ge>4.0</ge><lt>4.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thomas Sibley reports:</p>
	<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html">
	<p>We discovered a number of security vulnerabilities which
	affect both RT 3.8.x and RT 4.0.x. We are releasing RT
	versions 3.8.17 and 4.0.13 to resolve these vulnerabilities,
	as well as patches which apply atop all released versions of
	3.8 and 4.0.</p>
	<p>The vulnerabilities addressed by 3.8.17, 4.0.13, and the
	below patches include the following:</p>
	<p>RT 4.0.0 and above are vulnerable to a limited privilege
	escalation leading to unauthorized modification of ticket
	data. The DeleteTicket right and any custom lifecycle
	transition rights may be bypassed by any user with
	ModifyTicket. This vulnerability is assigned
	CVE-2012-4733.</p>
	<p>RT 3.8.0 and above include a version of bin/rt that uses
	semi-predictable names when creating tempfiles. This could
	possibly be exploited by a malicious user to overwrite files
	with permissions of the user running bin/rt. This
	vulnerability is assigned CVE-2013-3368.</p>
	<p>RT 3.8.0 and above allow calling of arbitrary Mason
	components (without control of arguments) for users who can
	see administration pages. This could be used by a malicious
	user to run private components which may have negative
	side-effects. This vulnerability is assigned
	CVE-2013-3369.</p>
	<p>RT 3.8.0 and above allow direct requests to private
	callback components. Though no callback components ship
	with RT, this could be used to exploit an extension or local
	callback which uses the arguments passed to it insecurely.
	This vulnerability is assigned CVE-2013-3370.</p>
	<p>RT 3.8.3 and above are vulnerable to cross-site scripting
	(XSS) via attachment filenames. The vector is difficult to
	exploit due to parsing requirements. Additionally, RT 4.0.0
	and above are vulnerable to XSS via maliciously-crafted
	"URLs" in ticket content when RT's "MakeClicky" feature is
	configured. Although not believed to be exploitable in the
	stock configuration, a patch is also included for RTIR 2.6.x
	to add bulletproofing. These vulnerabilities are assigned
	CVE-2013-3371.</p>
	<p>RT 3.8.0 and above are vulnerable to an HTTP header
	injection limited to the value of the Content-Disposition
	header. Injection of other arbitrary response headers is
	not possible. Some (especially older) browsers may allow
	multiple Content-Disposition values which could lead to XSS.
	Newer browsers contain security measures to prevent this.
	Thank you to Dominic Hargreaves for reporting this
	vulnerability. This vulnerability is assigned
	CVE-2013-3372.</p>
	<p>RT 3.8.0 and above are vulnerable to a MIME header
	injection in outgoing email generated by RT. The vectors
	via RT's stock templates are resolved by this patchset, but
	any custom email templates should be updated to ensure that
	values interpolated into mail headers do not contain
	newlines. This vulnerability is assigned CVE-2013-3373.</p>
	<p>RT 3.8.0 and above are vulnerable to limited session
	re-use when using the file-based session store,
	Apache::Session::File. RT's default session configuration
	only uses Apache::Session::File for Oracle. RT instances
	using Oracle may be locally configured to use the
	database-backed Apache::Session::Oracle, in which case
	sessions are never re-used. The extent of session re-use is
	limited to information leaks of certain user preferences and
	caches, such as queue names available for ticket creation.
	Thank you to Jenny Martin for reporting the problem that
	lead to discovery of this vulnerability. This vulnerability
	is assigned CVE-2013-3374.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html</url>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html</url>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html</url>
	<cvename>CVE-2012-4733</cvename>
	<cvename>CVE-2013-3368</cvename>
	<cvename>CVE-2013-3369</cvename>
	<cvename>CVE-2013-3370</cvename>
	<cvename>CVE-2013-3371</cvename>
	<cvename>CVE-2013-3372</cvename>
	<cvename>CVE-2013-3373</cvename>
	<cvename>CVE-2013-3374</cvename>
	</references>
	<dates>
	<discovery>2013-05-22</discovery>
	<entry>2013-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="c72a2494-c08b-11e2-bb21-083e8ed0f47b">
	<topic>plib -- stack-based buffer overflow</topic>
	<affects>
	<package>
	<name>plib</name>
	<range><lt>1.8.5_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4552">
	<p>Stack-based buffer overflow in the error function in
	ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to
	execute arbitrary code via a crafted 3d model file that
	triggers a long error message, as demonstrated by a .ase
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>55839</bid>
	<cvename>CVE-2012-4552</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2012/10/29/8</mlist>
	</references>
	<dates>
	<discovery>2012-10-09</discovery>
	<entry>2013-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="13bf0602-c08a-11e2-bb21-083e8ed0f47b">
	<topic>plib -- buffer overflow</topic>
	<affects>
	<package>
	<name>plib</name>
	<range><lt>1.8.5_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="https://secunia.com/advisories/47297">
	<p>A vulnerability has been discovered in PLIB, which can be
	exploited by malicious people to compromise an application
	using the library. The vulnerability is caused due to a
	boundary error within the "ulSetError()" function
	(src/util/ulError.cxx) when creating the error message,
	which can be exploited to overflow a static buffer.</p>
	<p>Successful exploitation allows the execution of arbitrary
	code but requires that the attacker can e.g. control the
	content of an overly long error message passed to the
	"ulSetError()" function.</p>
	<p>The vulnerability is confirmed in version 1.8.5. Other
	versions may also be affected.</p>
	<p>Originally reported in TORCS by Andres Gomez.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4620</cvename>
	<mlist>http://openwall.com/lists/oss-security/2011/12/21/2</mlist>
	</references>
	<dates>
	<discovery>2011-12-21</discovery>
	<entry>2013-05-19</entry>
	</dates>
	</vuln>

	<vuln vid="a0c65049-bddd-11e2-a0f6-001060e06fd4">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.285</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-14.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2728</cvename>
	<cvename>CVE-2013-3324</cvename>
	<cvename>CVE-2013-3325</cvename>
	<cvename>CVE-2013-3326</cvename>
	<cvename>CVE-2013-3327</cvename>
	<cvename>CVE-2013-3328</cvename>
	<cvename>CVE-2013-3329</cvename>
	<cvename>CVE-2013-3330</cvename>
	<cvename>CVE-2013-3331</cvename>
	<cvename>CVE-2013-3332</cvename>
	<cvename>CVE-2013-3333</cvename>
	<cvename>CVE-2013-3334</cvename>
	<cvename>CVE-2013-3335</cvename>
	</references>
	<dates>
	<discovery>2013-05-14</discovery>
	<entry>2013-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>21.0,1</lt></range>
	<range><lt>17.0.6,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.6,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.17.1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.6</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.17.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0
	/ rv:17.0.6)</p>
	<p>MFSA 2013-42 Privileged access for content level constructor</p>
	<p>MFSA 2013-43 File input control has access to full path</p>
	<p>MFSA 2013-44 Local privilege escalation through Mozilla
	Maintenance Service</p>
	<p>MFSA 2013-45 Mozilla Updater fails to update some Windows Registry
	entries</p>
	<p>MFSA 2013-46 Use-after-free with video and onresize event</p>
	<p>MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent</p>
	<p>MFSA 2013-48 Memory corruption found using Address Sanitizer</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1942</cvename>
	<cvename>CVE-2013-0801</cvename>
	<cvename>CVE-2013-1669</cvename>
	<cvename>CVE-2013-1670</cvename>
	<cvename>CVE-2013-1671</cvename>
	<cvename>CVE-2013-1672</cvename>
	<cvename>CVE-2013-1674</cvename>
	<cvename>CVE-2013-1675</cvename>
	<cvename>CVE-2013-1676</cvename>
	<cvename>CVE-2013-1677</cvename>
	<cvename>CVE-2013-1678</cvename>
	<cvename>CVE-2013-1679</cvename>
	<cvename>CVE-2013-1680</cvename>
	<cvename>CVE-2013-1681</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-41.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-42.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-43.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-44.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-45.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-46.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-47.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-48.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-05-14</discovery>
	<entry>2013-05-15</entry>
	<modified>2013-05-21</modified>
	</dates>
	</vuln>

	<vuln vid="efaa4071-b700-11e2-b1b9-f0def16c5c1b">
	<topic>nginx -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><ge>1.2.0,1</ge><le>1.2.8,1</le></range>
	<range><ge>1.3.0,1</ge><lt>1.4.1,1</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><ge>1.1.4</ge><le>1.2.8</le></range>
	<range><ge>1.3.0</ge><lt>1.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	<p>A stack-based buffer overflow might occur in a worker process
	process while handling a specially crafted request, potentially
	resulting in arbitrary code execution. [CVE-2013-2028]</p>
	<p>A security problem related to CVE-2013-2028 was identified,
	affecting some previous nginx versions if proxy_pass to
	untrusted upstream HTTP servers is used.</p>
	<p>The problem may lead to a denial of service or a disclosure of a
	worker process memory on a specially crafted response from an
	upstream proxied server. [CVE-2013-2070]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2028</cvename>
	<cvename>CVE-2013-2070</cvename>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html</url>
	<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html</url>
	</references>
	<dates>
	<discovery>2013-05-07</discovery>
	<entry>2013-05-07</entry>
	<modified>2013-05-16</modified>
	</dates>
	</vuln>

	<vuln vid="6ff570cb-b418-11e2-b279-20cf30e32f6d">
	<topic>strongSwan -- ECDSA signature verification issue</topic>
	<affects>
	<package>
	<name>strongswan</name>
	<range><lt>5.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>strongSwan security team reports:</p>
	<blockquote cite="http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html">
	<p>If the openssl plugin is used for ECDSA signature verification an empty,
	zeroed or otherwise invalid signature is handled as a legitimate one.
	Both IKEv1 and IKEv2 are affected.</p>
	<p>Affected are only installations that have enabled and loaded the OpenSSL
	crypto backend (--enable-openssl). Builds using the default crypto backends
	are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2944</cvename>
	</references>
	<dates>
	<discovery>2013-04-30</discovery>
	<entry>2013-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="622e14b1-b40c-11e2-8441-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.514</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02">
	<p>This advisory announces multiple security vulnerabilities that
	were found in Jenkins core.</p>
	<ol>
	<li>
	<p>SECURITY-63 / CVE-2013-2034</p>
	<p>This creates a cross-site request forgery (CSRF) vulnerability
	on Jenkins master, where an anonymous attacker can trick an
	administrator to execute arbitrary code on Jenkins master by
	having him open a specifically crafted attack URL.</p>
	<p>There's also a related vulnerability where the permission
	check on this ability is done imprecisely, which may affect
	those who are running Jenkins instances with a custom
	authorization strategy plugin.</p>
	</li>
	<li>
	<p>SECURITY-67 / CVE-2013-2033</p>
	<p>This creates a cross-site scripting (XSS) vulnerability, where
	an attacker with a valid user account on Jenkins can execute
	JavaScript in the browser of other users, if those users are
	using certain browsers.</p>
	</li>
	<li>
	<p>SECURITY-69 / CVE-2013-2034</p>
	<p>This is another CSRF vulnerability that allows an attacker to
	cause a deployment of binaries to Maven repositories. This
	vulnerability has the same CVE ID as SEUCRITY-63.</p>
	</li>
	<li>
	<p>SECURITY-71 / CVE-2013-1808</p>
	<p>This creates a cross-site scripting (XSS) vulnerability.</p>
	</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02</url>
	<cvename>CVE-2013-2034</cvename>
	<cvename>CVE-2013-2033</cvename>
	<cvename>CVE-2013-2034</cvename>
	<cvename>CVE-2013-1808</cvename>
	</references>
	<dates>
	<discovery>2013-05-02</discovery>
	<entry>2013-05-03</entry>
	</dates>
	</vuln>

	<vuln vid="e66a6e2f-b0d5-11e2-9164-0016e6dcb562">
	<topic>FreeBSD -- NFS remote denial of service</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_8</lt></range>
	<range><ge>9.1</ge><lt>9.1_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc">
	<p>Insufficient input validation in the NFS server allows an
	attacker to cause the underlying file system to treat a
	regular file as a directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3266</cvename>
	<freebsdsa>SA-13:05.nfsserver</freebsdsa>
	</references>
	<dates>
	<discovery>2013-04-21</discovery>
	<entry>2013-04-29</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="57df803e-af34-11e2-8d62-6cf0490a8c18">
	<topic>Joomla! -- XXS and DDoS vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla</name>
	<range><ge>2.0.*</ge><lt>2.5.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The JSST and the Joomla! Security Center report:</p>
	<blockquote cite="http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html">
	<h2>[20130405] - Core - XSS Vulnerability</h2>
	<p>Inadequate filtering leads to XSS vulnerability in Voting plugin.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html">
	<h2>[20130403] - Core - XSS Vulnerability</h2>
	<p>Inadequate filtering allows possibility of XSS exploit in some
	circumstances.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/82-20130402-core-information-disclosure.html">
	<h2>[20130402] - Core - Information Disclosure</h2>
	<p>Inadequate permission checking allows unauthorised user to see
	permission settings in some circumstances.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html">
	<h2>[20130404] - Core - XSS Vulnerability</h2>
	<p>Use of old version of Flash-based file uploader leads to XSS
	vulnerability.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html">
	<h2>[20130401] - Core - Privilege Escalation</h2>
	<p>Inadequate permission checking allows unauthorised user to delete
	private messages.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/85-20130406-core-dos-vulnerability.html">
	<h2>[20130406] - Core - DOS Vulnerability</h2>
	<p>Object unserialize method leads to possible denial of service
	vulnerability.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html">
	<h2>[20130407] - Core - XSS Vulnerability</h2>
	<p>Inadequate filtering leads to XSS vulnerability in highlighter
	plugin</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3059</cvename>
	<cvename>CVE-2013-3058</cvename>
	<cvename>CVE-2013-3057</cvename>
	<url>http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html</url>
	<cvename>CVE-2013-3056</cvename>
	<cvename>CVE-2013-3242</cvename>
	<cvename>CVE-2013-3267</cvename>
	</references>
	<dates>
	<discovery>2013-04-24</discovery>
	<entry>2013-04-27</entry>
	</dates>
	</vuln>

	<vuln vid="8c8fa44d-ad15-11e2-8cea-6805ca0b3d42">
	<topic>phpMyAdmin -- Multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>3.5</ge><lt>3.5.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php">
	<p>In some PHP versions, the preg_replace() function can be
	tricked into executing arbitrary PHP code on the
	server. This is done by passing a crafted argument as the
	regular expression, containing a null byte. phpMyAdmin does
	not correctly sanitize an argument passed to preg_replace()
	when using the "Replace table prefix" feature, opening the
	way to this vulnerability..</p>
	<p>This vulnerability can be triggered only by someone who
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users to access the required
	form.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php">
	<p>phpMyAdmin can be configured to save an export file on
	the web server, via its SaveDir directive. With this in
	place, it's possible, either via a crafted filename template
	or a crafted table name, to save a double extension file
	like foobar.php.sql. In turn, an Apache webserver on which
	there is no definition for the MIME type "sql" (the default)
	will treat this saved file as a ".php" script, leading to
	remote code execution.</p>
	<p>This vulnerability can be triggered only by someone who
	logged in to phpMyAdmin, as the usual token protection
	prevents non-logged-in users to access the required
	form. Moreover, the SaveDir directive is empty by default,
	so a default configuration is not vulnerable. The
	$cfg['SaveDir'] directive must be configured, and the server
	must be running Apache with mod_mime to be exploitable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-3238</cvename>
	<cvename>CVE-2013-3239</cvename>
	</references>
	<dates>
	<discovery>2013-04-24</discovery>
	<entry>2013-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="aeb962f6-ab8d-11e2-b3f5-003067c2616f">
	<topic>tinc -- Buffer overflow</topic>
	<affects>
	<package>
	<name>tinc</name>
	<range><lt>1.0.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>tinc-vpn.org reports:</p>
	<blockquote cite="http://www.tinc-vpn.org/news/">
	<p>Drop packets forwarded via TCP if they are too big.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1428</cvename>
	</references>
	<dates>
	<discovery>2013-01-26</discovery>
	<entry>2013-04-22</entry>
	</dates>
	</vuln>

	<vuln vid="7280c3f6-a99a-11e2-8cef-6805ca0b3d42">
	<topic>phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>3.5</ge><lt>3.5.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php">
	<p> When modifying a URL parameter with a crafted value it
	is possible to trigger an XSS.</p>
	<p>These XSS can only be triggered when a valid database is
	known and when a valid cookie token is used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1937</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php</url>
	</references>
	<dates>
	<discovery>2013-04-18</discovery>
	<entry>2013-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="a592e991-a919-11e2-ade0-8c705af55518">
	<topic>roundcube -- arbitrary file disclosure vulnerability</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>0.8.6,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RoundCube development team reports:</p>
	<blockquote cite="http://lists.roundcube.net/pipermail/dev/2013-March/022337.html">
	<p>After getting reports about a possible vulnerability
	of Roundcube which allows an attacker to modify its
	users preferences in a way that he/she can then read
	files from the server, we now published updated packages
	as well as patches that fix this security issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1904</cvename>
	<url>https://secunia.com/advisories/52806/</url>
	</references>
	<dates>
	<discovery>2013-03-27</discovery>
	<entry>2013-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="8ff84335-a7da-11e2-b3f5-003067c2616f">
	<topic>jasper -- buffer overflow</topic>
	<affects>
	<package>
	<name>jasper</name>
	<range><lt>1.900.1_12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fedora reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/887409">
	<p>JasPer fails to properly decode marker segments and other
	sections in malformed JPEG2000 files. Malformed inputs can
	cause heap buffer overflows which in turn may result in
	execution of attacker-controlled code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3520</cvename>
	<cvename>CVE-2008-3522</cvename>
	<cvename>CVE-2011-4516</cvename>
	<cvename>CVE-2011-4517</cvename>
	<url>http://www.kb.cert.org/vuls/id/887409</url>
	</references>
	<dates>
	<discovery>2011-12-09</discovery>
	<entry>2013-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="2070c79a-8e1e-11e2-b34d-000c2957946c">
	<topic>ModSecurity -- XML External Entity Processing Vulnerability</topic>
	<affects>
	<package>
	<name>mod_security</name>
	<range><gt>2.*</gt><lt>2.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Positive Technologies has reported a vulnerability in ModSecurity,
	which can be exploited by malicious people to disclose potentially
	sensitive information or cause a DoS (Denial Of Serice).</p>
	<p>The vulnerability is caused due to an error when parsing external
	XML entities and can be exploited to e.g. disclose local files or
	cause excessive memory and CPU consumption.</p>
	<blockquote cite="https://secunia.com/advisories/52847/">
	<p>.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1915</cvename>
	<url>https://secunia.com/advisories/52847/</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915</url>
	<url>https://bugs.gentoo.org/show_bug.cgi?id=464188</url>
	</references>
	<dates>
	<discovery>2013-04-02</discovery>
	<entry>2013-04-16</entry>
	</dates>
	</vuln>

	<vuln vid="a2ff483f-a5c6-11e2-9601-000d601460a4">
	<topic>sieve-connect -- TLS hostname verification was not occurring</topic>
	<affects>
	<package>
	<name>sieve-connect</name>
	<range><lt>0.85</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>sieve-connect developer Phil Pennock reports:</p>
	<blockquote cite="http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html">
	<p>sieve-connect was not actually verifying TLS certificate identities
	matched the expected hostname.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html</url>
	</references>
	<dates>
	<discovery>2013-04-14</discovery>
	<entry>2013-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="15236023-a21b-11e2-a460-208984377b34">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.280</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-12.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1383</cvename>
	<cvename>CVE-2013-1384</cvename>
	<cvename>CVE-2013-1385</cvename>
	<cvename>CVE-2013-1386</cvename>
	</references>
	<dates>
	<discovery>2013-04-09</discovery>
	<entry>2013-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="db0c4b00-a24c-11e2-9601-000d601460a4">
	<topic>rubygem-rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.13</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.13</lt></range>
	</package>
	<package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.13</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails team reports:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/">
	<p>Rails versions 3.2.13 has been released. This release
	contains important security fixes. It is recommended
	users upgrade as soon as possible.</p>
	<p>Four vulnerabilities have been discovered and fixed:</p>
	<ol>
	<li>(CVE-2013-1854) Symbol DoS vulnerability in Active Record</li>
	<li>(CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack</li>
	<li>(CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users</li>
	<li>(CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1854</cvename>
	<cvename>CVE-2013-1856</cvename>
	<cvename>CVE-2013-1856</cvename>
	<cvename>CVE-2013-1857</cvename>
	<url>http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/</url>
	<url>https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI</url>
	</references>
	<dates>
	<discovery>2013-03-18</discovery>
	<entry>2013-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="1431f2d6-a06e-11e2-b9e0-001636d274f3">
	<topic>NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode</topic>
	<affects>
	<package>
	<name>nvidia-driver</name>
	<range><ge>310.14</ge><lt>310.44</lt></range>
	<range><ge>195.22</ge><lt>304.88</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVIDIA Unix security team reports:</p>
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3290">
	<p>When the NVIDIA driver for the X Window System is operated in
	"NoScanout" mode, and an X client installs an ARGB cursor that
	is larger than the expected size (64x64 or 256x256, depending on
	the driver version), the driver will overflow a buffer. This
	can cause a denial of service (e.g., an X server segmentation
	fault), or could be exploited to achieve arbitrary code
	execution. Because the X server runs as setuid root in many
	configurations, an attacker could potentially use this
	vulnerability in those configurations to gain root privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0131</cvename>
	<url>http://nvidia.custhelp.com/app/answers/detail/a_id/3290</url>
	</references>
	<dates>
	<discovery>2013-03-27</discovery>
	<entry>2013-04-08</entry>
	</dates>
	</vuln>

	<vuln vid="cebed39d-9e6f-11e2-b3f5-003067c2616f">
	<topic>opera -- moderately severe issue</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>12.15</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><lt>12.15</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>12.15</lt></range>
	</package>
	<package>
	<name>linux-opera-devel</name>
	<range><lt>12.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/kb/view/1042/">
	<p>Fixed a moderately severe issue, as reported by Attila Suszte.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/docs/changelogs/unified/1215/</url>
	<url>http://www.opera.com/support/kb/view/1046/</url>
	<url>http://www.opera.com/support/kb/view/1047/</url>
	</references>
	<dates>
	<discovery>2013-04-04</discovery>
	<entry>2014-04-30</entry>
	</dates>
	</vuln>

	<vuln vid="b6beb137-9dc0-11e2-882f-20cf30e32f6d">
	<topic>Subversion -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
	<range><ge>1.0.0</ge><lt>1.6.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion team reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1845-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will use excessive
	amounts of memory when a large number of properties are set or deleted
	on a node.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1846-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when
	a LOCK request is made against activity URLs.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1847-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash in some
	circumstances when a LOCK request is made against a non-existent URL.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1849-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
	PROPFIND request is made against activity URLs.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1884-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
	log REPORT request receives a limit that is out of the allowed range.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1845</cvename>
	<cvename>CVE-2013-1846</cvename>
	<cvename>CVE-2013-1847</cvename>
	<cvename>CVE-2013-1849</cvename>
	<cvename>CVE-2013-1884</cvename>
	</references>
	<dates>
	<discovery>2013-04-05</discovery>
	<entry>2013-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="eae8e3cf-9dfe-11e2-ac7f-001fd056c417">
	<topic>otrs -- Information disclosure and Data manipulation</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/">
	<p>An attacker with a valid agent login could manipulate URLs in the
	object linking mechanism to see titles of tickets and other objects
	that are not obliged to be seen. Furthermore, links to objects without
	permission can be placed and removed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2625</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/</url>
	</references>
	<dates>
	<discovery>2013-04-02</discovery>
	<entry>2013-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="3f332f16-9b6b-11e2-8fe9-08002798f6ff">
	<topic>PostgreSQL -- anonymous remote access data corruption vulnerability</topic>
	<affects>
	<package>
	<name>postgresql-server</name>
	<range><ge>8.3.0</ge><lt>8.3.21_1</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.17</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.13</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.9</lt></range>
	<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1456/">
	<p>
	The PostgreSQL Global Development Group has released a security
	update to all current versions of the PostgreSQL database system,
	including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
	fixes a high-exposure security vulnerability in versions 9.0 and
	later. All users of the affected versions are strongly urged to apply
	the update immediately.
	</p>
	<p>
	A major security issue (for versions 9.x only) fixed in this release,
	[CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
	makes it possible for a connection request containing a database name
	that begins with "-" to be crafted that can damage or destroy files
	within a server's data directory. Anyone with access to the port the
	PostgreSQL server listens on can initiate this request. This issue was
	discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
	Software Center.
	</p>
	<p>
	Two lesser security fixes are also included in this release:
	[CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900),
	wherein random numbers generated by contrib/pgcrypto functions may be
	easy for another database user to guess (all versions), and
	[CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901),
	which mistakenly allows an unprivileged user to run commands that
	could interfere with in-progress backups (for versions 9.x only).
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1899</cvename>
	<cvename>CVE-2013-1900</cvename>
	<cvename>CVE-2013-1901</cvename>
	</references>
	<dates>
	<discovery>2013-04-04</discovery>
	<entry>2013-04-04</entry>
	</dates>
	</vuln>

	<vuln vid="94976433-9c74-11e2-a9fc-d43d7e0c7c02">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>20.0,1</lt></range>
	<range><lt>17.0.5,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.5,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.17</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.5</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.17</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 /
	rv:17.0.5)</p>
	<p>MFSA 2013-31 Out-of-bounds write in Cairo library</p>
	<p>MFSA 2013-32 Privilege escalation through Mozilla Maintenance
	Service</p>
	<p>MFSA 2013-33 World read and write access to app_tmp directory on
	Android</p>
	<p>MFSA 2013-34 Privilege escalation through Mozilla Updater</p>
	<p>MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux</p>
	<p>MFSA 2013-36 Bypass of SOW protections allows cloning of protected
	nodes</p>
	<p>MFSA 2013-37 Bypass of tab-modal dialog origin disclosure</p>
	<p>MFSA 2013-38 Cross-site scripting (XSS) using timed history
	navigations</p>
	<p>MFSA 2013-39 Memory corruption while rendering grayscale PNG
	images</p>
	<p>MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0788</cvename>
	<cvename>CVE-2013-0789</cvename>
	<cvename>CVE-2013-0790</cvename>
	<cvename>CVE-2013-0791</cvename>
	<cvename>CVE-2013-0792</cvename>
	<cvename>CVE-2013-0793</cvename>
	<cvename>CVE-2013-0794</cvename>
	<cvename>CVE-2013-0795</cvename>
	<cvename>CVE-2013-0796</cvename>
	<cvename>CVE-2013-0797</cvename>
	<cvename>CVE-2013-0798</cvename>
	<cvename>CVE-2013-0799</cvename>
	<cvename>CVE-2013-0800</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-30.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-31.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-32.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-33.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-34.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-35.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-36.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-37.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-38.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-39.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-04-02</discovery>
	<entry>2013-04-03</entry>
	<modified>2013-04-08</modified>
	</dates>
	</vuln>

	<vuln vid="13031d98-9bd1-11e2-a7be-8c705af55518">
	<topic>FreeBSD -- BIND remote denial of service</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.0_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:04.bind.asc">
	<p>A flaw in a library used by BIND allows an
	attacker to deliberately cause excessive memory
	consumption by the named(8) process. This
	affects both recursive and authoritative
	servers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2266</cvename>
	<freebsdsa>SA-13:04.bind</freebsdsa>
	<url>https://kb.isc.org/article/AA-00871</url>
	</references>
	<dates>
	<discovery>2013-04-02</discovery>
	<entry>2013-04-02</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="69bfc852-9bd0-11e2-a7be-8c705af55518">
	<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_7</lt></range>
	<range><ge>9.0</ge><lt>9.0_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:03.openssl.asc">
	<p>A flaw in the OpenSSL handling of OCSP response
	verification could be exploited to cause a denial of
	service attack.</p>
	<p>OpenSSL has a weakness in the handling of CBC
	ciphersuites in SSL, TLS and DTLS. The weakness could reveal
	plaintext in a timing attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0166</cvename>
	<cvename>CVE-2013-0169</cvename>
	<freebsdsa>SA-13:03.openssl</freebsdsa>
	<url>http://www.openssl.org/news/secadv_20130205.txt</url>
	</references>
	<dates>
	<discovery>2013-04-02</discovery>
	<entry>2013-04-02</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="92f30415-9935-11e2-ad4c-080027ef73ec">
	<topic>OpenVPN -- potential side-channel/timing attack when comparing HMACs</topic>
	<affects>
	<package>
	<name>openvpn</name>
	<range><lt>2.0.9_4</lt></range>
	<range><ge>2.1.0</ge><lt>2.2.2_2</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenVPN project reports:</p>
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc">
	<p>OpenVPN 2.3.0 and earlier running in UDP mode are subject
	to chosen ciphertext injection due to a non-constant-time
	HMAC comparison function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc</url>
	<cvename>CVE-2013-2061</cvename>
	<url>http://www.openwall.com/lists/oss-security/2013/05/06/6</url>
	<url>https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee</url>
	</references>
	<dates>
	<discovery>2013-03-19</discovery>
	<entry>2013-03-31</entry>
	<modified>2013-06-01</modified>
	</dates>
	</vuln>

	<vuln vid="843a4641-9816-11e2-9c51-080027019be0">
	<topic>libxml2 -- cpu consumption Dos</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kurt Seifried reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2013/q1/391">
	<p>libxml2 is affected by the expansion of internal entities
	(which can be used to consume resources) and external entities
	(which can cause a denial of service against other services,
	be used to port scan, etc.)..</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0338</cvename>
	<cvename>CVE-2013-0339</cvename>
	<url>http://seclists.org/oss-sec/2013/q1/391</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2013-0338</url>
	<url>https://security-tracker.debian.org/tracker/CVE-2013-0339</url>
	</references>
	<dates>
	<discovery>2013-02-21</discovery>
	<entry>2013-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="daf0a339-9850-11e2-879e-d43d7e0c7c02">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><gt>11.*</gt><lt>11.2.2</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.12.2</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.20.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Buffer Overflow Exploit Through SIP SDP Header</p>
	<p>Username disclosure in SIP channel driver</p>
	<p>Denial of Service in HTTP server</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2685</cvename>
	<cvename>CVE-2013-2686</cvename>
	<cvename>CVE-2013-2264</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-001.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-002.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2013-003.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2013-03-27</discovery>
	<entry>2013-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="7a282e49-95b6-11e2-8433-0800273fe665">
	<topic>dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.2.2</lt></range>
	</package>
	<package>
	<name>bind99-base</name>
	<range><lt>9.9.2.2</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.4.2</lt></range>
	</package>
	<package>
	<name>bind98-base</name>
	<range><lt>9.8.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-00871">
	<p>A critical defect in BIND 9 allows an attacker to cause
	excessive memory consumption in named or other programs
	linked to libdns.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2266</cvename>
	</references>
	<dates>
	<discovery>2013-03-11</discovery>
	<entry>2013-03-27</entry>
	</dates>
	</vuln>

	<vuln vid="6adca5e9-95d2-11e2-8549-68b599b52a02">
	<topic>firebird -- Remote Stack Buffer Overflow</topic>
	<affects>
	<package>
	<name>firebird25-server</name>
	<range><ge>2.5.0</ge><le>2.5.2</le></range>
	</package>
	<package>
	<name>firebird21-server</name>
	<range><ge>2.1.0</ge><le>2.1.5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Firebird Project reports:</p>
	<blockquote cite="http://tracker.firebirdsql.org/browse/CORE-4058">
	<p>The FirebirdSQL server is vulnerable to a stack buffer overflow
	that can be triggered when an unauthenticated user sends a
	specially crafted packet. The result can lead to remote code
	execution as the user which runs the FirebirdSQL server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-2492</cvename>
	<url>https://gist.github.com/zeroSteiner/85daef257831d904479c</url>
	</references>
	<dates>
	<discovery>2013-01-31</discovery>
	<entry>2013-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="a8818f7f-9182-11e2-9bdf-d48564727302">
	<topic>optipng -- use-after-free vulnerability</topic>
	<affects>
	<package>
	<name>optipng</name>
	<range><ge>0.7</ge><lt>0.7.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="https://secunia.com/advisories/50654">
	<p>A vulnerability has been reported in OptiPNG, which can be
	exploited by malicious people to potentially compromise a user's
	system.</p>
	<p>The vulnerability is caused due to a use-after-free error related
	to the palette reduction functionality. No further information is
	currently available.</p>
	<p>Success exploitation may allow execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4432</cvename>
	<url>https://secunia.com/advisories/50654</url>
	</references>
	<dates>
	<discovery>2012-09-16</discovery>
	<entry>2013-03-21</entry>
	</dates>
	</vuln>

	<vuln vid="1d23109a-9005-11e2-9602-d43d7e0c7c02">
	<topic>php5 -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.4.13</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP development team reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	<p>PHP does not validate the relationship between the soap.wsdl_cache_dir
	directive and the open_basedir directive, which allows remote attackers to
	bypass intended access restrictions by triggering the creation of cached
	SOAP WSDL files in an arbitrary directory.</p>
	<p>The SOAP parser in PHP allows remote attackers to read arbitrary files
	via a SOAP WSDL file containing an XML external entity declaration in
	conjunction with an entity reference, related to an XML External Entity
	(XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1635</cvename>
	<cvename>CVE-2013-1643</cvename>
	</references>
	<dates>
	<discovery>2013-03-04</discovery>
	<entry>2013-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="edd201a5-8fc3-11e2-b131-000c299b62e1">
	<topic>piwigo -- CSRF/Path Traversal</topic>
	<affects>
	<package>
	<name>piwigo</name>
	<range><lt>2.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>High-Tech Bridge Security Research Lab reports:</p>
	<blockquote cite="http://piwigo.org/releases/2.4.7">
	<p>The CSRF vulnerability exists due to insufficient verification of the
	HTTP request origin in "/admin.php" script. A remote attacker can trick
	a logged-in administrator to visit a specially crafted webpage and
	create arbitrary PHP file on the remote server.</p>
	<p>The path traversal vulnerability exists due to insufficient filtration
	of user-supplied input in "dl" HTTP GET parameter passed to
	"/install.php" script. The script is present on the system after
	installation by default, and can be accessed by attacker without any
	restrictions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1468</cvename>
	<cvename>CVE-2013-1469</cvename>
	<url>http://piwigo.org/bugs/view.php?id=0002843</url>
	<url>http://piwigo.org/bugs/view.php?id=0002844</url>
	<url>http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt</url>
	</references>
	<dates>
	<discovery>2013-02-06</discovery>
	<entry>2013-03-18</entry>
	</dates>
	</vuln>

	<vuln vid="d881d254-70c6-11e2-862d-080027a5ec9a">
	<topic>libexif -- multiple remote vulnerabilities</topic>
	<affects>
	<package>
	<name>libexif</name>
	<range><lt>0.6.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>libexif project security advisory:</p>
	<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29534027">
	<p>A number of remotely exploitable issues were discovered in libexif
	and exif, with effects ranging from information leakage to potential
	remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2812</cvename>
	<cvename>CVE-2012-2813</cvename>
	<cvename>CVE-2012-2814</cvename>
	<cvename>CVE-2012-2836</cvename>
	<cvename>CVE-2012-2837</cvename>
	<cvename>CVE-2012-2840</cvename>
	<cvename>CVE-2012-2841</cvename>
	<cvename>CVE-2012-2845</cvename>
	<bid>54437</bid>
	</references>
	<dates>
	<discovery>2012-07-12</discovery>
	<entry>2013-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="5ff40cb4-8b92-11e2-bdb6-001060e06fd4">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.275</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-09.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0646</cvename>
	<cvename>CVE-2013-0650</cvename>
	<cvename>CVE-2013-1371</cvename>
	<cvename>CVE-2013-1375</cvename>
	</references>
	<dates>
	<discovery>2013-03-12</discovery>
	<entry>2013-03-12</entry>
	</dates>
	</vuln>

	<vuln vid="cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c">
	<topic>puppet27 and puppet -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>puppet</name>
	<range><ge>3.0</ge><lt>3.1.1</lt></range>
	</package>
	<package>
	<name>puppet27</name>
	<range><ge>2.7</ge><lt>2.7.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Moses Mendoza reports:</p>
	<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
	<p>A vulnerability found in Puppet could allow an authenticated client
	to cause the master to execute arbitrary code while responding to a
	catalog request. Specifically, in order to exploit the
	vulnerability, the puppet master must be made to invoke the
	'template' or 'inline_template' functions during catalog compilation.
	</p>
	<p>A vulnerability found in Puppet could allow an authenticated client
	to connect to a puppet master and perform unauthorized actions.
	Specifically, given a valid certificate and private key, an agent
	could retrieve catalogs from the master that it is not authorized
	to access or it could poison the puppet master's caches for any
	puppet-generated data that supports caching such as catalogs,
	nodes, facts, and resources. The extent and severity of this
	vulnerability varies depending on the specific configuration of the
	master: for example, whether it is using storeconfigs or not, which
	version, whether it has access to the cache or not, etc.
	</p>
	<p>A vulnerability has been found in Puppet which could allow
	authenticated clients to execute arbitrary code on agents that have
	been configured to accept kick connections. This vulnerability is
	not present in the default configuration of puppet agents, but if
	they have been configured to listen for incoming connections
	('listen=true'), and the agent's auth.conf has been configured to
	allow access to the `run` REST endpoint, then a client could
	construct an HTTP request which could execute arbitrary code. The
	severity of this issue is exacerbated by the fact that puppet
	agents typically run as root.
	</p>
	<p>A vulnerability has been found in Puppet that could allow a client
	negotiating a connection to a master to downgrade the master's
	SSL protocol to SSLv2. This protocol has been found to contain
	design weaknesses. This issue only affects systems running older
	versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
	SSLv2.
	</p>
	<p>A vulnerability found in Puppet could allow unauthenticated clients
	to send requests to the puppet master which would cause it to load
	code unsafely. While there are no reported exploits, this
	vulnerability could cause issues like those described in Rails
	CVE-2013-0156. This vulnerability only affects puppet masters
	running Ruby 1.9.3 and higher.
	</p>
	<p>This vulnerability affects puppet masters 0.25.0 and above. By
	default, auth.conf allows any authenticated node to submit a report
	for any other node. This can cause issues with compliance. The
	defaults in auth.conf have been changed.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1640</cvename>
	<cvename>CVE-2013-1652</cvename>
	<cvename>CVE-2013-1653</cvename>
	<cvename>CVE-2013-1654</cvename>
	<cvename>CVE-2013-1655</cvename>
	<cvename>CVE-2013-2275</cvename>
	<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-1653/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-1655/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw</url>
	</references>
	<dates>
	<discovery>2013-03-13</discovery>
	<entry>2013-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="04042f95-14b8-4382-a8b9-b30e365776cf">
	<topic>puppet26 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>puppet26</name>
	<range><ge>2.6</ge><lt>2.6.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Moses Mendoza reports:</p>
	<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
	<p>A vulnerability found in Puppet could allow an authenticated client
	to cause the master to execute arbitrary code while responding to a
	catalog request. Specifically, in order to exploit the
	vulnerability, the puppet master must be made to invoke the
	'template' or 'inline_template' functions during catalog compilation.
	</p>
	<p>A vulnerability found in Puppet could allow an authenticated client
	to connect to a puppet master and perform unauthorized actions.
	Specifically, given a valid certificate and private key, an agent
	could retrieve catalogs from the master that it is not authorized
	to access or it could poison the puppet master's caches for any
	puppet-generated data that supports caching such as catalogs,
	nodes, facts, and resources. The extent and severity of this
	vulnerability varies depending on the specific configuration of the
	master: for example, whether it is using storeconfigs or not, which
	version, whether it has access to the cache or not, etc.
	</p>
	<p>A vulnerability has been found in Puppet that could allow a client
	negotiating a connection to a master to downgrade the master's
	SSL protocol to SSLv2. This protocol has been found to contain
	design weaknesses. This issue only affects systems running older
	versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
	SSLv2.
	</p>
	<p>A vulnerability found in Puppet could allow an authenticated client
	to execute arbitrary code on a puppet master that is running in the
	default configuration, or an agent with `puppet kick` enabled.
	Specifically, a properly authenticated and connected puppet agent
	could be made to construct an HTTP PUT request for an authorized
	report that actually causes the execution of arbitrary code on the
	master.
	</p>
	<p>This vulnerability affects puppet masters 0.25.0 and above. By
	default, auth.conf allows any authenticated node to submit a report
	for any other node. This can cause issues with compliance. The
	defaults in auth.conf have been changed.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1640</cvename>
	<cvename>CVE-2013-1652</cvename>
	<cvename>CVE-2013-1654</cvename>
	<cvename>CVE-2013-2274</cvename>
	<cvename>CVE-2013-2275</cvename>
	<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-2274/</url>
	<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
	</references>
	<dates>
	<discovery>2013-03-13</discovery>
	<entry>2013-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="68c1f75b-8824-11e2-9996-c48508086173">
	<topic>perl -- denial of service via algorithmic complexity attack on hashing routines</topic>
	<affects>
	<package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><lt>5.12.4_5</lt></range>
	<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
	<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Perl developers report:</p>
	<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html">
	<p>In order to prevent an algorithmic complexity attack
	against its hashing mechanism, perl will sometimes
	recalculate keys and redistribute the contents of a hash.
	This mechanism has made perl robust against attacks that
	have been demonstrated against other systems.</p>
	<p>Research by Yves Orton has recently uncovered a flaw in
	the rehashing code which can result in pathological
	behavior. This flaw could be exploited to carry out a
	denial of service attack against code that uses arbitrary
	user input as hash keys.</p>
	<p>Because using user-provided strings as hash keys is a
	very common operation, we urge users of perl to update their
	perl executable as soon as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1667</cvename>
	<url>http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html</url>
	</references>
	<dates>
	<discovery>2013-03-04</discovery>
	<entry>2013-03-10</entry>
	<modified>2016-08-22</modified>
	</dates>
	</vuln>

	<vuln vid="549787c1-8916-11e2-8549-68b599b52a02">
	<topic>libpurple -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libpurple</name>
	<range><lt>2.10.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pidgin reports:</p>
	<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
	<p>libpurple</p>
	<p>Fix a crash when receiving UPnP responses with abnormally long values.</p>
	<p>MXit</p>
	<p>Fix two bugs where a remote MXit user could possibly specify a local file
	path to be written to.</p>
	<p>Fix a bug where the MXit server or a man-in-the-middle could potentially
	send specially crafted data that could overflow a buffer and lead to a crash
	or remote code execution.</p>
	<p>Sametime</p>
	<p>Fix a crash in Sametime when a malicious server sends us an abnormally long
	user ID.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0274</cvename>
	<cvename>CVE-2013-0271</cvename>
	<cvename>CVE-2013-0272</cvename>
	<cvename>CVE-2013-0273</cvename>
	<url>https://developer.pidgin.im/wiki/ChangeLog</url>
	</references>
	<dates>
	<discovery>2013-02-13</discovery>
	<entry>2013-03-10</entry>
	<modified>2013-03-16</modified>
	</dates>
	</vuln>

	<vuln vid="630c8c08-880f-11e2-807f-d43d7e0c7c02">
	<topic>mozilla -- use-after-free in HTML Editor</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>19.0.2,1</lt></range>
	<range><lt>17.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.4,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.16.1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.4</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.16.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.4</lt></range>
	<range><lt>10.0.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-29 Use-after-free in HTML Editor</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0787</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-29.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-03-07</discovery>
	<entry>2013-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="b9a347ac-8671-11e2-b73c-0019d18c446a">
	<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.23</lt></range>
	<range><ge>4.6.0</ge><lt>4.6.16</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
	<range><ge>6.0.0</ge><lt>6.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo Security Team reports:</p>
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/">
	<p>Extbase Framework - Failing to sanitize user input, the Extbase
	database abstraction layer is susceptible to SQL Injection. TYPO3
	sites which have no Extbase extensions installed are not affected.
	Extbase extensions are affected if they use the Query Object Model
	and relation values are user generated input. Credits go to Helmut
	Hummel and Markus Opahle who discovered and reported the issue.</p>
	<p>Access tracking mechanism - Failing to validate user provided
	input, the access tracking mechanism allows redirects to arbitrary
	URLs. To fix this vulnerability, we had to break existing
	behaviour of TYPO3 sites that use the access tracking mechanism
	(jumpurl feature) to transform links to external sites. The link
	generation has been changed to include a hash that is checked
	before redirecting to an external URL. This means that old links
	that have been distributed (e.g. by a newsletter) will not work
	any more.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/</url>
	</references>
	<dates>
	<discovery>2013-03-06</discovery>
	<entry>2013-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="c97219b6-843d-11e2-b131-000c299b62e1">
	<topic>stunnel -- Remote Code Execution</topic>
	<affects>
	<package>
	<name>stunnel</name>
	<range><ge>4.21</ge><lt>4.55</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michal Trojnara reports:</p>
	<blockquote cite="https://www.stunnel.org/CVE-2013-1762.html">
	<p>64-bit versions of stunnel with the following conditions:
	* NTLM authentication enabled
	* CONNECT protocol negotiation enabled
	* Configured in SSL client mode
	* An attacker that can either control the proxy server specified in
	the "connect" option or execute MITM attacks on the TCP session
	between stunnel and the proxy</p>
	<p>Can be exploited for remote code execution. The code is executed
	within the configured chroot directory, with privileges of the
	configured user and group.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1762</cvename>
	<url>https://www.stunnel.org/CVE-2013-1762.html</url>
	</references>
	<dates>
	<discovery>2013-03-03</discovery>
	<entry>2013-03-03</entry>
	</dates>
	</vuln>

	<vuln vid="9c88d8a8-8372-11e2-a010-20cf30e32f6d">
	<topic>apache22 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
	</package>
	<package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
	</package>
	<package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
	</package>
	<package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
	</package>
	<package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
	<h1>low: XSS due to unescaped hostnames CVE-2012-3499</h1>
	<p>Various XSS flaws due to unescaped hostnames and URIs HTML output in
	mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.</p>
	<h1>moderate: XSS in mod_proxy_balancer CVE-2012-4558</h1>
	<p>A XSS flaw affected the mod_proxy_balancer manager interface.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3499</cvename>
	<cvename>CVE-2012-4558</cvename>
	</references>
	<dates>
	<discovery>2012-10-07</discovery>
	<entry>2013-03-02</entry>
	</dates>
	</vuln>

	<vuln vid="764344fb-8214-11e2-9273-902b343deec9">
	<topic>sudo -- Authentication bypass when clock is reset</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><lt>1.8.6.p7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.sudo.ws/sudo/alerts/epoch_ticket.html">
	<p>The flaw may allow someone with physical access to a machine that
	is not password-protected to run sudo commands without knowing the
	logged in user's password. On systems where sudo is the principal
	way of running commands as root, such as on Ubuntu and Mac OS X,
	there is a greater chance that the logged in user has run sudo
	before and thus that an attack would succeed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1775</cvename>
	<url>http://www.sudo.ws/sudo/alerts/epoch_ticket.html</url>
	</references>
	<dates>
	<discovery>2013-02-27</discovery>
	<entry>2013-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="82cfd919-8213-11e2-9273-902b343deec9">
	<topic>sudo -- Potential bypass of tty_tickets constraints</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><lt>1.8.6.p7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.sudo.ws/sudo/alerts/tty_tickets.html">
	<p>A (potentially malicious) program run by a user with sudo access
	may be able to bypass the "tty_ticket" constraints. In order for
	this to succeed there must exist on the machine a terminal device
	that the user has previously authenticated themselves on via sudo
	within the last time stamp timeout (5 minutes by default).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1776</cvename>
	<url>http://www.sudo.ws/sudo/alerts/tty_tickets.html</url>
	</references>
	<dates>
	<discovery>2013-02-27</discovery>
	<entry>2013-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="aa7764af-0b5e-4ddc-bc65-38ad697a484f">
	<topic>rubygem-dragonfly -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>rubygem18-dragonfly</name>
	<name>rubygem19-dragonfly</name>
	<name>rubygem20-dragonfly</name>
	<range><lt>0.9.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark Evans reports:</p>
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo">
	<p>Unfortnately there is a security vulnerability in Dragonfly when
	used with Rails which would potentially allow an attacker to run
	arbitrary code on a host machine using carefully crafted
	requests.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1756</cvename>
	</references>
	<dates>
	<discovery>2013-02-19</discovery>
	<entry>2013-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="dbdac023-80e1-11e2-9a29-001060e06fd4">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.273</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-08.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0504</cvename>
	<cvename>CVE-2013-0643</cvename>
	<cvename>CVE-2013-0648</cvename>
	</references>
	<dates>
	<discovery>2013-02-26</discovery>
	<entry>2013-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="84065569-7fb4-11e2-9c5a-000d601460a4">
	<topic>otrs -- XSS vulnerability could lead to remote code execution</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><ge>3.1.*</ge><lt>3.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03">
	<p>This advisory covers vulnerabilities discovered in the OTRS core
	system. This is a variance of the XSS vulnerability, where an attacker
	could send a specially prepared HTML email to OTRS which would cause
	JavaScript code to be executed in your browser while displaying the
	email. In this case this is achieved by using javascript source
	attributes with whitespaces.</p>
	<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
	and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to
	and including 3.1.10.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4751</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03</url>
	</references>
	<dates>
	<discovery>2012-10-16</discovery>
	<entry>2013-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="d60199df-7fb3-11e2-9c5a-000d601460a4">
	<topic>otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><ge>3.1.*</ge><lt>3.1.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02/">
	<p>This advisory covers vulnerabilities discovered in the OTRS core
	system. This is a variance of the XSS vulnerability, where an attacker
	could send a specially prepared HTML email to OTRS which would cause
	JavaScript code to be executed in your browser while displaying the
	email in Firefox and Opera. In this case this is achieved with an
	invalid HTML structure with nested tags.</p>
	<p>Affected by this
	vulnerability are all releases of OTRS 2.4.x up to and including
	2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including
	3.1.9 in combination with Firefox and Opera.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4600</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02</url>
	</references>
	<dates>
	<discovery>2012-08-30</discovery>
	<entry>2013-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="b50cbbc0-7fb2-11e2-9c5a-000d601460a4">
	<topic>otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><ge>3.1.*</ge><lt>3.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OTRS Project reports:</p>
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01">
	<p>This advisory covers vulnerabilities discovered in the OTRS core
	system. Due to the XSS vulnerability in Internet Explorer an attacker
	could send a specially prepared HTML email to OTRS which would cause
	JavaScript code to be executed in your Internet Explorer while
	displaying the email.</p>
	<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
	and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to
	and including 3.1.8 in combination with Internet Explorer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2582</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01</url>
	</references>
	<dates>
	<discovery>2012-08-22</discovery>
	<entry>2013-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="844cf3f5-9259-4b3e-ac9e-13ca17333ed7">
	<topic>ruby -- DoS vulnerability in REXML</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>1.9,1</ge><lt>1.9.3.392,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby developers report:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/">
	<p>Unrestricted entity expansion can lead to a DoS vulnerability in
	REXML. (The CVE identifier will be assigned later.) We strongly
	recommend to upgrade ruby.
	</p>
	<p>When reading text nodes from an XML document, the REXML parser can
	be coerced in to allocating extremely large string objects which
	can consume all of the memory on a machine, causing a denial of
	service.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/</url>
	</references>
	<dates>
	<discovery>2013-02-22</discovery>
	<entry>2013-02-24</entry>
	</dates>
	</vuln>

	<vuln vid="e1aa3bdd-839a-4a77-8617-cca439a8f9fc">
	<topic>rubygem-ruby_parser -- insecure tmp file usage</topic>
	<affects>
	<package>
	<name>rubygem18-ruby_parser</name>
	<name>rubygem19-ruby_parser</name>
	<name>rubygem20-ruby_parser</name>
	<range><lt>3.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Scherer reports:</p>
	<blockquote cite="http://seclists.org/oss-sec/2013/q1/393">
	<p>This is a relatively minor tmp file usage issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0162</cvename>
	</references>
	<dates>
	<discovery>2013-02-24</discovery>
	<entry>2013-02-24</entry>
	</dates>
	</vuln>

	<vuln vid="21c59f5e-7cc5-11e2-9c11-080027a5ec9a">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py26-django</name>
	<name>py27-django</name>
	<range><ge>1.3</ge><lt>1.3.6</lt></range>
	<range><ge>1.4</ge><lt>1.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django Project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2013/feb/19/security/">
	<p>These security releases fix four issues: one potential phishing
	vector, one denial-of-service vector, an information leakage issue,
	and a range of XML vulnerabilities.</p>
	<ol>
	<li>
	<p>Host header poisoning</p>
	<p>an attacker could cause Django to generate and display URLs that
	link to arbitrary domains. This could be used as part of a phishing
	attack. These releases fix this problem by introducing a new
	setting, ALLOWED_HOSTS, which specifies a whitelist of domains your
	site is known to respond to.</p>
	<p>Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to
	allow all hosts. This means that to actually fix the security
	vulnerability you should define this setting yourself immediately
	after upgrading.</p>
	</li>
	<li>
	<p>Formset denial-of-service</p>
	<p>an attacker can abuse Django's tracking of the number of forms in
	a formset to cause a denial-of-service attack. This has been fixed
	by adding a default maximum number of forms of 1,000. You can still
	manually specify a bigger max_num, if you wish, but 1,000 should be
	enough for anyone.</p>
	</li>
	<li>
	<p>XML attacks</p>
	<p>Django's serialization framework was vulnerable to attacks via XML
	entity expansion and external references; this is now fixed.
	However, if you're parsing arbitrary XML in other parts of your
	application, we recommend you look into the defusedxml Python
	packages which remedy this anywhere you parse XML, not just via
	Django's serialization framework.</p>
	</li>
	<li>
	<p>Data leakage via admin history log</p>
	<p>Django's admin interface could expose supposedly-hidden
	information via its history log. This has been fixed.</p>
	</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1664</cvename>
	<cvename>CVE-2013-1665</cvename>
	<cvename>CVE-2013-0305</cvename>
	<cvename>CVE-2013-0306</cvename>
	<bid>58022</bid>
	<bid>58061</bid>
	</references>
	<dates>
	<discovery>2013-02-21</discovery>
	<entry>2013-02-24</entry>
	</dates>
	</vuln>

	<vuln vid="f54584bc-7d2b-11e2-9bd1-206a8a720317">
	<topic>krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415]</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><le>1.11</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>No advisory has been released yet.</p>
	<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
	<p>Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-1415</cvename>
	<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
	</references>
	<dates>
	<discovery>2013-02-21</discovery>
	<entry>2013-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="3c90e093-7c6e-11e2-809b-6c626d99876c">
	<topic>FreeBSD -- glob(3) related resource exhaustion</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_12</lt></range>
	<range><ge>8.3</ge><lt>8.3_6</lt></range>
	<range><ge>9.0</ge><lt>9.0_6</lt></range>
	<range><ge>9.1</ge><lt>9.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc">
	<p>GLOB_LIMIT is supposed to limit the number of paths to prevent against
	memory or CPU attacks. The implementation however is insufficient.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-13:02.libc</freebsdsa>
	<cvename>CVE-2010-2632</cvename>
	</references>
	<dates>
	<discovery>2013-02-19</discovery>
	<entry>2013-02-21</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="4671cdc9-7c6d-11e2-809b-6c626d99876c">
	<topic>FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.0_6</lt></range>
	<range><ge>9.1</ge><lt>9.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:01.bind.asc">
	<p>Due to a software defect a crafted query can cause named(8) to crash
	with an assertion failure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-13:01.bind</freebsdsa>
	<cvename>CVE-2012-5688</cvename>
	</references>
	<dates>
	<discovery>2013-02-19</discovery>
	<entry>2013-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="a4d71e4c-7bf4-11e2-84cd-d43d7e0c7c02">
	<topic>drupal7 -- Denial of service</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://drupal.org/SA-CORE-2013-002">
	<p>Drupal core's Image module allows for the on-demand generation
	of image derivatives. This capability can be abused by requesting
	a large number of new derivatives which can fill up the server disk
	space, and which can cause a very high CPU load. Either of these
	effects may lead to the site becoming unavailable or unresponsive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0316</cvename>
	<url>https://drupal.org/SA-CORE-2013-002</url>
	</references>
	<dates>
	<discovery>2013-02-20</discovery>
	<entry>2013-02-21</entry>
	</dates>
	</vuln>

	<vuln vid="58c15292-7b61-11e2-95da-001e8c1a8a0e">
	<topic>nss-pam-ldapd -- file descriptor buffer overflow</topic>
	<affects>
	<package>
	<name>nss-pam-ldapd</name>
	<range><lt>0.8.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Garth Mollett reports:</p>
	<blockquote cite="http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288">
	<p>A file descriptor overflow issue in the use of FD_SET()
	in nss-pam-ldapd can lead to a stack-based buffer overflow.
	An attacker could, under some circumstances, use this flaw
	to cause a process that has the NSS or PAM module loaded to
	crash or potentially execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0288</cvename>
	</references>
	<dates>
	<discovery>2013-02-18</discovery>
	<entry>2013-02-20</entry>
	</dates>
	</vuln>

	<vuln vid="1c8a039b-7b23-11e2-b17b-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<name>de-bugzilla</name>
	<name>ru-bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.13</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.12/">
	<h1>Cross-Site Scripting</h1>
	<p>When viewing a single bug report, which is the default,
	the bug ID is validated and rejected if it is invalid.
	But when viewing several bug reports at once, which is
	specified by the format=multiple parameter, invalid bug
	IDs can go through and are sanitized in the HTML page
	itself. But when an invalid page format is passed to the
	CGI script, the wrong HTML page is called and data are not
	correctly sanitized, which can lead to XSS.</p>
	<h1>Information Leak</h1>
	<p>When running a query in debug mode, the generated SQL
	query used to collect the data is displayed. The way this
	SQL query is built permits the user to determine if some
	confidential field value (such as a product name) exists.
	This problem only affects Bugzilla 4.0.9 and older. Newer
	releases are not affected by this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0785</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=842038</url>
	<cvename>CVE-2013-0786</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=824399</url>
	</references>
	<dates>
	<discovery>2013-02-19</discovery>
	<entry>2013-02-20</entry>
	<modified>2013-03-31</modified>
	</dates>
	</vuln>

	<vuln vid="e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>19.0,1</lt></range>
	<range><lt>17.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.16</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.3</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.16</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.3</lt></range>
	<range><lt>10.0.12</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 /
	rv:17.0.3)</p>
	<p>MFSA 2013-22 Out-of-bounds read in image rendering</p>
	<p>MFSA 2013-23 Wrapped WebIDL objects can be wrapped again</p>
	<p>MFSA 2013-24 Web content bypass of COW and SOW security wrappers</p>
	<p>MFSA 2013-25 Privacy leak in JavaScript Workers</p>
	<p>MFSA 2013-26 Use-after-free in nsImageLoadingContent</p>
	<p>MFSA 2013-27 Phishing on HTTPS connection through malicious proxy</p>
	<p>MFSA 2013-28 Use-after-free, out of bounds read, and buffer
	overflow issues found using Address Sanitizer</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0765</cvename>
	<cvename>CVE-2013-0772</cvename>
	<cvename>CVE-2013-0773</cvename>
	<cvename>CVE-2013-0774</cvename>
	<cvename>CVE-2013-0775</cvename>
	<cvename>CVE-2013-0776</cvename>
	<cvename>CVE-2013-0783</cvename>
	<cvename>CVE-2013-0784</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-21.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-22.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-23.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-24.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-25.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-26.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-27.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-02-19</discovery>
	<entry>2013-02-19</entry>
	<modified>2013-02-20</modified>
	</dates>
	</vuln>

	<vuln vid="fcfdabb7-f14d-4e61-a7d5-cfefb4b99b15">
	<topic>Ruby Rack Gem -- Multiple Issues</topic>
	<affects>
	<package>
	<name>rubygem18-rack</name>
	<range><lt>1.4.5</lt></range>
	</package>
	<package>
	<name>rubygem19-rack</name>
	<range><lt>1.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rack developers report:</p>
	<blockquote cite="http://www.ruby-forum.com/topic/4410659">
	<p>Today we are proud to announce the release of Rack 1.4.5.</p>
	<p>Fix CVE-2013-0263, timing attack against Rack::Session::Cookie</p>
	<p>Fix CVE-2013-0262, symlink path traversal in Rack::File</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0262</cvename>
	<cvename>CVE-2013-0263</cvename>
	</references>
	<dates>
	<discovery>2013-02-08</discovery>
	<entry>2013-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="beab40bf-c1ca-4d2b-ad46-2f14bac8a968">
	<topic>Ruby Activemodel Gem -- Circumvention of attr_protected</topic>
	<affects>
	<package>
	<name>rubygem18-activemodel</name>
	<range><lt>3.2.12</lt></range>
	</package>
	<package>
	<name>rubygem19-activemodel</name>
	<range><lt>3.2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aaron Patterson reports:</p>
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8">
	<p>The attr_protected method allows developers to specify a blacklist
	of model attributes which users should not be allowed to assign to.
	By using a specially crafted request, attackers could circumvent
	this protection and alter values that were meant to be protected.</p>
	<p>All users running an affected release should either upgrade or use
	one of the work arounds immediately. Users should also consider
	switching from attr_protected to the whitelist method
	attr_accessible which is not vulnerable to this attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0276</cvename>
	</references>
	<dates>
	<discovery>2013-02-11</discovery>
	<entry>2013-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="7fe5b84a-78eb-11e2-8441-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.501</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16">
	<p>This advisory announces multiple security vulnerabilities that
	were found in Jenkins core.</p>
	<ol>
	<li>One of the vulnerabilities allows cross-site request
	forgery (CSRF) attacks on Jenkins master, which causes an user
	to make unwanted actions on Jenkins. Another vulnerability
	enables cross-site scripting (XSS) attacks, which has the similar
	consequence. Another vulnerability allowed an attacker to bypass
	the CSRF protection mechanism in place, thereby mounting more CSRF
	attackes. These attacks allow an attacker without direct access to
	Jenkins to mount an attack.</li>
	<li>In the fourth vulnerability, a malicious user of Jenkins can trick
	Jenkins into building jobs that he does not have direct access to.</li>
	<li>And lastly, a vulnerability allows a malicious user of Jenkins to
	mount a denial of service attack by feeding a carefully crafted
	payload to Jenkins.</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16</url>
	</references>
	<dates>
	<discovery>2013-02-16</discovery>
	<entry>2013-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="f7809d9e-6af0-11e2-8e32-080027d768d3">
	<topic>poweradmin -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>poweradmin</name>
	<range><lt>2.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple cross-site scripting (XSS) vulnerabilities</p>
	<blockquote cite="https://www.poweradmin.org/trac/ticket/468">
	<p>Multiple scripts are vulnerable to XSS attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>55619</bid>
	<url>http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html</url>
	</references>
	<dates>
	<discovery>2012-01-12</discovery>
	<entry>2013-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="c79eb109-a754-45d7-b552-a42099eb2265">
	<topic>Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
	</package>
	<package>
	<name>rubygem18-json</name>
	<range><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>rubygem19-json</name>
	<range><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>rubygem18-json_pure</name>
	<range><lt>1.7.7</lt></range>
	</package>
	<package>
	<name>rubygem19-json_pure</name>
	<range><lt>1.7.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aaron Patterson reports:</p>
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58">
	<p>When parsing certain JSON documents, the JSON gem can be coerced in
	to creating Ruby symbols in a target system. Since Ruby symbols
	are not garbage collected, this can result in a denial of service
	attack.</p>
	<p>The same technique can be used to create objects in a target system
	that act like internal objects. These "act alike" objects can be
	used to bypass certain security mechanisms and can be used as a
	spring board for SQL injection attacks in Ruby on Rails.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0269</cvename>
	</references>
	<dates>
	<discovery>2013-02-11</discovery>
	<entry>2013-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="d3e96508-056b-4259-88ad-50dc8d1978a6">
	<topic>Ruby -- XSS exploit of RDoc documentation generated by rdoc</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
	</package>
	<package>
	<name>rubygem18-rdoc</name>
	<range><lt>3.12.1</lt></range>
	</package>
	<package>
	<name>rubygem19-rdoc</name>
	<range><lt>3.12.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby developers report:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/">
	<p>RDoc documentation generated by rdoc bundled with ruby are
	vulnerable to an XSS exploit. All ruby users are recommended to
	update ruby to newer version which includes security-fixed RDoc. If
	you are publishing RDoc documentation generated by rdoc, you are
	recommended to apply a patch for the documentaion or re-generate it
	with security-fixed RDoc.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0256</cvename>
	</references>
	<dates>
	<discovery>2013-02-06</discovery>
	<entry>2013-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="414e6a41-7204-11e2-8599-001060e06fd4">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.262</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-04.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0633</cvename>
	<cvename>CVE-2013-0634</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb13-04.html</url>
	</references>
	<dates>
	<discovery>2013-02-07</discovery>
	<entry>2013-02-08</entry>
	</dates>
	</vuln>

	<vuln vid="00b0d8cd-7097-11e2-98d9-003067c2616f">
	<topic>OpenSSL -- TLS 1.1, 1.2 denial of service</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.1_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL security team reports:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20130205.txt">
	<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1
	and TLS 1.2 on AES-NI supporting platforms can be exploited in a
	DoS attack.</p>
	<p>A flaw in the OpenSSL handling of OCSP response verification can
	be exploited in a denial of service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2686</cvename>
	<cvename>CVE-2013-0166</cvename>
	<cvename>CVE-2013-0169</cvename>
	<url>http://www.openssl.org/news/secadv_20120510.txt</url>
	</references>
	<dates>
	<discovery>2013-02-05</discovery>
	<entry>2013-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="8c773d7f-6cbb-11e2-b242-c8600054b392">
	<topic>mysql/mariadb/percona server -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.67</lt></range>
	<range><ge>5.5</ge><lt>5.5.29</lt></range>
	</package>
	<package>
	<name>mariadb-server</name>
	<range><ge>5.3</ge><lt>5.3.12</lt></range>
	<range><ge>5.5</ge><lt>5.5.29</lt></range>
	</package>
	<package>
	<name>percona-server</name>
	<range><ge>5.5</ge><lt>5.5.29.29.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ORACLE reports:</p>
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html">
	<p>Multiple SQL injection vulnerabilities in the replication code</p>
	<p>Stack-based buffer overflow</p>
	<p>Heap-based buffer overflow</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4414</cvename>
	<cvename>CVE-2012-5611</cvename>
	<cvename>CVE-2012-5612</cvename>
	<cvename>CVE-2012-5615</cvename>
	<cvename>CVE-2012-5627</cvename>
	<url>https://mariadb.atlassian.net/browse/MDEV-4029</url>
	<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
	<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
	<url>http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/</url>
	</references>
	<dates>
	<discovery>2012-12-01</discovery>
	<entry>2013-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="ea0f45e2-6c4b-11e2-98d9-003067c2616f">
	<topic>opera -- execution of arbitrary code</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<name>linux-opera-devel</name>
	<range><lt>12.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/kb/view/1042/">
	<p>Particular DOM event manipulations can cause Opera to crash. In
	some cases, this crash might occur in a way that allows execution
	of arbitrary code. To inject code, additional techniques would
	have to be employed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/kb/view/1042/</url>
	<url>http://www.opera.com/support/kb/view/1043/</url>
	</references>
	<dates>
	<discovery>2013-01-30</discovery>
	<entry>2013-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84">
	<topic>upnp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>upnp</name>
	<range><lt>1.6.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Project changelog reports:</p>
	<blockquote cite="http://pupnp.sourceforge.net/ChangeLog">
	<p>This patch addresses three possible buffer overflows in
	function unique_service_name().The three issues have the
	folowing CVE numbers:</p>
	<ul>
	<li>CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf</li>
	<li>CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN</li>
	<li>CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN</li>
	</ul>
	<p>Notice that the following issues have already been dealt by
	previous work:</p>
	<ul>
	<li>CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN</li>
	<li>CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType</li>
	<li>CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN</li>
	<li>CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType</li>
	<li>CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5958</cvename>
	<cvename>CVE-2012-5959</cvename>
	<cvename>CVE-2012-5960</cvename>
	<cvename>CVE-2012-5961</cvename>
	<cvename>CVE-2012-5962</cvename>
	<cvename>CVE-2012-5963</cvename>
	<cvename>CVE-2012-5964</cvename>
	<cvename>CVE-2012-5965</cvename>
	</references>
	<dates>
	<discovery>2012-11-21</discovery>
	<entry>2013-01-30</entry>
	</dates>
	</vuln>

	<vuln vid="559e00b7-6a4d-11e2-b6b0-10bf48230856">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.5.1,1</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>3.5.1</lt></range>
	</package>
	<package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.5.1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>3.5.1</lt></range>
	</package>
	<package>
	<name>ja-wordpress</name>
	<range><lt>3.5.1</lt></range>
	</package>
	<package>
	<name>ru-wordpress</name>
	<range><lt>3.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wordpress reports:</p>
	<blockquote cite="http://wordpress.org/news/2013/01/wordpress-3-5-1/">
	<p>WordPress 3.5.1 also addresses the following security issues:</p>
	<ul>
	<li>A server-side request forgery vulnerability and remote port
	scanning using pingbacks. This vulnerability, which could
	potentially be used to expose information and compromise a
	site, affects all previous WordPress versions. This was fixed
	by the WordPress security team. We'd like to thank security
	researchers <a href="http://codeseekah.com/">Gennady
	Kovshenin</a> and <a href="http://www.ethicalhack3r.co.uk/">Ryan
	Dewhurst</a> for reviewing our work.</li>
	<li>Two instances of cross-site scripting via shortcodes and post
	content. These issues were discovered by Jon Cave of the WordPress
	security team.</li>
	<li>A cross-site scripting vulnerability in the external library
	Plupload. Thanks to the Moxiecode team for working with us on
	this, and for releasing Plupload 1.5.5 to address this issue.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0235</cvename>
	<cvename>CVE-2013-0236</cvename>
	<cvename>CVE-2013-0237</cvename>
	</references>
	<dates>
	<discovery>2013-01-24</discovery>
	<entry>2013-01-29</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="3886cafe-668c-11e2-94b8-1c4bd681f0cf">
	<topic>django-cms -- XSS Vulnerability</topic>
	<affects>
	<package>
	<name>py-django-cms</name>
	<range><lt>2.3.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cross-site scripting (XSS) vulnerability</p>
	<blockquote cite="https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/">
	<p>Jonas Obrist reports: The security issue allows users with limited
	admin access to elevate their privileges through XSS injection
	using the page_attribute template tag. Only users with admin access
	and the permission to edit at least one django CMS page object
	could exploit this vulnerability. Websites that do not use the
	page_attribute template tag are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/</url>
	</references>
	<dates>
	<discovery>2012-12-04</discovery>
	<entry>2013-01-25</entry>
	</dates>
	</vuln>

	<vuln vid="1827f213-633e-11e2-8d93-c8600054b392">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.28</lt></range>
	</package>
	<package>
	<name>drupal7</name>
	<range><lt>7.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="https://drupal.org/SA-CORE-2013-001">
	<p>Cross-site scripting (Various core and contributed modules)</p>
	<p>Access bypass (Book module printer friendly version)</p>
	<p>Access bypass (Image module)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://drupal.org/SA-CORE-2013-001</url>
	</references>
	<dates>
	<discovery>2013-01-16</discovery>
	<entry>2013-01-20</entry>
	</dates>
	</vuln>

	<vuln vid="1b9b199f-5efd-11e2-a1ee-c48508086173">
	<topic>ettercap -- buffer overflow in target list parsing</topic>
	<affects>
	<package>
	<name>ettercap</name>
	<range><lt>0.7.4.1</lt></range>
	<range><ge>0.7.5</ge><lt>0.7.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Host target list parsing routine in ettercap
	0.7.4-series prior to 0.7.4.1 and 0.7.5-series
	is prone to the stack-based buffer overflow that
	may lead to the code execution with the privileges
	of the ettercap process.</p>
	<p>In order to trigger this vulnerability, user or service
	that use ettercap should be tricked to pass the crafted list
	of targets via the "-j" option.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0722</cvename>
	<url>http://www.exploit-db.com/exploits/23945/</url>
	<url>https://secunia.com/advisories/51731/</url>
	</references>
	<dates>
	<discovery>2013-01-07</discovery>
	<entry>2013-01-16</entry>
	</dates>
	</vuln>

	<vuln vid="d5e0317e-5e45-11e2-a113-c48508086173">
	<topic>java 7.x -- security manager bypass</topic>
	<affects>
	<package>
	<name>openjdk7</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>linux-sun-jdk</name>
	<range><ge>7.0</ge><lt>7.11</lt></range>
	</package>
	<package>
	<name>linux-sun-jre</name>
	<range><ge>7.0</ge><lt>7.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/625617">
	<p>Java 7 Update 10 and earlier versions of Java 7 contain a
	vulnerability that can allow a remote, unauthenticated
	attacker to execute arbitrary code on a vulnerable
	system.</p>
	<p>The Java JRE plug-in provides its own Security Manager.
	Typically, a web applet runs with a security manager
	provided by the browser or Java Web Start plugin. Oracle's
	document states, "If there is a security manager already
	installed, this method first calls the security manager's
	checkPermission method with a
	RuntimePermission("setSecurityManager") permission to ensure
	it's safe to replace the existing security manager. This may
	result in throwing a SecurityException".</p>
	<p>By leveraging the vulnerability in the Java Management
	Extensions (JMX) MBean components, unprivileged Java code
	can access restricted classes. By using that vulnerability
	in conjunction with a second vulnerability involving the
	Reflection API and the invokeWithArguments method of the
	MethodHandle class, an untrusted Java applet can escalate
	its privileges by calling the the setSecurityManager()
	function to allow full privileges, without requiring code
	signing. Oracle Java 7 update 10 and earlier Java 7 versions
	are affected. The invokeWithArguments method was introduced
	with Java 7, so therefore Java 6 is not affected.</p>
	<p>This vulnerability is being attacked in the wild, and is
	reported to be incorporated into exploit kits. Exploit code
	for this vulnerability is also publicly available.</p>
	</blockquote>
	<p>Esteban Guillardoy from Immunity Inc. additionally clarifies
	on the recursive reflection exploitation technique:</p>
	<blockquote cite="https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf">
	<p>The real issue is in the native
	sun.reflect.Reflection.getCallerClass method.</p>
	<p>We can see the following information in the Reflection
	source code:</p>
	<p>Returns the class of the method realFramesToSkip frames
	up the stack (zero-based), ignoring frames associated with
	java.lang.reflect.Method.invoke() and its
	implementation.</p>
	<p>So what is happening here is that they forgot to skip the
	frames related to the new Reflection API and only the old
	reflection API is taken into account.</p>
	</blockquote>
	<p>This exploit does not only affect Java applets, but every
	piece of software that relies on the Java Security Manager for
	sandboxing executable code is affected: malicious code can
	totally disable Security Manager.</p>
	<p>For users who are running native Web browsers with enabled
	Java plugin, the workaround is to remove the java/icedtea-web
	port and restart all browser instances.</p>
	<p>For users who are running Linux Web browser flavors, the
	workaround is either to disable the Java plugin in browser
	or to upgrade linux-sun-* packages to the non-vulnerable
	version.</p>
	<p>It is not recommended to run untrusted applets using
	appletviewer, since this may lead to the execution of the
	malicious code on vulnerable versions on JDK/JRE.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0433</cvename>
	<certvu>625617</certvu>
	<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html</url>
	<url>https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf</url>
	</references>
	<dates>
	<discovery>2013-01-10</discovery>
	<entry>2013-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="97c22a94-5b8b-11e2-b131-000c299b62e1">
	<topic>nagios -- buffer overflow in history.cgi</topic>
	<affects>
	<package>
	<name>nagios</name>
	<range><lt>3.4.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>full disclosure reports:</p>
	<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html">
	<p>history.cgi is vulnerable to a buffer overflow due to the use of
	sprintf with user supplied data that has not been restricted in size.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-6096</cvename>
	<url>http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html</url>
	<url>http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&revision=2547</url>
	</references>
	<dates>
	<discovery>2012-12-21</discovery>
	<entry>2013-01-10</entry>
	</dates>
	</vuln>

	<vuln vid="a4ed6632-5aa9-11e2-8fcb-c8600054b392">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>17.0.2,1</lt></range>
	<range><lt>10.0.12,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>17.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.15</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.2</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.15</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.2</lt></range>
	<range><lt>10.0.12</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
	</package>
	<package>
	<name>ca_root_nss</name>
	<range><lt>3.14.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/
	rv:10.0.12 / rv:17.0.2)</p>
	<p>MFSA 2013-02 Use-after-free and buffer overflow issues found using
	Address Sanitizer</p>
	<p>MFSA 2013-03 Buffer Overflow in Canvas</p>
	<p>MFSA 2013-04 URL spoofing in addressbar during page loads</p>
	<p>MFSA 2013-05 Use-after-free when displaying table with many
	columns and column groups</p>
	<p>MFSA 2013-06 Touch events are shared across iframes</p>
	<p>MFSA 2013-07 Crash due to handling of SSL on threads</p>
	<p>MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during
	garbage collection</p>
	<p>MFSA 2013-09 Compartment mismatch with quickstubs returned values</p>
	<p>MFSA 2013-10 Event manipulation in plugin handler to bypass
	same-origin policy</p>
	<p>MFSA 2013-11 Address space layout leaked in XBL objects</p>
	<p>MFSA 2013-12 Buffer overflow in Javascript string concatenation</p>
	<p>MFSA 2013-13 Memory corruption in XBL with XML bindings containing
	SVG</p>
	<p>MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing
	prototype</p>
	<p>MFSA 2013-15 Privilege escalation through plugin objects</p>
	<p>MFSA 2013-16 Use-after-free in serializeToStream</p>
	<p>MFSA 2013-17 Use-after-free in ListenerManager</p>
	<p>MFSA 2013-18 Use-after-free in Vibrate</p>
	<p>MFSA 2013-19 Use-after-free in Javascript Proxy objects</p>
	<p>MFSA 2013-20 Mis-issued TURKTRUST certificates</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5829</cvename>
	<cvename>CVE-2013-0743</cvename>
	<cvename>CVE-2013-0744</cvename>
	<cvename>CVE-2013-0745</cvename>
	<cvename>CVE-2013-0746</cvename>
	<cvename>CVE-2013-0747</cvename>
	<cvename>CVE-2013-0748</cvename>
	<cvename>CVE-2013-0749</cvename>
	<cvename>CVE-2013-0750</cvename>
	<cvename>CVE-2013-0751</cvename>
	<cvename>CVE-2013-0752</cvename>
	<cvename>CVE-2013-0753</cvename>
	<cvename>CVE-2013-0754</cvename>
	<cvename>CVE-2013-0755</cvename>
	<cvename>CVE-2013-0756</cvename>
	<cvename>CVE-2013-0757</cvename>
	<cvename>CVE-2013-0758</cvename>
	<cvename>CVE-2013-0759</cvename>
	<cvename>CVE-2013-0760</cvename>
	<cvename>CVE-2013-0761</cvename>
	<cvename>CVE-2013-0762</cvename>
	<cvename>CVE-2013-0763</cvename>
	<cvename>CVE-2013-0764</cvename>
	<cvename>CVE-2013-0766</cvename>
	<cvename>CVE-2013-0767</cvename>
	<cvename>CVE-2013-0768</cvename>
	<cvename>CVE-2013-0769</cvename>
	<cvename>CVE-2013-0770</cvename>
	<cvename>CVE-2013-0771</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-01.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-02.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-03.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-04.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-05.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-06.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-07.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-08.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-09.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-10.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-11.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-12.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-13.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-14.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-15.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-16.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-17.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-18.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-19.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2013-01-08</discovery>
	<entry>2013-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="ca5d3272-59e3-11e2-853b-00262d5ed8ee">
	<topic>rubygem-rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.11</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.11</lt></range>
	</package>
	<package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.11</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails team reports:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/">
	<p>Two high-risk vulnerabilities have been discovered:</p>
	<p>(CVE-2013-0155) There is a vulnerability when Active Record is
	used in conjunction with JSON parameter parsing.</p>
	<p>Due to the way Active Record interprets parameters in combination
	with the way that JSON parameters are parsed, it is possible for an
	attacker to issue unexpected database queries with "IS NULL" or
	empty "WHERE" clauses. This issue does not let an attacker insert
	arbitrary values into an SQL query, however they can cause the
	query to check for NULL or eliminate a WHERE clause when most users
	would not expect it.</p>
	<p>(CVE-2013-0156) There are multiple weaknesses in the parameter
	parsing code for Ruby on Rails which allows attackers to bypass
	authentication systems, inject arbitrary SQL, inject and execute
	arbitrary code, or perform a DoS attack on a Rails application.</p>
	<p>The parameter parsing code of Ruby on Rails allows applications to
	automatically cast values from strings to certain data types.
	Unfortunately the type casting code supported certain conversions
	which were not suitable for performing on user-provided data
	including creating Symbols and parsing YAML. These unsuitable
	conversions can be used by an attacker to compromise a Rails
	application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2013-0155</cvename>
	<cvename>CVE-2013-0156</cvename>
	<url>http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/</url>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI</url>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ</url>
	</references>
	<dates>
	<discovery>2013-01-08</discovery>
	<entry>2013-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="b4051b52-58fa-11e2-853b-00262d5ed8ee">
	<topic>rubygem-rails -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby on Rails team reports:</p>
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM">
	<p>There is a SQL injection vulnerability in Active Record in ALL
	versions. Due to the way dynamic finders in Active Record extract
	options from method parameters, a method parameter can mistakenly
	be used as a scope. Carefully crafted requests can use the scope
	to inject arbitrary SQL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5664</cvename>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM</url>
	</references>
	<dates>
	<discovery>2013-01-02</discovery>
	<entry>2013-01-07</entry>
	</dates>
	</vuln>

	<vuln vid="3a65d33b-5950-11e2-b66b-00e0814cab4e">
	<topic>jenkins -- HTTP access to the server to retrieve the master cryptographic key</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.498</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04">
	<p>This advisory announces a security vulnerability that was found
	in Jenkins core.</p>
	<p>An attacker can then use this master cryptographic key to mount
	remote code execution attack against the Jenkins master, or
	impersonate arbitrary users in making REST API calls.</p>
	<p>There are several factors that mitigate some of these problems
	that may apply to specific installations.</p>
	<ul>
	<li>The particular attack vector is only applicable on Jenkins
	instances that have slaves attached to them, and allow
	anonymous read access.</li>
	<li>Jenkins allows users to re-generate the API tokens. Those
	re-generated API tokens cannot be impersonated by the
	attacker.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04</url>
	</references>
	<dates>
	<discovery>2013-01-04</discovery>
	<entry>2013-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="1b769b72-582b-11e2-b66b-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>django</name>
	<range><lt>1.4.3</lt></range>
	</package>
	<package>
	<name>django13</name>
	<range><lt>1.3.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django Project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2012/dec/10/security/">
	<ol>
	<li>
	<p>Host header poisoning</p>
	<p>Several earlier Django security releases focused on the issue of
	poisoning the HTTP Host header, causing Django to generate URLs
	pointing to arbitrary, potentially-malicious domains.</p>
	<p>In response to further input received and reports of continuing
	issues following the previous release, we're taking additional
	steps to tighten Host header validation. Rather than attempt to
	accommodate all features HTTP supports here, Django's Host header
	validation attempts to support a smaller, but far more common, subset:</p>
	<ul>
	<li>Hostnames must consist of characters [A-Za-z0-9] plus hyphen
	('-') or dot ('.').</li>
	<li>IP addresses -- both IPv4 and IPv6 -- are permitted.</li>
	<li>Port, if specified, is numeric.</li>
	</ul>
	<p>Any deviation from this will now be rejected, raising the exception
	django.core.exceptions.SuspiciousOperation.</p>
	</li>
	<li>
	<p>Redirect poisoning</p>
	<p>Also following up on a previous issue: in July of this year, we made
	changes to Django's HTTP redirect classes, performing additional
	validation of the scheme of the URL to redirect to (since, both
	within Django's own supplied applications and many third-party
	applications, accepting a user-supplied redirect target is a common
	pattern).</p>
	<p>Since then, two independent audits of the code turned up further
	potential problems. So, similar to the Host-header issue, we are
	taking steps to provide tighter validation in response to reported
	problems (primarily with third-party applications, but to a certain
	extent also within Django itself). This comes in two parts:</p>
	<ol>
	<li>A new utility function, django.utils.http.is_safe_url, is
	added; this function takes a URL and a hostname, and checks
	that the URL is either relative, or if absolute matches the
	supplied hostname. This function is intended for use whenever
	user-supplied redirect targets are accepted, to ensure that
	such redirects cannot lead to arbitrary third-party sites.</li>
	<li>All of Django's own built-in views -- primarily in the
	authentication system -- which allow user-supplied redirect
	targets now use is_safe_url to validate the supplied URL.</li>
	</ol>
	</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2012/dec/10/security/</url>
	</references>
	<dates>
	<discovery>2012-12-10</discovery>
	<entry>2013-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="1ae613c3-5728-11e2-9483-14dae938ec40">
	<topic>freetype -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.4.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The FreeType Project reports:</p>
	<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view">
	<p>Some vulnerabilities in the BDF implementation have been fixed.
	Users of this font format should upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view</url>
	</references>
	<dates>
	<discovery>2012-12-20</discovery>
	<entry>2013-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="a264b1b0-5726-11e2-9483-14dae938ec40">
	<topic>moinmoin -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.9.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MoinMoin developers report the following vulnerabilities
	as fixed in version 1.9.6:</p>
	<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES">
	<ul>
	<li>remote code execution vulnerability in
	twikidraw/anywikidraw action,</li>
	<li>path traversal vulnerability in AttachFile action,</li>
	<li>XSS issue, escape page name in rss link.</li>
	</ul>
	</blockquote>
	<p>CVE entries at MITRE furher clarify:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6081">
	<p>Multiple unrestricted file upload vulnerabilities in the
	(1) twikidraw (action/twikidraw.py) and (2) anywikidraw
	(action/anywikidraw.py) actions in MoinMoin before 1.9.6
	allow remote authenticated users with write permissions to
	execute arbitrary code by uploading a file with an
	executable extension, then accessing it via a direct request
	to the file in an unspecified directory, as exploited in the
	wild in July 2012.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6080">
	<p>Directory traversal vulnerability in the
	_do_attachment_move function in the AttachFile action
	(action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5
	allows remote attackers to overwrite arbitrary files via a
	.. (dot dot) in a file name.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6082">
	<p>Cross-site scripting (XSS) vulnerability in the rsslink
	function in theme/__init__.py in MoinMoin 1.9.5 allows
	remote attackers to inject arbitrary web script or HTML
	via the page name in a rss link.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-6081</cvename>
	<cvename>CVE-2012-6080</cvename>
	<cvename>CVE-2012-6082</cvename>
	<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES</url>
	<url>http://www.debian.org/security/2012/dsa-2593</url>
	</references>
	<dates>
	<discovery>2012-12-29</discovery>
	<entry>2013-01-05</entry>
	<modified>2013-01-06</modified>
	</dates>
	</vuln>

	<vuln vid="f7c87a8a-55d5-11e2-a255-c8600054b392">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk11</name>
	<range><gt>11.*</gt><lt>11.1.2</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.11.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.19.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Crashes due to large stack allocations when using TCP</p>
	<p>Denial of Service Through Exploitation of Device State Caching</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5976</cvename>
	<cvename>CVE-2012-5977</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-014.html</url>
	<url>http://downloads.digium.com/pub/security/AST-2012-015.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2013-01-02</discovery>
	<entry>2013-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="4108cc57-54d7-11e2-9483-14dae938ec40">
	<topic>ircd-ratbox and charybdis -- remote DoS vulnerability</topic>
	<affects>
	<package>
	<name>ircd-ratbox</name>
	<range><gt>2.*</gt><lt>3.0.8</lt></range>
	</package>
	<package>
	<name>charybdis</name>
	<range><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>atheme.org reports:</p>
	<blockquote cite="http://www.ratbox.org/ASA-2012-12-31.txt">
	<p>All versions of Charybdis are vulnerable to a remotely-triggered
	crash bug caused by code originating from ircd-ratbox 2.0.
	(Incidentally, this means all versions since ircd-ratbox 2.0 are
	also vulnerable.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.ratbox.org/ASA-2012-12-31.txt</url>
	</references>
	<dates>
	<discovery>2012-12-31</discovery>
	<entry>2013-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="101f0aae-52d1-11e2-87fe-f4ce46b9ace8">
	<topic>puppet -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>puppet</name>
	<range><gt>2.6.*</gt><lt>2.6.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>puppet -- multiple vulnerabilities</p>
	<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17">
	<p>Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.</p>
	<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does not exist in Puppet as configured by default.</p>
	<p>Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3864</cvename>
	<cvename>CVE-2012-3865</cvename>
	<cvename>CVE-2012-3867</cvename>
	<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
	</references>
	<dates>
	<discovery>2012-07-10</discovery>
	<entry>2012-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="13320091-52a6-11e2-a289-1c4bd681f0cf">
	<topic>otrs -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-03/">
	<p>This advisory covers vulnerabilities discovered in the OTRS core
	system. This is a variance of the XSS vulnerability, where an attacker could
	send a specially prepared HTML email to OTRS which would cause JavaScript code
	to be executed in your browser while displaying the email. In this case this is
	achieved by using javascript source attributes with whitespaces.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4751</cvename>
	<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/</url>
	<url>http://www.kb.cert.org/vuls/id/603276</url>
	</references>
	<dates>
	<discovery>2012-10-16</discovery>
	<entry>2012-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="95a69d1a-52a5-11e2-a289-1c4bd681f0cf">
	<topic>otrs -- XSS vulnerability in Firefox and Opera</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/">
	<p>This advisory covers vulnerabilities discovered in the OTRS core
	system. This is a variance of the XSS vulnerability, where an attacker could
	send a specially prepared HTML email to OTRS which would cause JavaScript code
	to be executed in your browser while displaying the email in Firefox and Opera.
	In this case this is achieved with an invalid HTML structure with nested tags.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4600</cvename>
	<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/</url>
	</references>
	<dates>
	<discovery>2012-08-30</discovery>
	<entry>2012-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="49a6026a-52a3-11e2-a289-1c4bd681f0cf">
	<topic>otrs -- XSS vulnerability in Internet Explorer</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>3.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/">
	<p>This advisory covers vulnerabilities discovered in the OTRS core
	system. Due to the XSS vulnerability in Internet Explorer an attacker could send
	a specially prepared HTML email to OTRS which would cause JavaScript code to be
	executed in your Internet Explorer while displaying the email.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2582</cvename>
	<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/</url>
	</references>
	<dates>
	<discovery>2012-08-22</discovery>
	<entry>2012-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="c37de843-488e-11e2-a5c9-0019996bc1f7">
	<topic>squid -- denial of service</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><lt>2.7.9_4</lt></range>
	<range><ge>3.1</ge><lt>3.1.23</lt></range>
	<range><ge>3.2</ge><lt>3.2.6</lt></range>
	<range><ge>3.3</ge><lt>3.3.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid developers report:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2012_1.txt">
	<p>Due to missing input validation Squid cachemgr.cgi tool
	is vulnerable to a denial of service attack when processing
	specially crafted requests.</p>
	<p>This problem allows any client able to reach the
	cachemgr.cgi to perform a denial of service attack on the
	service host.</p>
	<p>The nature of the attack may cause secondary effects
	through resource consumption on the host server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5643</cvename>
	<cvename>CVE-2013-0189</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2012_1.txt</url>
	</references>
	<dates>
	<discovery>2012-12-17</discovery>
	<entry>2012-12-28</entry>
	<modified>2013-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="85f33a8d-492f-11e2-aa75-003067c2616f">
	<topic>opera -- execution of arbitrary code</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>12.12</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><lt>12.12</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>12.12</lt></range>
	</package>
	<package>
	<name>linux-opera-devel</name>
	<range><lt>12.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/kb/view/1038/">
	<p>When loading GIF images into memory, Opera should allocate the
	correct amount of memory to store that image. Specially crafted
	image files can cause Opera to allocate the wrong amount of memory.
	Subsequent data may then overwrite unrelated memory with
	attacker-controlled data. This can lead to a crash, which may also
	execute that data as code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/kb/view/1038/</url>
	<url>http://www.opera.com/support/kb/view/1039/</url>
	</references>
	<dates>
	<discovery>2012-12-18</discovery>
	<entry>2012-12-18</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="1657a3e6-4585-11e2-a396-10bf48230856">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.258</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-27.html">
	<p>These updates address vulnerabilities that could cause a crash
	and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5676</cvename>
	<cvename>CVE-2012-5677</cvename>
	<cvename>CVE-2012-5678</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb12-27.html</url>
	</references>
	<dates>
	<discovery>2012-12-11</discovery>
	<entry>2012-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="953911fe-51ef-11e2-8e34-0022156e8794">
	<topic>tomcat -- bypass of CSRF prevention filter</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><ge>6.0.0</ge><le>6.0.35</le></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.31</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-7.html">
	<p>The CSRF prevention filter could be bypassed if a request was made to a
	protected resource without a session identifier present in the request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4431</cvename>
	<url>http://tomcat.apache.org/security-6.html</url>
	<url>http://tomcat.apache.org/security-7.html</url>
	</references>
	<dates>
	<discovery>2012-12-04</discovery>
	<entry>2012-12-04</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="134acaa2-51ef-11e2-8e34-0022156e8794">
	<topic>tomcat -- denial of service</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><ge>6.0.0</ge><le>6.0.35</le></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.27</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-7.html">
	<p>When using the NIO connector with sendfile and HTTPS enabled, if a
	client breaks the connection while reading the response an infinite loop
	is entered leading to a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4534</cvename>
	<url>http://tomcat.apache.org/security-6.html</url>
	<url>http://tomcat.apache.org/security-7.html</url>
	</references>
	<dates>
	<discovery>2012-12-04</discovery>
	<entry>2012-12-04</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="f599dfc4-3ec2-11e2-8ae1-001a8056d0b5">
	<topic>tomcat -- bypass of security constraints</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><ge>6.0.0</ge><le>6.0.35</le></range>
	</package>
	<package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.29</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-7.html">
	<p>When using FORM authentication it was possible to bypass the security
	constraint checks in the FORM authenticator by appending
	"/j_security_check" to the end of the URL if some other component
	(such as the Single-Sign-On valve) had called request.setUserPrincipal()
	before the call to FormAuthenticator#authenticate().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3546</cvename>
	<url>http://tomcat.apache.org/security-6.html</url>
	<url>http://tomcat.apache.org/security-7.html</url>
	</references>
	<dates>
	<discovery>2012-12-04</discovery>
	<entry>2012-12-04</entry>
	<modified>2017-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="2892a8e2-3d68-11e2-8e01-0800273fe665">
	<topic>dns/bind9* -- servers using DNS64 can be crashed by a crafted query</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.2.1</lt></range>
	</package>
	<package>
	<name>bind99-base</name>
	<range><lt>9.9.2.1</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.4.1</lt></range>
	</package>
	<package>
	<name>bind98-base</name>
	<range><lt>9.8.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-00828">
	<p>BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
	vulnerable to a software defect that allows a crafted query to
	crash the server with a REQUIRE assertion failure. Remote
	exploitation of this defect can be achieved without extensive
	effort, resulting in a denial-of-service (DoS) vector against
	affected servers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5688</cvename>
	</references>
	<dates>
	<discovery>2012-11-27</discovery>
	<entry>2012-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="f524d8e0-3d83-11e2-807a-080027ef73ec">
	<topic>bogofilter -- heap corruption by invalid base64 input</topic>
	<affects>
	<package> <name>bogofilter</name> <range><lt>1.2.3</lt></range> </package>
	<package> <name>bogofilter-sqlite</name> <range><lt>1.2.3</lt></range> </package>
	<package> <name>bogofilter-tc</name> <range><lt>1.2.3</lt></range> </package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Relson reports:</p>
	<blockquote cite="https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/NEWS">
	<p>Fix a heap corruption in base64 decoder on invalid input.
	Analysis and patch by Julius Plenz, [FU Berlin, Germany].</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5468</cvename>
	<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01</url>
	</references>
	<dates>
	<discovery>2012-10-17</discovery>
	<entry>2012-12-03</entry>
	</dates>
	</vuln>

	<vuln vid="aa4f86af-3172-11e2-ad21-20cf30e32f6d">
	<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
	<affects>
	<package>
	<name>yahoo-ui</name>
	<range><le>2.8.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The YUI team reports:</p>
	<blockquote cite="http://yuilibrary.com/support/20121030-vulnerability/">
	<h1>Vulnerability in YUI 2.4.0 through YUI 2.9.0</h1>
	<p>A XSS vulnerability has been discovered in some YUI 2 .swf files
	from versions 2.4.0 through 2.9.0. This defect allows JavaScript
	injection exploits to be created against domains that host affected
	YUI .swf files.</p>
	<p>If your site loads YUI 2 from a CDN (yui.yahooapis.com,
	ajax.googleapis.com, etc.) and not from your own domain, you
	are not affected. YUI 3 is not affected by this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5881</cvename>
	<cvename>CVE-2012-5882</cvename>
	<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
	</references>
	<dates>
	<discovery>2012-10-30</discovery>
	<entry>2012-11-27</entry>
	<modified>2012-11-29</modified>
	</dates>
	</vuln>

	<vuln vid="5536c8e4-36b3-11e2-a633-902b343deec9">
	<topic>FreeBSD -- Linux compatibility layer input validation error</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_11</lt></range>
	<range><ge>8.3</ge><lt>8.3_5</lt></range>
	<range><ge>9.0</ge><lt>9.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:08.linux.asc">
	<p>A programming error in the handling of some Linux system calls
	may result in memory locations being accessed without proper
	validation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:08.linux</freebsdsa>
	<cvename>CVE-2012-4576</cvename>
	</references>
	<dates>
	<discovery>2012-11-22</discovery>
	<entry>2012-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="f115f693-36b2-11e2-a633-902b343deec9">
	<topic>FreeBSD -- Insufficient message length validation for EAP-TLS messages</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_5</lt></range>
	<range><ge>9.0</ge><lt>9.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc">
	<p>The internal authentication server of hostapd does not
	sufficiently validate the message length field of EAP-TLS
	messages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:07.hostapd</freebsdsa>
	<cvename>CVE-2012-4445</cvename>
	</references>
	<dates>
	<discovery>2012-11-22</discovery>
	<entry>2012-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="4b79538b-a450-11e2-9898-001060e06fd4">
	<topic>FreeBSD -- Multiple Denial of Service vulnerabilities with named(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_11</lt></range>
	<range><ge>8.3</ge><lt>8.3_5</lt></range>
	<range><ge>9.0</ge><lt>9.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:06.bind.asc">
	<p>The BIND daemon would crash when a query is made on a resource
	record with RDATA that exceeds 65535 bytes.</p>
	<p>The BIND daemon would lock up when a query is made on specific
	combinations of RDATA.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:06.bind</freebsdsa>
	<cvename>CVE-2012-4244</cvename>
	<cvename>CVE-2012-5166</cvename>
	</references>
	<dates>
	<discovery>2012-11-22</discovery>
	<entry>2012-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="0925716f-34e2-11e2-aa75-003067c2616f">
	<topic>opera -- execution of arbitrary code</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>12.11</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><lt>12.11</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>12.11</lt></range>
	</package>
	<package>
	<name>linux-opera-devel</name>
	<range><lt>12.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/kb/view/1036/">
	<p>When requesting pages using HTTP, Opera temporarily stores the
	response in a buffer. In some cases, Opera may incorrectly allocate
	too little space for a buffer, and may then store too much of the
	response in that buffer. This causes a buffer overflow, which in
	turn can lead to a memory corruption and crash. It is possible to
	use this crash to execute the overflowing data as code, which may
	be controlled by an attacking site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/kb/view/1036/</url>
	</references>
	<dates>
	<discovery>2012-11-19</discovery>
	<entry>2012-11-22</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="1cd3ca42-33e6-11e2-a255-5404a67eef98">
	<topic>lighttpd -- remote DoS in header parsing</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><gt>1.4.30</gt><lt>1.4.32</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Lighttpd security advisory reports:</p>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt">
	<p>Certain Connection header values will trigger an endless loop, for example:
	"Connection: TE,,Keep-Alive"</p>
	<p>On receiving such value, lighttpd will enter an endless loop,
	detecting an empty token but not incrementing the current string
	position, and keep reading the ',' again and again.</p>
	<p>This bug was introduced in 1.4.31, when we fixed an "invalid read"
	bug (it would try to read the byte before the string if it started
	with ',', although the value wasn't actually used).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5533</cvename>
	</references>
	<dates>
	<discovery>2012-11-17</discovery>
	<entry>2012-11-21</entry>
	</dates>
	</vuln>

	<vuln vid="d23119df-335d-11e2-b64c-c8600054b392">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>17.0,1</lt></range>
	<range><lt>10.0.11,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.11,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.14</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.11</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.14</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0</lt></range>
	<range><lt>10.0.11</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/
	rv:10.0.11)</p>
	<p>MFSA 2012-92 Buffer overflow while rendering GIF images</p>
	<p>MFSA 2012-93 evalInSanbox location context incorrectly applied</p>
	<p>MFSA 2012-94 Crash when combining SVG text on path with CSS</p>
	<p>MFSA 2012-95 Javascript: URLs run in privileged context on New Tab
	page</p>
	<p>MFSA 2012-96 Memory corruption in str_unescape</p>
	<p>MFSA 2012-97 XMLHttpRequest inherits incorrect principal within
	sandbox</p>
	<p>MFSA 2012-98 Firefox installer DLL hijacking</p>
	<p>MFSA 2012-99 XrayWrappers exposes chrome-only properties when not
	in chrome compartment</p>
	<p>MFSA 2012-100 Improper security filtering for cross-origin
	wrappers</p>
	<p>MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset</p>
	<p>MFSA 2012-102 Script entered into Developer Toolbar runs with
	chrome privileges</p>
	<p>MFSA 2012-103 Frames can shadow top.location</p>
	<p>MFSA 2012-104 CSS and HTML injection through Style Inspector</p>
	<p>MFSA 2012-105 Use-after-free and buffer overflow issues found</p>
	<p>MFSA 2012-106 Use-after-free, buffer overflow, and memory
	corruption issues found using Address Sanitizer</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4201</cvename>
	<cvename>CVE-2012-4202</cvename>
	<cvename>CVE-2012-4203</cvename>
	<cvename>CVE-2012-4204</cvename>
	<cvename>CVE-2012-4205</cvename>
	<cvename>CVE-2012-4206</cvename>
	<cvename>CVE-2012-4207</cvename>
	<cvename>CVE-2012-4208</cvename>
	<cvename>CVE-2012-4209</cvename>
	<cvename>CVE-2012-4210</cvename>
	<cvename>CVE-2012-4212</cvename>
	<cvename>CVE-2012-4213</cvename>
	<cvename>CVE-2012-4214</cvename>
	<cvename>CVE-2012-4215</cvename>
	<cvename>CVE-2012-4216</cvename>
	<cvename>CVE-2012-4217</cvename>
	<cvename>CVE-2012-4218</cvename>
	<cvename>CVE-2012-5829</cvename>
	<cvename>CVE-2012-5830</cvename>
	<cvename>CVE-2012-5833</cvename>
	<cvename>CVE-2012-5835</cvename>
	<cvename>CVE-2012-5836</cvename>
	<cvename>CVE-2012-5837</cvename>
	<cvename>CVE-2012-5838</cvename>
	<cvename>CVE-2012-5839</cvename>
	<cvename>CVE-2012-5840</cvename>
	<cvename>CVE-2012-5841</cvename>
	<cvename>CVE-2012-5842</cvename>
	<cvename>CVE-2012-5843</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-91.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-92.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-93.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-94.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-95.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-96.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-97.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-98.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-99.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-100.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-101.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-102.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-103.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-104.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-105.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-106.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2012-11-20</discovery>
	<entry>2012-11-20</entry>
	</dates>
	</vuln>

	<vuln vid="81826d12-317a-11e2-9186-406186f3d89d">
	<topic>weechat -- Arbitrary shell command execution via scripts</topic>
	<affects>
	<package>
	<name>weechat</name>
	<range><ge>0.3.0</ge><lt>0.3.9.2</lt></range>
	</package>
	<package>
	<name>weechat-devel</name>
	<range><lt>20121118</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastien Helleu reports:</p>
	<blockquote cite="http://weechat.org/security/">
	<p>Untrusted command for function hook_process could lead to
	execution of commands, because of shell expansions.</p>
	<p>Workaround with a non-patched version: remove/unload all scripts
	calling function hook_process (for maximum safety).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://weechat.org/security/</url>
	<url>https://savannah.nongnu.org/bugs/?37764</url>
	</references>
	<dates>
	<discovery>2012-11-15</discovery>
	<entry>2012-11-18</entry>
	<modified>2012-11-18</modified>
	</dates>
	</vuln>

	<vuln vid="2b841f88-2e8d-11e2-ad21-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.12</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.9</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.11/">
	<p>The following security issues have been discovered in
	Bugzilla:</p>
	<h1>Information Leak</h1>
	<p>If the visibility of a custom field is controlled by a product
	or a component of a product you cannot see, their names are
	disclosed in the JavaScript code generated for this custom field
	despite they should remain confidential.</p>
	<p>Calling the User.get method with a 'groups' argument leaks the
	existence of the groups depending on whether an error is thrown
	or not. This method now also throws an error if the user calling
	this method does not belong to these groups (independently of
	whether the groups exist or not).</p>
	<p>Trying to mark an attachment in a bug you cannot see as obsolete
	discloses its description in the error message. The description
	of the attachment is now removed from the error message.</p>
	<h1>Cross-Site Scripting</h1>
	<p>Due to incorrectly filtered field values in tabular reports,
	it is possible to inject code leading to XSS.</p>
	<p>A vulnerability in swfstore.swf from YUI2 allows JavaScript
	injection exploits to be created against domains that host this
	affected YUI .swf file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4199</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=731178</url>
	<cvename>CVE-2012-4198</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=781850</url>
	<cvename>CVE-2012-4197</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=802204</url>
	<cvename>CVE-2012-4189</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=790296</url>
	<cvename>CVE-2012-5881</cvename>
	<cvename>CVE-2012-5882</cvename>
	<cvename>CVE-2012-5883</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=808845</url>
	<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
	</references>
	<dates>
	<discovery>2012-11-13</discovery>
	<entry>2012-11-14</entry>
	<modified>2012-11-27</modified>
	</dates>
	</vuln>

	<vuln vid="79818ef9-2d10-11e2-9160-00262d5ed8ee">
	<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.21</lt></range>
	<range><ge>4.6.0</ge><lt>4.6.14</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo Security Team reports:</p>
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/">
	<p>TYPO3 Backend History Module - Due to missing encoding of user
	input, the history module is susceptible to SQL Injection and
	Cross-Site Scripting. A valid backend login is required to exploit
	this vulnerability. Credits go to Thomas Worm who discovered and
	reported the issue.</p>
	<p>TYPO3 Backend API - Failing to properly HTML-encode user input the
	tree render API (TCA-Tree) is susceptible to Cross-Site Scripting.
	TYPO3 Versions below 6.0 does not make us of this API, thus is not
	exploitable, if no third party extension is installed which uses
	this API. A valid backend login is required to exploit this
	vulnerability. Credits go to Richard Brain who discovered and
	reported the issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/</url>
	</references>
	<dates>
	<discovery>2012-11-08</discovery>
	<entry>2012-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="a537b449-2b19-11e2-b339-90e6ba652cce">
	<topic>DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust</topic>
	<affects>
	<package>
	<name>opendkim</name>
	<range><lt>2.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/268267">
	<p>DomainKeys Identified Mail (DKIM) Verifiers may
	inappropriately convey message trust when messages are
	signed using test or small bit signing keys.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<certvu>268267</certvu>
	</references>
	<dates>
	<discovery>2012-10-24</discovery>
	<entry>2012-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="e02c572f-2af0-11e2-bb44-003067b2972c">
	<topic>weechat -- Crash or freeze when decoding IRC colors in strings</topic>
	<affects>
	<package>
	<name>weechat</name>
	<range><ge>0.3.6</ge><lt>0.3.9.1</lt></range>
	</package>
	<package>
	<name>weechat-devel</name>
	<range><ge>20110614</ge><lt>20121110</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastien Helleu reports:</p>
	<blockquote cite="https://savannah.nongnu.org/bugs/?37704">
	<p>A buffer overflow is causing a crash or freeze of WeeChat when
	decoding IRC colors in strings.</p>
	<p>Workaround for a non-patched version:
	/set irc.network.colors_receive off</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5854</cvename>
	<freebsdpr>ports/173513</freebsdpr>
	<url>http://weechat.org/security/</url>
	<url>https://savannah.nongnu.org/bugs/?37704</url>
	</references>
	<dates>
	<discovery>2012-11-09</discovery>
	<entry>2012-11-10</entry>
	<modified>2012-11-13</modified>
	</dates>
	</vuln>

	<vuln vid="5e647ca3-2aea-11e2-b745-001fd0af1a4c">
	<topic>ruby -- Hash-flooding DoS vulnerability for ruby 1.9</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>1.9</ge><lt>1.9.3.327</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/">
	<p>Carefully crafted sequence of strings can cause a denial of service
	attack on the service that parses the sequence to create a Hash
	object by using the strings as keys. For instance, this
	vulnerability affects web application that parses the JSON data
	sent from untrusted entity.</p>
	<p>This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
	1.9 versions were using modified MurmurHash function but it's
	reported that there is a way to create sequence of strings that
	collide their hash values each other. This fix changes the Hash
	function of String object from the MurmurHash to SipHash 2-4.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5371</cvename>
	<url>http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/</url>
	</references>
	<dates>
	<discovery>2012-11-10</discovery>
	<entry>2012-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="152e4c7e-2a2e-11e2-99c7-00a0d181e71d">
	<topic>tomcat -- authentication weaknesses</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.36</lt></range>
	<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
	<range><gt>7.0.0</gt><lt>7.0.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security.html">
	<p>Three weaknesses in Tomcat's implementation of DIGEST
	authentication were identified and resolved:</p>
	<ul>
	<li> Tomcat tracked client rather than server nonces and nonce count.</li>
	<li> When a session ID was present, authentication was bypassed.</li>
	<li> The user name and password were not checked before when indicating
	that a nonce was stale.</li>
	</ul>
	<p>These issues reduced the security of DIGEST authentication making
	replay attacks possible in some circumstances.</p>
	<p>The first issue was identified by Tilmann Kuhn. The second and third
	issues were identified by the Tomcat security team during the code
	review resulting from the first issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3439</cvename>
	<url>http://tomcat.apache.org/security.html</url>
	<url>http://tomcat.apache.org/security-5.html</url>
	<url>http://tomcat.apache.org/security-6.html</url>
	<url>http://tomcat.apache.org/security-7.html</url>
	</references>
	<dates>
	<discovery>2012-11-05</discovery>
	<entry>2012-11-08</entry>
	<modified>2012-11-09</modified>
	</dates>
	</vuln>

	<vuln vid="4ca26574-2a2c-11e2-99c7-00a0d181e71d">
	<topic>tomcat -- Denial of Service</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
	<range><gt>7.0.0</gt><lt>7.0.28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation reports:</p>
	<blockquote cite="http://tomcat.apache.org/security.html">
	<p>The checks that limited the permitted size of request headers were
	implemented too late in the request parsing process for the HTTP NIO
	connector. This enabled a malicious user to trigger an
	OutOfMemoryError by sending a single request with very large
	headers. This issue was identified by Josh Spiewak.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2733</cvename>
	<url>http://tomcat.apache.org/security.html</url>
	<url>http://tomcat.apache.org/security-6.html</url>
	<url>http://tomcat.apache.org/security-7.html</url>
	</references>
	<dates>
	<discovery>2012-11-05</discovery>
	<entry>2012-11-08</entry>
	<modified>2012-11-09</modified>
	</dates>
	</vuln>

	<vuln vid="4b8b748e-2a24-11e2-bb44-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.243</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
	<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5274</cvename>
	<cvename>CVE-2012-5275</cvename>
	<cvename>CVE-2012-5276</cvename>
	<cvename>CVE-2012-5277</cvename>
	<cvename>CVE-2012-5278</cvename>
	<cvename>CVE-2012-5279</cvename>
	<cvename>CVE-2012-5280</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb12-24.html</url>
	</references>
	<dates>
	<discovery>2012-10-08</discovery>
	<entry>2012-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="38daea4f-2851-11e2-9483-14dae938ec40">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>12.10</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><lt>12.10</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>12.10</lt></range>
	</package>
	<package>
	<name>linux-opera-devel</name>
	<range><lt>12.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/kb/view/1030/">
	<p>CORS (Cross-Origin Resource Sharing) allows web pages to retrieve
	the contents of pages from other sites, with their permission,
	as they would appear for the current user.
	When requests are made in this way, the browser should only allow
	the page content to be retrieved if the target site sends the
	correct headers that give permission for their contents to be
	used in this way. Specially crafted requests may trick Opera
	into thinking that the target site has given permission when it
	had not done so. This can result in the contents of any target page
	being revealed to untrusted sites, including any
	sensitive information or session IDs contained within the
	source of those pages.</p>
	</blockquote>
	<p>Also reported are vulnerabilities involving SVG graphics and XSS.</p>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/kb/view/1030/</url>
	<url>http://www.opera.com/support/kb/view/1031/</url>
	<url>http://www.opera.com/support/kb/view/1033/</url>
	</references>
	<dates>
	<discovery>2012-11-06</discovery>
	<entry>2012-11-06</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="36533a59-2770-11e2-bb44-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.238</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
	<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5248</cvename>
	<cvename>CVE-2012-5249</cvename>
	<cvename>CVE-2012-5250</cvename>
	<cvename>CVE-2012-5251</cvename>
	<cvename>CVE-2012-5252</cvename>
	<cvename>CVE-2012-5253</cvename>
	<cvename>CVE-2012-5254</cvename>
	<cvename>CVE-2012-5255</cvename>
	<cvename>CVE-2012-5256</cvename>
	<cvename>CVE-2012-5257</cvename>
	<cvename>CVE-2012-5258</cvename>
	<cvename>CVE-2012-5259</cvename>
	<cvename>CVE-2012-5260</cvename>
	<cvename>CVE-2012-5261</cvename>
	<cvename>CVE-2012-5262</cvename>
	<cvename>CVE-2012-5263</cvename>
	<cvename>CVE-2012-5264</cvename>
	<cvename>CVE-2012-5265</cvename>
	<cvename>CVE-2012-5266</cvename>
	<cvename>CVE-2012-5267</cvename>
	<cvename>CVE-2012-5269</cvename>
	<cvename>CVE-2012-5270</cvename>
	<cvename>CVE-2012-5271</cvename>
	<cvename>CVE-2012-5272</cvename>
	<cvename>CVE-2012-5285</cvename>
	<cvename>CVE-2012-5286</cvename>
	<cvename>CVE-2012-5287</cvename>
	<cvename>CVE-2012-5673</cvename>
	<cvename>CVE-2012-2034</cvename>
	<cvename>CVE-2012-2035</cvename>
	<cvename>CVE-2012-2036</cvename>
	<cvename>CVE-2012-2037</cvename>
	<cvename>CVE-2012-2038</cvename>
	<cvename>CVE-2012-2039</cvename>
	<cvename>CVE-2012-2040</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb12-22.html</url>
	</references>
	<dates>
	<discovery>2012-10-08</discovery>
	<entry>2012-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="65539c54-2517-11e2-b9d6-20cf30e32f6d">
	<topic>apache22 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
	</package>
	<package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
	</package>
	<package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
	</package>
	<package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
	</package>
	<package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
	<h1>low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687</h1>
	<p>Possible XSS for sites which use mod_negotiation and
	allow untrusted uploads to locations which have MultiViews enabled.</p>
	<h1>low: insecure LD_LIBRARY_PATH handling CVE-2012-0883</h1>
	<p>This issue was already fixed in port version 2.2.22_5</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2687</cvename>
	<cvename>CVE-2012-0833</cvename><!-- already fixed in r301849 -->
	</references>
	<dates>
	<discovery>2012-09-13</discovery>
	<entry>2012-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="ec89dc70-2515-11e2-8eda-000a5e1e33c6">
	<topic>webmin -- potential XSS attack via real name field</topic>
	<affects>
	<package>
	<name>webmin</name>
	<range><lt>1.600_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The webmin updates site reports</p>
	<blockquote cite="http://www.webmin.com/updates.html">
	<p>Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack
	via real name field; Solution: New module.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.webmin.com/updates.html</url>
	</references>
	<dates>
	<discovery>2012-11-02</discovery>
	<entry>2012-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="3decc87d-2498-11e2-b0c7-000d601460a4">
	<topic>ruby -- Unintentional file creation caused by inserting an illegal NUL character</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/">
	<p>A vulnerability was found that file creation routines can create
	unintended files by strategically inserting NUL(s) in file paths.
	This vulnerability has been reported as CVE-2012-4522.</p>
	<p>Ruby can handle arbitrary binary patterns as Strings, including
	NUL chars. On the other hand OSes and other libraries tend not.
	They usually treat a NUL as an End of String mark. So to interface
	them with Ruby, NUL chars should properly be avoided.</p>
	<p>However methods like IO#open did not check the filename passed to
	them, and just passed those strings to lower layer routines. This
	led to create unintentional files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4522</cvename>
	<url>http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/</url>
	<url>https://access.redhat.com/security/cve/CVE-2012-4522/</url>
	</references>
	<dates>
	<discovery>2012-10-12</discovery>
	<entry>2012-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="2a093853-2495-11e2-b0c7-000d601460a4">
	<topic>ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><gt>1.8.7,1</gt><lt>1.8.7.371,1</lt></range>
	<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/">
	<p>Vulnerabilities found for Exception#to_s, NameError#to_s, and
	name_err_mesg_to_s() which is Ruby interpreter-internal API. A
	malicious user code can bypass $SAFE check by utilizing one of
	those security holes.</p>
	<p>Ruby's $SAFE mechanism enables untrusted user codes to run in
	$SAFE >= 4 mode. This is a kind of sandboxing so some operations
	are restricted in that mode to protect other data outside the
	sandbox.</p>
	<p>The problem found was around this mechanism. Exception#to_s,
	NameError#to_s, and name_err_mesg_to_s() interpreter-internal API
	was not correctly handling the $SAFE bits so a String object which
	is not tainted can destructively be marked as tainted using them.
	By using this an untrusted code in a sandbox can modify a
	formerly-untainted string destructively.</p>
	<p>Ruby 1.8 once had a similar security issue. It fixed
	Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue
	survived previous security fix</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4464</cvename>
	<cvename>CVE-2012-4466</cvename>
	<url>http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/</url>
	<url>https://access.redhat.com/security/cve/CVE-2012-4464/</url>
	</references>
	<dates>
	<discovery>2012-08-21</discovery>
	<entry>2012-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="4b738d54-2427-11e2-9817-c8600054b392">
	<topic>RT -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>rt40</name>
	<range><ge>4.0</ge><lt>4.0.8</lt></range>
	</package>
	<package>
	<name>rt38</name>
	<range><lt>3.8.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BestPractical report:</p>
	<blockquote cite="http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html">
	<p>All versions of RT are vulnerable to an email header injection
	attack. Users with ModifySelf or AdminUser can cause RT to add
	arbitrary headers or content to outgoing mail. Depending on the
	scrips that are configured, this may be be leveraged for information
	leakage or phishing.</p>
	<p>RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability
	due to lack of proper rights checking, allowing any privileged user
	to create Articles in any class.</p>
	<p>All versions of RT with cross-site-request forgery (CSRF)
	protection (RT 3.8.12 and above, RT 4.0.6 and above, and any
	instances running the security patches released 2012-05-22) contain
	a vulnerability which incorrectly allows though CSRF requests which
	toggle ticket bookmarks.</p>
	<p>All versions of RT are vulnerable to a confused deputy attack on
	the user. While not strictly a CSRF attack, users who are not logged
	in who are tricked into following a malicious link may, after
	supplying their credentials, be subject to an attack which leverages
	their credentials to modify arbitrary state. While users who were
	logged in would have observed the CSRF protection page, users who
	were not logged in receive no such warning due to the intervening
	login process. RT has been extended to notify users of pending
	actions during the login process.</p>
	<p>RT 3.8.0 and above are susceptible to a number of vulnerabilities
	concerning improper signing or encryption of messages using GnuPG;
	if GnuPG is not enabled, none of the following affect you.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4730</cvename>
	<cvename>CVE-2012-4731</cvename>
	<cvename>CVE-2012-4732</cvename>
	<cvename>CVE-2012-4734</cvename>
	<cvename>CVE-2012-4735</cvename>
	<cvename>CVE-2012-4884</cvename>
	<url>http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html</url>
	</references>
	<dates>
	<discovery>2012-10-26</discovery>
	<entry>2012-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5">
	<topic>drupal7 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal7</name>
	<range><lt>7.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="http://drupal.org/node/1815912">
	<ol>
	<li>
	<p>Arbitrary PHP code execution</p>
	<p>A bug in the installer code was identified that allows an attacker
	to re-install Drupal using an external database server under certain
	transient conditions. This could allow the attacker to execute
	arbitrary PHP code on the original server.</p>
	</li>
	<li>
	<p>Information disclosure - OpenID module</p>
	<p>For sites using the core OpenID module, an information disclosure
	vulnerability was identified that allows an attacker to read files
	on the local filesystem by attempting to log in to the site using a
	malicious OpenID server.</p>
	</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/1815912</url>
	</references>
	<dates>
	<discovery>2012-10-17</discovery>
	<entry>2012-10-31</entry>
	</dates>
	</vuln>

	<vuln vid="6b3b1b97-207c-11e2-a03f-c8600054b392">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>16.0.2,1</lt></range>
	<range><lt>10.0.10,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.10,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.13.2</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.10</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.13.2</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>16.0.2</lt></range>
	<range><lt>10.0.10</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-90 Fixes for Location object issues</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4194</cvename>
	<cvename>CVE-2012-4195</cvename>
	<cvename>CVE-2012-4196</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
	</references>
	<dates>
	<discovery>2012-10-26</discovery>
	<entry>2012-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="b0f3ab1f-1f3b-11e2-8fe9-0022156e8794">
	<topic>Exim -- remote code execution</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><ge>4.70</ge><lt>4.80.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>This vulnerability affects Exim instances built with DKIM
	enabled (this is the default for FreeBSD Exim port) and running
	verification of DKIM signatures on the incoming mail
	messages.</p>
	<p>Phil Penncock reports:</p>
	<blockquote cite="https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html">
	<p>This is a SECURITY release, addressing a CRITICAL remote
	code execution flaw in versions of Exim between 4.70 and
	4.80 inclusive, when built with DKIM support (the default).</p>
	<p>This security vulnerability can be exploited by anyone
	who can send email from a domain for which they control the
	DNS.</p>
	<p>You are not vulnerable if you built Exim with DISABLE_DKIM
	or if you put this at the start of an ACL plumbed into
	acl_smtp_connect or acl_smtp_rcpt:</p>
	<pre>warn control = dkim_disable_verify</pre>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5671</cvename>
	<url>https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html</url>
	</references>
	<dates>
	<discovery>2012-10-25</discovery>
	<entry>2012-10-26</entry>
	</dates>
	</vuln>

	<vuln vid="5f326d75-1db9-11e2-bc8f-d0df9acfd7e5">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>django</name>
	<range><lt>1.4.2</lt></range>
	</package>
	<package>
	<name>django13</name>
	<range><lt>1.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django Project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2012/oct/17/security/">
	<ol>
	<li>
	<p>Host header poisoning</p>
	<p>Some parts of Django -- independent of end-user-written applications
	-- make use of full URLs, including domain name, which are generated
	from the HTTP Host header. Some attacks against this are beyond Django's
	ability to control, and require the web server to be properly configured;
	Django's documentation has for some time contained notes advising users
	on such configuration.</p>
	<p>Django's own built-in parsing of the Host header is, however, still
	vulnerable, as was reported to us recently. The Host header parsing
	in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host()
	-- was incorrectly handling username/password information in the header.
	Thus, for example, the following Host header would be accepted by Django when
	running on "validsite.com":</p>
	<p>Host: validsite.com:random@evilsite.com</p>
	<p>Using this, an attacker can cause parts of Django -- particularly the
	password-reset mechanism -- to generate and display arbitrary URLs to users.</p>
	<p>To remedy this, the parsing in HttpRequest.get_host() is being modified; Host
	headers which contain potentially dangerous content (such as username/password
	pairs) now raise the exception django.core.exceptions.SuspiciousOperation.</p>
	</li>
	<li>
	<p>Documentation of HttpOnly cookie option</p>
	<p>As of Django 1.4, session cookies are always sent with the HttpOnly flag, which
	provides some additional protection from cross-site scripting attacks by denying
	client-side scripts access to the session cookie.</p>
	<p>Though not directly a security issue in Django, it has been reported that the
	Django 1.4 documentation incorrectly described this change, by claiming that this
	was now the default for all cookies set by the HttpResponse.set_cookie() method.</p>
	<p>The Django documentation has been updated to reflect that this only applies to the
	session cookie. Users of Django are encouraged to review their use of set_cookie()
	to ensure that the HttpOnly flag is being set or unset appropriately.</p>
	</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4520</cvename>
	<url>https://www.djangoproject.com/weblog/2012/oct/17/security/</url>
	</references>
	<dates>
	<discovery>2012-10-17</discovery>
	<entry>2012-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="a7706414-1be7-11e2-9aad-902b343deec9">
	<topic>Wireshark -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><le>1.8.2_1</le></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><le>1.8.2_1</le></range>
	</package>
	<package>
	<name>tshark</name>
	<range><le>1.8.2_1</le></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><le>1.8.2_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark reports:</p>
	<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html">
	<p>The HSRP dissector could go into an infinite loop.</p>
	<p>The PPP dissector could abort.</p>
	<p>Martin Wilck discovered an infinite loop in the DRDA
	dissector.</p>
	<p>Laurent Butti discovered a buffer overflow in the LDP
	dissector.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5237</cvename>
	<cvename>CVE-2012-5238</cvename>
	<cvename>CVE-2012-5239</cvename>
	<cvename>CVE-2012-5240</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-26.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-27.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-28.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-29.html</url>
	<url>http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html</url>
	</references>
	<dates>
	<discovery>2012-10-02</discovery>
	<entry>2012-10-22</entry>
	<modified>2013-06-19</modified>
	</dates>
	</vuln>

	<vuln vid="57652765-18aa-11e2-8382-00a0d181e71d">
	<topic>xlockmore -- local exploit</topic>
	<affects>
	<package>
	<name>xlockmore</name>
	<range><lt>5.40_1</lt></range>
	</package>
	<package>
	<name>ja-xlockmore</name>
	<range><lt>5.40_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ignatios Souvatzis of NetBSD reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/10/17/10">
	<p>Due to an error in the dclock screensaver in xlockmore, users who
	explicitly use this screensaver or a random mix of screensavers using
	something like "xlockmore -mode random" may have their screen unlocked
	unexpectedly at a random time.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4524</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2012/10/17/10</mlist>
	</references>
	<dates>
	<discovery>2012-10-17</discovery>
	<entry>2012-10-17</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="e11955ca-187c-11e2-be36-00215af774f0">
	<topic>xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled</topic>
	<affects>
	<package>
	<name>xinetd</name>
	<range><lt>2.3.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thomas Swan reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=790940">
	<p>xinetd allows for services to be configured with the TCPMUX
	or TCPMUXPLUS service types, which makes those services
	available on port 1, as per RFC 1078 [1], if the tcpmux-server
	service is enabled. When the tcpmux-server service is enabled,
	xinetd would expose _all_ enabled services via the tcpmux port,
	instead of just the configured service(s). This could allow
	a remote attacker to bypass firewall restrictions and access
	services via the tcpmux port.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0862</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=790940</url>
	</references>
	<dates>
	<discovery>2012-02-15</discovery>
	<entry>2012-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="ec34d0c2-1799-11e2-b4ab-000c29033c32">
	<topic>Zend Framework -- Multiple vulnerabilities via XXE injection</topic>
	<affects>
	<package>
	<name>ZendFramework</name>
	<range><lt>1.11.13</lt></range>
	</package>
	<package>
	<name>magento</name>
	<range><lt>1.7.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Zend Framework team reports:</p>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2012-01">
	<p>The XmlRpc package of Zend Framework is vulnerable to XML
	eXternal Entity Injection attacks (both server and client).
	The SimpleXMLElement class (SimpleXML PHP extension) is used
	in an insecure way to parse XML data. External entities can be
	specified by adding a specific DOCTYPE element to XML-RPC
	requests. By exploiting this vulnerability an application may be
	coerced to open arbitrary files and/or TCP connections.</p>
	<p>Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and
	Zend_XmlRpc components are vulnerable to XML Entity Expansion
	(XEE) vectors, leading to Denial of Service vectors. XEE attacks
	occur when the XML DOCTYPE declaration includes XML entity
	definitions that contain either recursive or circular references;
	this leads to CPU and memory consumption, making Denial of
	Service exploits trivial to implement.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3363</cvename>
	<url>https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt</url>
	<url>http://framework.zend.com/security/advisory/ZF2012-01</url>
	<url>http://framework.zend.com/security/advisory/ZF2012-02</url>
	<url>http://www.openwall.com/lists/oss-security/2012/06/26/2</url>
	<url>https://secunia.com/advisories/49665/</url>
	<url>http://www.magentocommerce.com/download/release_notes</url>
	</references>
	<dates>
	<discovery>2012-06-26</discovery>
	<entry>2012-10-16</entry>
	<modified>2015-10-14</modified>
	</dates>
	</vuln>

	<vuln vid="f94befcd-1289-11e2-a25e-525400272390">
	<topic>gitolite -- path traversal vulnerability</topic>
	<affects>
	<package>
	<name>gitolite</name>
	<range><ge>3.01</ge><le>3.04</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sitaram Chamarty reports:</p>
	<blockquote cite="https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion">
	<p>I'm sorry to say there is a potential path traversal vulnerability in
	v3. Thanks to Stephane Chazelas for finding it and alerting me.</p>
	<p>Can it affect you? This can only affect you if you are using wild
	card repos, and at least one of your patterns allows the string
	"../" to match multiple times.</p>
	<p>How badly can it affect you? A malicious user who also has the
	ability to create arbitrary files in, say, /tmp (e.g., he has his own
	userid on the same box), can compromise the entire "git" user.
	Otherwise the worst he can do is create arbitrary repos in /tmp.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4506</cvename>
	<mlist msgid="CAMK1S_jotna+d_X2C-+es-M28i1aUBcsNeiXxwJ63EshQ8ht6w@mail.gmail.com">https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion</mlist>
	</references>
	<dates>
	<discovery>2012-10-09</discovery>
	<entry>2012-10-15</entry>
	</dates>
	</vuln>

	<vuln vid="ef417da3-1640-11e2-999b-e0cb4e266481">
	<topic>phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><ge>3.5</ge><lt>3.5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php">
	<p>When creating/modifying a trigger, event or procedure
	with a crafted name, it is possible to trigger an XSS.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php">
	<p>To display information about the current phpMyAdmin
	version on the main page, a piece of JavaScript is fetched
	from the phpmyadmin.net website in non-SSL mode. A
	man-in-the-middle could modify this script on the wire to
	cause mischief.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5339</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php</url>
	<cvename>CVE-2012-5368</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php</url>
	</references>
	<dates>
	<discovery>2012-10-08</discovery>
	<entry>2012-10-14</entry>
	</dates>
	</vuln>

	<vuln vid="6e5a9afd-12d3-11e2-b47d-c8600054b392">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>16.0.1,1</lt></range>
	<range><lt>10.0.9,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.9,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.13.1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.9</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.13.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>16.0.1</lt></range>
	<range><lt>10.0.9</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p> MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/
	rv:10.0.8)</p>
	<p>MFSA 2012-75 select element persistance allows for attacks</p>
	<p>MFSA 2012-76 Continued access to initial origin after setting
	document.domain</p>
	<p>MFSA 2012-77 Some DOMWindowUtils methods bypass security checks</p>
	<p>MFSA 2012-78 Reader Mode pages have chrome privileges</p>
	<p>MFSA 2012-79 DOS and crash with full screen and history navigation</p>
	<p>MFSA 2012-80 Crash with invalid cast when using instanceof
	operator</p>
	<p>MFSA 2012-81 GetProperty function can bypass security checks</p>
	<p>MFSA 2012-82 top object and location property accessible by
	plugins</p>
	<p>MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces
	to privileged functions or properties</p>
	<p>MFSA 2012-84 Spoofing and script injection through location.hash</p>
	<p>MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds
	read issues found using Address Sanitizer</p>
	<p>MFSA 2012-86 Heap memory corruption issues found using Address
	Sanitizer</p>
	<p>MFSA 2012-87 Use-after-free in the IME State Manager</p>
	<p>MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)</p>
	<p>MFSA 2012-89 defaultValue security checks not applied</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3982</cvename>
	<cvename>CVE-2012-3983</cvename>
	<cvename>CVE-2012-3984</cvename>
	<cvename>CVE-2012-3985</cvename>
	<cvename>CVE-2012-3986</cvename>
	<cvename>CVE-2012-3987</cvename>
	<cvename>CVE-2012-3988</cvename>
	<cvename>CVE-2012-3989</cvename>
	<cvename>CVE-2012-3990</cvename>
	<cvename>CVE-2012-3991</cvename>
	<cvename>CVE-2012-3992</cvename>
	<cvename>CVE-2012-3993</cvename>
	<cvename>CVE-2012-3994</cvename>
	<cvename>CVE-2012-3995</cvename>
	<cvename>CVE-2012-4179</cvename>
	<cvename>CVE-2012-4180</cvename>
	<cvename>CVE-2012-4181</cvename>
	<cvename>CVE-2012-4182</cvename>
	<cvename>CVE-2012-4183</cvename>
	<cvename>CVE-2012-4184</cvename>
	<cvename>CVE-2012-4186</cvename>
	<cvename>CVE-2012-4187</cvename>
	<cvename>CVE-2012-4188</cvename>
	<cvename>CVE-2012-4190</cvename>
	<cvename>CVE-2012-4191</cvename>
	<cvename>CVE-2012-4192</cvename>
	<cvename>CVE-2012-4193</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-74.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-75.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-76.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-77.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-78.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-79.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-80.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-81.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-82.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-83.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-84.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-85.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-86.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-87.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-88.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-89.html</url>
	</references>
	<dates>
	<discovery>2012-10-09</discovery>
	<entry>2012-10-10</entry>
	<modified>2012-10-11</modified>
	</dates>
	</vuln>

	<vuln vid="57a700f9-12c0-11e2-9f86-001d923933b6">
	<topic>dns/bind9* -- crash on deliberately constructed combination of records</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.1.4</lt></range>
	</package>
	<package>
	<name>bind99-base</name>
	<range><lt>9.9.1.4</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.3.4</lt></range>
	</package>
	<package>
	<name>bind98-base</name>
	<range><lt>9.8.3.4</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.6.4</lt></range>
	</package>
	<package>
	<name>bind97-base</name>
	<range><lt>9.7.6.4</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.4</lt></range>
	</package>
	<package>
	<name>bind96-base</name>
	<range><lt>9.6.3.1.ESV.R7.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-00801/">
	<p>A deliberately constructed combination of records could cause named
	to hang while populating the additional section of a response.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-5166</cvename>
	</references>
	<dates>
	<discovery>2012-09-26</discovery>
	<entry>2012-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="dee44ba9-08ab-11e2-a044-d0df9acfd7e5">
	<topic>OpenX -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>openx</name>
	<range><lt>2.8.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/50598/">
	<p>A vulnerability has been discovered in OpenX, which can be
	exploited by malicious people to conduct SQL injection
	attacks.</p>
	<p>Input passed via the "xajaxargs" parameter to
	www/admin/updates-history.php (when "xajax" is set to
	"expandOSURow") is not properly sanitised in e.g. the
	"queryAuditBackupTablesByUpgradeId()" function
	(lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL
	queries. This can be exploited to manipulate SQL queries by
	injecting arbitrary SQL code.</p>
	<p>The vulnerability is confirmed in version 2.8.9. Prior versions
	may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/50598/</url>
	</references>
	<dates>
	<discovery>2012-09-14</discovery>
	<entry>2012-09-27</entry>
	</dates>
	</vuln>

	<vuln vid="73efb1b7-07ec-11e2-a391-000c29033c32">
	<topic>eperl -- Remote code execution</topic>
	<affects>
	<package>
	<name>eperl</name>
	<range><le>2.2.14_4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Madison reports:</p>
	<blockquote cite="http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml">
	<p>ePerl is a multipurpose Perl filter and interpreter program
	for Unix systems. The ePerl preprocessor contains an input
	validation error. The preprocessor allows foreign data to be
	"safely" included using the 'sinclude' directive.</p>
	<p>The problem occurs when a file referenced by a 'sinclude'
	directive contains a 'include' directive; the contents of
	the file referred to by the second directive will be loaded
	and executed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2001-0733</cvename>
	<url>http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml</url>
	<bid>2912</bid>
	<url>http://xforce.iss.net/xforce/xfdb/6743</url>
	<url>http://osvdb.org/show/osvdb/1880</url>
	</references>
	<dates>
	<discovery>2001-06-21</discovery>
	<entry>2012-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="98690c45-0361-11e2-a391-000c29033c32">
	<topic>ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<range><le>6.7.8.6</le></range>
	</package>
	<package>
	<name>ImageMagick-nox11</name>
	<range><le>6.7.8.6</le></range>
	</package>
	<package>
	<name>GraphicsMagick</name>
	<range><ge>1.3.0</ge><le>1.3.16</le></range>
	</package>
	<package>
	<name>GraphicsMagick-nox11</name>
	<range><ge>1.3.0</ge><le>1.3.16</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kurt Seifried reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=844105">
	<p>There is an issue in ImageMagick that is also present in
	GraphicsMagick. CVE-2011-3026 deals with libpng memory
	allocation, and limitations have been added so that a bad PNG
	can't cause the system to allocate a lot of memory and a
	denial of service. However on further investigation of
	ImageMagick, Tom Lane found that PNG malloc function
	(Magick_png_malloc) in turn calls AcquireMagickMemory with an
	improper size argument.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3438</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=844105</url>
	<bid>54716</bid>
	<url>http://secunia.com/advisories/50090</url>
	<url>http://xforce.iss.net/xforce/xfdb/77259</url>
	<url>http://osvdb.org/show/osvdb/84323</url>
	</references>
	<dates>
	<discovery>2012-07-28</discovery>
	<entry>2012-09-20</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="ec255bd8-02c6-11e2-92d1-000d601460a4">
	<topic>php5-sqlite -- open_basedir bypass</topic>
	<affects>
	<package>
	<name>php5-sqlite</name>
	<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
	<range><ge>5.3</ge><lt>5.3.15</lt></range>
	</package>
	<package>
	<name>php52-sqlite</name>
	<range><lt>5.2.17_11</lt></range>
	</package>
	<package>
	<name>php53-sqlite</name>
	<range><lt>5.3.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE CVE team reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365">
	<p>The SQLite functionality in PHP before 5.3.15 allows remote
	attackers to bypass the open_basedir protection mechanism via
	unspecified vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3365</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365</url>
	</references>
	<dates>
	<discovery>2012-06-14</discovery>
	<entry>2012-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="9b2a5e88-02b8-11e2-92d1-000d601460a4">
	<topic>php5 -- Denial of Service in php_date_parse_tzfile()</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
	<range><ge>5.3</ge><lt>5.3.9</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_11</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE CVE team reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789">
	<p>Memory leak in the timezone functionality in PHP before 5.3.9
	allows remote attackers to cause a denial of service (memory
	consumption) by triggering many strtotime function calls, which are
	not properly handled by the php_date_parse_tzfile cache.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0789</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789</url>
	<url>https://bugs.php.net/bug.php?id=53502</url>
	</references>
	<dates>
	<discovery>2010-12-08</discovery>
	<entry>2012-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="53a0ddef-0208-11e2-8afa-0024e830109b">
	<topic>dns/bind9* -- Several vulnerabilities</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.1.3</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.3.3</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.6.3</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-00788">
	<p>Prevents a crash when queried for a record whose RDATA exceeds
	65535 bytes.</p>
	<p>Prevents a crash when validating caused by using "Bad cache" data
	before it has been initialized.</p>
	<p>ISC_QUEUE handling for recursive clients was updated to address
	a race condition that could cause a memory leak. This rarely
	occurred with UDP clients, but could be a significant problem
	for a server handling a steady rate of TCP queries.</p>
	<p>A condition has been corrected where improper handling of
	zero-length RDATA could cause undesirable behavior, including
	termination of the named process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url/>
	</references>
	<dates>
	<discovery>2012-09-12</discovery>
	<entry>2012-09-18</entry>
	</dates>
	</vuln>

	<vuln vid="d846af5b-00f4-11e2-b6d0-00e0814cab4e">
	<topic>jenkins -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.482</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17">
	<p>This advisory announces security vulnerabilities that were found
	in Jenkins core and several plugins.</p>
	<ol>
	<li>The first vulnerability in Jenkins core allows unprivileged
	users to insert data into Jenkins master, which can lead to
	remote code execution. For this vulnerability to be exploited,
	the attacker must have an HTTP access to a Jenkins master, and
	he must have a read access to Jenkins.</li>
	<li>The second vulnerability in Jenkins core is a cross-site
	scripting vulnerability. This allows an attacker to craft an URL
	that points to Jenkins, and if a legitimate user clicks this link,
	and the attacker will be able to hijack the user session.</li>
	<li>The third vulnerability is a cross-site scripting vulnerability
	in the Violations plugin</li>
	<li>The fourth vulnerability is a cross-site scripting vulnerability
	in The Continuous Integration Game plugin</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17</url>
	</references>
	<dates>
	<discovery>2012-09-17</discovery>
	<entry>2012-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="62f36dfd-ff56-11e1-8821-001b2134ef46">
	<topic>vlc -- arbitrary code execution in Real RTSP and MMS support</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>2.0.1,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa1201.html">
	<p>If successful, a malicious third party could crash the VLC
	media player process. Arbitrary code execution could be possible
	on some systems.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.videolan.org/security/sa1201.html</url>
	<url>http://www.videolan.org/security/sa1202.html</url>
	<cvename>CVE-2012-1775</cvename>
	<cvename>CVE-2012-1776</cvename>
	</references>
	<dates>
	<discovery>2012-03-12</discovery>
	<entry>2012-09-15</entry>
	</dates>
	</vuln>

	<vuln vid="143f6932-fedb-11e1-ad4a-003067b2972c">
	<topic>bacula -- Console ACL Bypass</topic>
	<affects>
	<package>
	<name>bacula</name>
	<range><lt>5.2.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://secunia.com/advisories/50535/">
	<p>A security issue has been reported in Bacula, which can be
	exploited by malicious users to bypass certain security
	restrictions.</p>
	<p>The security issue is caused due to an error within the implementation
	of console ACLs, which can be exploited to gain access to certain
	restricted functionality and e.g. dump resources.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4430</cvename>
	<url>http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905</url>
	<url>https://secunia.com/advisories/50535/</url>
	<url>http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view</url>
	</references>
	<dates>
	<discovery>2012-09-12</discovery>
	<entry>2012-09-15</entry>
	</dates>
	</vuln>

	<vuln vid="178ba4ea-fd40-11e1-b2ae-001fd0af1a4c">
	<topic>mod_pagespeed -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mod_pagespeed</name>
	<range><lt>0.10.22.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google Reports:</p>
	<blockquote cite="https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6">
	<p>mod_pagespeed 0.10.22.6 is a security update that fixes two
	critical issues that affect earlier versions:</p>
	<ul>
	<li>CVE-2012-4001, a problem with validation of own host name.</li>
	<li>CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.</li>
	</ul>
	<p>The effect of the first problem is that it is possible to confuse
	mod_pagespeed about its own host name, and to trick it into
	fetching resources from other machines. This could be an issue if
	the HTTP server has access to machines that are not otherwise
	publicly visible.</p>
	<p>The second problem would permit a hostile third party to execute
	JavaScript in users' browsers in context of the domain running
	mod_pagespeed, which could permit interception of users' cookies or
	data on the site.</p>
	<p>Because of the severity of the two problems, users are strongly
	encouraged to update immediately.</p>
	<p>Behavior Changes in the Update:</p>
	<p>As part of the fix to the first issue, mod_pagespeed will not fetch
	resources from machines other than localhost if they are not
	explicitly mentioned in the configuration. This means that if you
	need resources on the server's domain to be handled by some other
	system, you'll need to explicitly use ModPagespeedMapOriginDomain
	or ModPagespeedDomain to authorize that.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4001</cvename>
	<cvename>CVE-2012-4360</cvename>
	<url>https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6</url>
	</references>
	<dates>
	<discovery>2012-09-12</discovery>
	<entry>2012-09-12</entry>
	</dates>
	</vuln>

	<vuln vid="3bbbe3aa-fbeb-11e1-8bd8-0022156e8794">
	<topic>freeradius -- arbitrary code execution for TLS-based authentication</topic>
	<affects>
	<package>
	<name>freeradius</name>
	<range><ge>2.1.10</ge><lt>2.1.12_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>freeRADIUS security team reports:</p>
	<blockquote cite="http://freeradius.org/security.html">
	<p>Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.</p>
	<p>The issue was found by Timo Warns, and communicated to
	security@freeradius.org. A sample exploit for the issue was
	included in the notification.</p>
	<p>The vulnerability was created in commit a368a6f4f4aaf on
	August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11,
	and 2.1.12. Also anyone running the git "master" branch
	after August 18, 2010 is vulnerable.</p>
	<p>All sites using TLS-based EAP methods and the above
	versions are vulnerable. The only configuration change which
	can avoid the issue is to disable EAP-TLS, EAP-TTLS, and
	PEAP.</p>
	<p>An external attacker can use this vulnerability to
	over-write the stack frame of the RADIUS server, and cause
	it to crash. In addition, more sophisticated attacks may
	gain additional privileges on the system running the RADIUS
	server.</p>
	<p>This attack does not require local network access to the
	RADIUS server. It can be done by an attacker through a WiFi
	Access Point, so long as the Access Point is configured to
	use 802.1X authentication with the RADIUS server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3547</cvename>
	<url>http://freeradius.org/security.html</url>
	<url>http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt</url>
	</references>
	<dates>
	<discovery>2012-09-10</discovery>
	<entry>2012-09-11</entry>
	<modified>2012-09-11</modified>
	</dates>
	</vuln>

	<vuln vid="c1e5f35e-f93d-11e1-b07f-00235a5f2c9a">
	<topic>emacs -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>emacs</name>
	<range><gt>24.*</gt><lt>24.2</lt></range>
	<range><gt>23.*</gt><le>23.4_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chong Yidong reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/08/13/1">
	<p>Paul Ling has found a security flaw in the file-local
	variables code in GNU Emacs.</p>
	<p>When the Emacs user option `enable-local-variables' is
	set to `:safe' (the default value is t), Emacs should
	automatically refuse to evaluate `eval' forms in file-local
	variable sections. Due to the bug, Emacs instead
	automatically evaluates such `eval' forms. Thus, if the user
	changes the value of `enable-local-variables' to `:safe',
	visiting a malicious file can cause automatic execution of
	arbitrary Emacs Lisp code with the permissions of the
	user.</p>
	<p>The bug is present in Emacs 23.2, 23.3, 23.4, and
	24.1.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>54969</bid>
	<cvename>CVE-2012-3479</cvename>
	<url>https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html</url>
	<url>http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155</url>
	</references>
	<dates>
	<discovery>2012-08-13</discovery>
	<entry>2012-09-08</entry>
	<modified>2013-05-13</modified>
	</dates>
	</vuln>

	<vuln vid="30149157-f926-11e1-95cd-001fd0af1a4c">
	<topic>wordpress -- multiple unspecified privilege escalation bugs</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wordpress reports:</p>
	<blockquote cite="http://wordpress.org/news/2012/09/wordpress-3-4-2/">
	<p>Version 3.4.2 also fixes a few security issues and contains some
	security hardening. The vulnerabilities included potential
	privilege escalation and a bug that affects multisite installs with
	untrusted users. These issues were discovered and fixed by the
	WordPress security team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://wordpress.org/news/2012/09/wordpress-3-4-2/</url>
	</references>
	<dates>
	<discovery>2012-09-06</discovery>
	<entry>2012-09-07</entry>
	</dates>
	</vuln>

	<vuln vid="4a8a98ab-f745-11e1-8bd8-0022156e8794">
	<topic>moinmoin -- cross-site scripting via RST parser</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.9.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE CVE team reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1058">
	<p>Cross-site scripting (XSS) vulnerability in the
	reStructuredText (rst) parser in parser/text_rst.py in
	MoinMoin before 1.9.4, when docutils is installed or when
	"format rst" is set, allows remote attackers to inject
	arbitrary web script or HTML via a javascript: URL in the
	refuri attribute.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>46476</bid>
	<cvename>CVE-2011-1058</cvename>
	<url>http://moinmo.in/SecurityFixes</url>
	</references>
	<dates>
	<discovery>2011-02-21</discovery>
	<entry>2012-09-05</entry>
	</dates>
	</vuln>

	<vuln vid="4f99e2ef-f725-11e1-8bd8-0022156e8794">
	<topic>moinmoin -- wrong processing of group membership</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><ge>1.9</ge><lt>1.9.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MoinMoin developers report:</p>
	<blockquote cite="http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16">
	<p>If you have group NAMES containing "All" or "Known" or
	"Trusted", they behaved wrong until now (they erroneously
	included All/Known/Trusted users even if you did not list
	them as members), but will start working correctly with this
	changeset.</p>
	<p>E.g. AllFriendsGroup:</p>
	<ul>
	<li>JoeDoe</li>
	</ul>
	<p>AllFriendsGroup will now (correctly) include only JoeDoe.
	It (erroneously) contained all users (including JoeDoe)
	before.</p>
	<p>E.g. MyTrustedFriendsGroup:</p>
	<ul>
	<li>JoeDoe</li>
	</ul>
	<p>MyTrustedFriendsGroup will now (correctly) include only
	JoeDoe. It (erroneously) contained all trusted users and
	JoeDoe before.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4404</cvename>
	<url>http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16</url>
	</references>
	<dates>
	<discovery>2012-09-03</discovery>
	<entry>2012-09-05</entry>
	<modified>2012-09-11</modified>
	</dates>
	</vuln>

	<vuln vid="918f38cd-f71e-11e1-8bd8-0022156e8794">
	<topic>php5 -- header splitting attack via carriage-return character</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
	<range><ge>5.3</ge><lt>5.3.11</lt></range>
	<range><ge>5.4</ge><lt>5.4.1</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_11</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rui Hirokawa reports:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=60227">
	<p>As of PHP 5.1.2, header() can no longer be used to send
	multiple response headers in a single call to prevent the
	HTTP Response Splitting Attack. header() only checks the
	linefeed (LF, 0x0A) as line-end marker, it doesn't check the
	carriage-return (CR, 0x0D).</p>
	<p>However, some browsers including Google Chrome, IE also
	recognize CR as the line-end.</p>
	<p>The current specification of header() still has the
	vulnerability against the HTTP header splitting attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1398</cvename>
	<url>https://bugs.php.net/bug.php?id=60227</url>
	</references>
	<dates>
	<discovery>2011-11-06</discovery>
	<entry>2012-09-05</entry>
	<modified>2012-09-19</modified>
	</dates>
	</vuln>

	<vuln vid="b50913ce-f4a7-11e1-b135-003067b2972c">
	<topic>bitcoin -- denial of service</topic>
	<affects>
	<package>
	<name>bitcoin</name>
	<range><lt>0.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://bitcointalk.org/?topic=88734">
	<p>A unspecified denial-of-service attack that could cause the
	bitcoin process to become unresponsive was found.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3789</cvename>
	<url>https://bitcointalk.org/?topic=88734</url>
	</references>
	<dates>
	<discovery>2012-07-20</discovery>
	<entry>2012-09-02</entry>
	</dates>
	</vuln>

	<vuln vid="6ad18fe5-f469-11e1-920d-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.11</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.8</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.10/">
	<p>The following security issues have been discovered in
	Bugzilla:</p>
	<h1>LDAP Injection</h1>
	<p>When the user logs in using LDAP, the username is not
	escaped when building the uid=$username filter which is
	used to query the LDAP directory. This could potentially
	lead to LDAP injection.</p>
	<h1>Directory Browsing</h1>
	<p>Extensions are not protected against directory browsing
	and users can access the source code of the templates
	which may contain sensitive data.
	Directory browsing is blocked in Bugzilla 4.3.3 only,
	because it requires a configuration change in the Apache
	httpd.conf file to allow local .htaccess files to use
	Options -Indexes. To not break existing installations,
	this fix has not been backported to stable branches.
	The access to templates is blocked for all supported
	branches except the old 3.6 branch, because this branch
	doesn't have .htaccess in the bzr repository and cannot
	be fixed easily for existing installations without
	potentially conflicting with custom changes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3981</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785470</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785522</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785511</url>
	</references>
	<dates>
	<discovery>2012-08-30</discovery>
	<entry>2012-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="342176a8-f464-11e1-8bd8-0022156e8794">
	<topic>GNU gatekeeper -- denial of service</topic>
	<affects>
	<package>
	<name>gatekeeper</name>
	<range><lt>3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Willamowius reports:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534">
	<p>GNU Gatekeeper before 3.1 does not limit the number
	of connections to the status port, which allows remote
	attackers to cause a denial of service (connection and
	thread consumption) via a large number of connections.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3534</cvename>
	<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534</url>
	<url>http://www.openwall.com/lists/oss-security/2012/08/25/4</url>
	<url>http://www.gnugk.org/gnugk-3.1.html</url>
	</references>
	<dates>
	<discovery>2012-08-15</discovery>
	<entry>2012-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="7c0fecd6-f42f-11e1-b17b-000c2977ec30">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><ge>1.19</ge><lt>1.19.2</lt></range>
	<range><ge>1.18</ge><lt>1.18.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mediawiki reports:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html">
	<p>(Bug 39700) Wikipedia administrator Writ Keeper discovered
	a stored XSS (HTML injection) vulnerability. This was
	possible due to the handling of link text on File: links for
	nonexistent files. MediaWiki 1.16 and later is affected.</p>
	<p>(Bug 39180) User Fomafix reported several DOM-based XSS
	vulnerabilities, made possible by a combination of loose
	filtering of the uselang parameter, and JavaScript gadgets
	on various language Wikipedias.</p>
	<p>(Bug 39180) During internal review, it was discovered that
	CSRF tokens, available via the api, were not protected with
	X-Frame-Options headers. This could lead to a CSRF vulnerability
	if the API response is embedded in an external website using
	using an iframe.</p>
	<p>(Bug 39824) During internal review, it was discovered extensions
	were not always allowed to prevent the account creation action.
	This allowed users blocked by the GlobalBlocking extension to
	create accounts.</p>
	<p>(Bug 39184) During internal review, it was discovered that
	password data was always saved to the local MediaWiki database
	even if authentication was handled by an extension, such as LDAP.
	This could allow a compromised MediaWiki installation to leak
	information about user's LDAP passwords. Additionally, in situations
	when an authentication plugin returned false in its strict
	function, this would allow old passwords to be used for accounts
	that did not exist in the external system, indefinitely.</p>
	<p>(Bug 39823) During internal review, it was discovered that metadata
	about blocks, hidden by a user with suppression rights, was visible
	to administrators.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39700</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=37587</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39180</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39824</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39184</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39823</url>
	<cvename>CVE-2012-4377</cvename>
	<cvename>CVE-2012-4378</cvename>
	<cvename>CVE-2012-4379</cvename>
	<cvename>CVE-2012-4380</cvename>
	<cvename>CVE-2012-4381</cvename>
	<cvename>CVE-2012-4382</cvename>
	</references>
	<dates>
	<discovery>2012-08-27</discovery>
	<entry>2012-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="5415f1b3-f33d-11e1-8bd8-0022156e8794">
	<topic>wireshark -- denial of service in DRDA dissector</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
	</package>
	<package>
	<name>tshark</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat security team reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=849926">
	<p>A denial of service flaw was found in the way Distributed
	Relational Database Architecture (DRDA) dissector of
	Wireshark, a network traffic analyzer, performed processing
	of certain DRDA packet capture files. A remote attacker
	could create a specially-crafted capture file that, when
	opened could lead to wireshark executable to consume
	excessive amount of CPU time and hang with an infinite
	loop.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3548</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=849926</url>
	</references>
	<dates>
	<discovery>2012-08-21</discovery>
	<entry>2012-08-31</entry>
	<modified>2012-09-05</modified>
	</dates>
	</vuln>

	<vuln vid="4c53f007-f2ed-11e1-a215-14dae9ebcf89">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><gt>10.*</gt><lt>10.7.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.15.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Asterisk Manager User Unauthorized Shell Access</p>
	<p>ACL rules ignored when placing outbound calls by certain IAX2
	users</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2186</cvename>
	<cvename>CVE-2012-4737</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-012.html</url>
	<url>http://downloads.digium.com/pub/security/AST-2012-013.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2012-08-30</discovery>
	<entry>2012-08-30</entry>
	</dates>
	</vuln>

	<vuln vid="2b8cad90-f289-11e1-a215-14dae9ebcf89">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>15.0,1</lt></range>
	<range><lt>10.0.7,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.7,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.12</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.7</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.12</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>15.0</lt></range>
	<range><lt>10.0.7</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/
	rv:10.0.7)</p>
	<p>MFSA 2012-58 Use-after-free issues found using Address
	Sanitizer</p>
	<p>MFSA 2012-59 Location object can be shadowed using
	Object.defineProperty</p>
	<p>MFSA 2012-60 Escalation of privilege through about:newtab</p>
	<p>MFSA 2012-61 Memory corruption with bitmap format images with
	negative height</p>
	<p>MFSA 2012-62 WebGL use-after-free and memory corruption</p>
	<p>MFSA 2012-63 SVG buffer overflow and use-after-free issues</p>
	<p>MFSA 2012-64 Graphite 2 memory corruption</p>
	<p>MFSA 2012-65 Out-of-bounds read in format-number in XSLT</p>
	<p>MFSA 2012-66 HTTPMonitor extension allows for remote debugging
	without explicit activation</p>
	<p>MFSA 2012-67 Installer will launch incorrect executable following
	new installation</p>
	<p>MFSA 2012-68 DOMParser loads linked resources in extensions when
	parsing text/html</p>
	<p>MFSA 2012-69 Incorrect site SSL certificate data display</p>
	<p>MFSA 2012-70 Location object security checks bypassed by chrome
	code</p>
	<p>MFSA 2012-71 Insecure use of __android_log_print</p>
	<p>MFSA 2012-72 Web console eval capable of executing
	chrome-privileged code</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1956</cvename>
	<cvename>CVE-2012-1970</cvename>
	<cvename>CVE-2012-1971</cvename>
	<cvename>CVE-2012-1972</cvename>
	<cvename>CVE-2012-1973</cvename>
	<cvename>CVE-2012-1974</cvename>
	<cvename>CVE-2012-1975</cvename>
	<cvename>CVE-2012-1976</cvename>
	<cvename>CVE-2012-3956</cvename>
	<cvename>CVE-2012-3957</cvename>
	<cvename>CVE-2012-3958</cvename>
	<cvename>CVE-2012-3959</cvename>
	<cvename>CVE-2012-3960</cvename>
	<cvename>CVE-2012-3961</cvename>
	<cvename>CVE-2012-3962</cvename>
	<cvename>CVE-2012-3963</cvename>
	<cvename>CVE-2012-3964</cvename>
	<cvename>CVE-2012-3965</cvename>
	<cvename>CVE-2012-3966</cvename>
	<cvename>CVE-2012-3967</cvename>
	<cvename>CVE-2012-3968</cvename>
	<cvename>CVE-2012-3969</cvename>
	<cvename>CVE-2012-3970</cvename>
	<cvename>CVE-2012-3971</cvename>
	<cvename>CVE-2012-3972</cvename>
	<cvename>CVE-2012-3973</cvename>
	<cvename>CVE-2012-3974</cvename>
	<cvename>CVE-2012-3975</cvename>
	<cvename>CVE-2012-3976</cvename>
	<cvename>CVE-2012-3978</cvename>
	<cvename>CVE-2012-3979</cvename>
	<cvename>CVE-2012-3980</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-57.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-58.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-59.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-60.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-61.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-62.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-63.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-64.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-65.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-66.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-67.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-68.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-69.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-70.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-71.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-72.html</url>
	</references>
	<dates>
	<discovery>2012-08-28</discovery>
	<entry>2012-08-30</entry>
	</dates>
	</vuln>

	<vuln vid="6dd5e45c-f084-11e1-8d0f-406186f3d89d">
	<topic>coppermine -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>coppermine</name>
	<range><lt>1.5.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Coppermine Team reports:</p>
	<blockquote cite="http://forum.coppermine-gallery.net/index.php/topic,74682.0.html">
	<p>The release covers several path disclosure vulnerabilities. If
	unpatched, it's possible to generate an error that will reveal the
	full path of the script. A remote user can determine the full path
	to the web root directory and other potentially sensitive
	information. Furthermore, the release covers a recently discovered
	XSS vulnerability that allows (if unpatched) a malevolent visitor to
	include own script routines under certain conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1613</cvename>
	<cvename>CVE-2012-1614</cvename>
	<mlist>http://seclists.org/oss-sec/2012/q2/11</mlist>
	<url>http://forum.coppermine-gallery.net/index.php/topic,74682.0.html</url>
	</references>
	<dates>
	<discovery>2012-03-29</discovery>
	<entry>2012-08-30</entry>
	</dates>
	</vuln>

	<vuln vid="16846d1e-f1de-11e1-8bd8-0022156e8794">
	<topic>Java 1.7 -- security manager bypass</topic>
	<affects>
	<package>
	<name>openjdk</name>
	<range><ge>7.0</ge><lt>7.6.24_1</lt></range>
	</package>
	<package>
	<name>linux-sun-jdk</name>
	<range><ge>7.0</ge><lt>7.7</lt></range>
	</package>
	<package>
	<name>linux-sun-jre</name>
	<range><ge>7.0</ge><lt>7.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/636312">
	<p>Oracle Java Runtime Environment (JRE) 1.7 contains a
	vulnerability that may allow an applet to call
	setSecurityManager in a way that allows setting of arbitrary
	permissions.</p>
	<p>By leveraging the public, privileged getField() function,
	an untrusted Java applet can escalate its privileges by
	calling the setSecurityManager() function to allow full
	privileges, without requiring code signing.</p>
	<p>This vulnerability is being actively exploited in the
	wild, and exploit code is publicly available.</p>
	</blockquote>
	<p>This exploit does not only affect Java applets, but every
	piece of software that relies on the Java Security Manager for
	sandboxing executable code is affected: malicious code can
	totally disable Security Manager.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4681</cvename>
	<certvu>636312</certvu>
	<url>http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html</url>
	<url>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html</url>
	<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html</url>
	</references>
	<dates>
	<discovery>2012-08-27</discovery>
	<entry>2012-08-30</entry>
	<modified>2012-08-31</modified>
	</dates>
	</vuln>

	<vuln vid="18ce9a90-f269-11e1-be53-080027ef73ec">
	<topic>fetchmail -- chosen plaintext attack against SSL CBC initialization vectors</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><ge>6.3.9</ge><lt>6.3.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-01.txt">
	<p>Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL)
	which contains a switch to disable a countermeasure against certain
	attacks against block ciphers that permit guessing the
	initialization vectors, providing that an attacker can make the
	application (fetchmail) encrypt some data for him -- which is not
	easily the case.</p>
	<p>Stream ciphers (such as RC4) are unaffected.</p>
	<p>Credits to Apple Product Security for reporting this.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3389</cvename>
	</references>
	<dates>
	<discovery>2012-01-19</discovery>
	<entry>2012-08-30</entry>
	</dates>
	</vuln>

	<vuln vid="c906e0a4-efa6-11e1-8fbf-001b77d09812">
	<topic>roundcube -- cross-site scripting in HTML email messages</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><ge>0.8.0,1</ge><lt>0.8.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RoundCube branch 0.8.x prior to the version 0.8.1 is prone
	to the cross-scripting attack (XSS) originating from incoming
	HTML e-mails: due to the lack of proper sanitization
	of JavaScript code inside the "href" attribute, sender
	could launch XSS attack when recipient opens the message
	in RoundCube interface.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3508</cvename>
	<url>http://trac.roundcube.net/wiki/Changelog</url>
	<url>http://trac.roundcube.net/ticket/1488613</url>
	</references>
	<dates>
	<discovery>2012-08-14</discovery>
	<entry>2012-08-27</entry>
	</dates>
	</vuln>

	<vuln vid="aa4d3d73-ef17-11e1-b593-00269ef07d24">
	<topic>Calligra, KOffice -- input validation failure</topic>
	<affects>
	<package>
	<name>koffice</name>
	<range><le>1.6.3_18,2</le></range>
	</package>
	<package>
	<name>koffice-kde4</name>
	<range><le>2.3.3_7</le></range>
	</package>
	<package>
	<name>calligra</name>
	<range><lt>2.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20120810-1.txt">
	<p>A flaw has been found which can allow malicious code to take
	advantage of an input validation failure in the Microsoft import
	filter in Calligra and KOffice. Exploitation can allow the attacker
	to gain control of the running process and execute code on its
	behalf.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3455</cvename>
	<cvename>CVE-2012-3456</cvename>
	<url>http://www.kde.org/info/security/advisory-20120810-1.txt</url>
	<url>http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf</url>
	</references>
	<dates>
	<discovery>2012-08-10</discovery>
	<entry>2012-08-26</entry>
	</dates>
	</vuln>

	<vuln vid="ce680f0a-eea6-11e1-8bd8-0022156e8794">
	<topic>squidclamav -- cross-site scripting in default virus warning pages</topic>
	<affects>
	<package>
	<name>squidclamav</name>
	<range><lt>5.8</lt></range>
	<range><ge>6.0</ge><lt>6.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SquidClamav developers report:</p>
	<blockquote cite="http://squidclamav.darold.net/news.html">
	<p>This release fix several security issues by escaping CGI
	parameters.</p>
	</blockquote>
	<p>Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not
	properly sanitizing input variables, so they could be used to
	inject arbitrary strings to the generated page, leading
	to the cross-site scripting attacks.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4667</cvename>
	<url>http://squidclamav.darold.net/news.html</url>
	</references>
	<dates>
	<discovery>2012-07-24</discovery>
	<entry>2012-08-25</entry>
	</dates>
	</vuln>

	<vuln vid="8defa0f9-ee8a-11e1-8bd8-0022156e8794">
	<topic>squidclamav -- Denial of Service</topic>
	<affects>
	<package>
	<name>squidclamav</name>
	<range><lt>5.7_1</lt></range>
	<range><ge>6.0</ge><lt>6.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SquidClamav developers report:</p>
	<blockquote cite="http://squidclamav.darold.net/news.html">
	<p>Add a workaround for a squidGuard bug that unescape
	the URL and send it back unescaped. This result in garbage
	staying into pipe of the system command call and could crash
	squidclamav on next read or return false information.
	This is specially true with URL containing the %0D or %0A
	character.</p>
	</blockquote>
	<p>This vulnerability can be triggered only in configurations
	where external chained URL checker is configured via
	"squidguard" directive.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3501</cvename>
	<url>http://squidclamav.darold.net/news.html</url>
	</references>
	<dates>
	<discovery>2012-07-24</discovery>
	<entry>2012-08-25</entry>
	<modified>2012-09-04</modified>
	</dates>
	</vuln>

	<vuln vid="a7975581-ee26-11e1-8bd8-0022156e8794">
	<topic>inn -- plaintext command injection into encrypted channel</topic>
	<affects>
	<package>
	<name>inn</name>
	<range><lt>2.5.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>INN developers report:</p>
	<blockquote cite="https://www.isc.org/software/inn/2.5.3article">
	<p>Fixed a possible plaintext command injection during the
	negotiation of a TLS layer. The vulnerability detailed
	in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL
	commands. nnrpd now resets its read buffer upon
	a successful negotiation of a TLS layer. It prevents
	malicious commands, sent unencrypted, from being executed
	in the new encrypted state of the session.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3523</cvename>
	<cvename>CVE-2011-0411</cvename>
	<url>https://www.isc.org/software/inn/2.5.3article</url>
	</references>
	<dates>
	<discovery>2012-08-14</discovery>
	<entry>2012-08-25</entry>
	</dates>
	</vuln>

	<vuln vid="4d1d2f6d-ec94-11e1-8bd8-0022156e8794">
	<topic>jabberd -- domain spoofing in server dialback protocol</topic>
	<affects>
	<package>
	<name>jabberd</name>
	<range><lt>2.2.16_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>XMPP Standards Foundation reports:</p>
	<blockquote cite="http://xmpp.org/resources/security-notices/server-dialback/">
	<p>Some implementations of the XMPP Server Dialback protocol
	(RFC 3920/XEP-0220) have not been checking dialback
	responses to ensure that validated results are correlated
	with requests.</p>
	<p>An attacking server could spoof one or more domains in
	communicating with a vulnerable server implementation,
	thereby avoiding the protections built into the Server
	Dialback protocol.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3525</cvename>
	<url>http://xmpp.org/resources/security-notices/server-dialback/</url>
	</references>
	<dates>
	<discovery>2012-08-21</discovery>
	<entry>2012-08-23</entry>
	</dates>
	</vuln>

	<vuln vid="a4598875-ec91-11e1-8bd8-0022156e8794">
	<topic>rssh -- configuration restrictions bypass</topic>
	<affects>
	<package>
	<name>rssh</name>
	<range><lt>2.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Derek Martin (rssh maintainer) reports:</p>
	<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
	<p>John Barber reported a problem where, if the system
	administrator misconfigures rssh by providing too few access
	bits in the configuration file, the user will be given
	default permissions (scp) to the entire system, potentially
	circumventing any configured chroot. Fixing this required a
	behavior change: in the past, using rssh without a config
	file would give all users default access to use scp on an
	unchrooted system. In order to correct the reported bug,
	this feature has been eliminated, and you must now have a
	valid configuration file. If no config file exists, all
	users will be locked out.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.pizzashack.org/rssh/security.shtml</url>
	</references>
	<dates>
	<discovery>2010-08-01</discovery>
	<entry>2012-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="65b25acc-e63b-11e1-b81c-001b77d09812">
	<topic>rssh -- arbitrary command execution</topic>
	<affects>
	<package>
	<name>rssh</name>
	<range><lt>2.3.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Derek Martin (rssh maintainer) reports:</p>
	<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29235647">
	<p>Henrik Erkkonen has discovered that, through clever
	manipulation of environment variables on the ssh command
	line, it is possible to circumvent rssh. As far as I can
	tell, there is no way to effect a root compromise, except of
	course if the root account is the one you're attempting to
	protect with rssh...</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>53430</bid>
	<cvename>CVE-2012-3478</cvename>
	<url>http://sourceforge.net/mailarchive/message.php?msg_id=29235647</url>
	</references>
	<dates>
	<discovery>2012-05-08</discovery>
	<entry>2012-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="c651c898-e90d-11e1-b230-0024e830109b">
	<topic>libotr -- buffer overflows</topic>
	<affects>
	<package>
	<name>libotr</name>
	<range><lt>3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTR developers report:</p>
	<blockquote cite="http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html">
	<p>The otrl_base64_otr_decode() function and similar functions within OTR
	suffer from buffer overflows in the case of malformed input;
	specifically if a message of the format of "?OTR:===." is received
	then a zero-byte allocation is performed without a similar correlation
	between the subsequent base64 decoding write, as such it becomes
	possible to write between zero and three bytes incorrectly to the
	heap, albeit only with a value of '='.</p>
	<p>Because this code path is highly utilized, specifically in the
	reception of instant messages over pidgin or similar, this
	vulnerability is considered severe even though in many platforms and
	circumstances the bug would yield an unexploitable state and result
	simply in denial of service.</p>
	<p>The developers of OTR promptly fixed the errors and users of OTR are
	advised to upgrade the software at the next release cycle.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3461</cvename>
	<url>http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html</url>
	</references>
	<dates>
	<discovery>2012-07-27</discovery>
	<entry>2012-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="0f62be39-e8e0-11e1-bea0-002354ed89bc">
	<topic>OpenTTD -- Denial of Service</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><le>1.2.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://security.openttd.org/en/CVE-2012-3436">
	<p>Denial of service (server) using ships on half tiles and
	landscaping.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3436</cvename>
	<url>http://security.openttd.org/en/CVE-2012-3436</url>
	</references>
	<dates>
	<discovery>2012-07-25</discovery>
	<entry>2012-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="4cdfe875-e8d6-11e1-bea0-002354ed89bc">
	<topic>Wireshark -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>tshark</name>
	<range><lt>1.8.2</lt></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><lt>1.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark reports:</p>
	<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.2.html">
	<p>It may be possible to make Wireshark crash by injecting a
	malformed packet onto the wire or by convincing someone to read a
	malformed packet trace file.</p>
	<p>It may be possible to make Wireshark consume excessive CPU
	resources by injecting a malformed packet onto the wire or by
	convincing someone to read a malformed packet trace file.</p>
	<p>The PPP dissector could crash.</p>
	<p>The NFS dissector could use excessive amounts of CPU.</p>
	<p>The DCP ETSI dissector could trigger a zero division.</p>
	<p>The MongoDB dissector could go into a large loop.</p>
	<p>The XTP dissector could go into an infinite loop.</p>
	<p>The ERF dissector could overflow a buffer.</p>
	<p>The AFP dissector could go into a large loop.</p>
	<p>The RTPS2 dissector could overflow a buffer.</p>
	<p>The GSM RLC MAC dissector could overflow a buffer.</p>
	<p>The CIP dissector could exhaust system memory.</p>
	<p>The STUN dissector could crash.</p>
	<p>The EtherCAT Mailbox dissector could abort.</p>
	<p>The CTDB dissector could go into a large loop.</p>
	<p>The pcap-ng file parser could trigger a zero division.</p>
	<p>The Ixia IxVeriWave file parser could overflow a buffer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4048</cvename>
	<cvename>CVE-2012-4049</cvename>
	<cvename>CVE-2012-4285</cvename>
	<cvename>CVE-2012-4286</cvename>
	<cvename>CVE-2012-4287</cvename>
	<cvename>CVE-2012-4288</cvename>
	<cvename>CVE-2012-4289</cvename>
	<cvename>CVE-2012-4290</cvename>
	<cvename>CVE-2012-4291</cvename>
	<cvename>CVE-2012-4292</cvename>
	<cvename>CVE-2012-4293</cvename>
	<cvename>CVE-2012-4294</cvename>
	<cvename>CVE-2012-4295</cvename>
	<cvename>CVE-2012-4296</cvename>
	<cvename>CVE-2012-4297</cvename>
	<cvename>CVE-2012-4298</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-11.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-12.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-13.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-14.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-15.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-16.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-17.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-18.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-19.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-20.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-21.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-22.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-23.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-24.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-25.html</url>
	</references>
	<dates>
	<discovery>2012-07-22</discovery>
	<entry>2012-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="07234e78-e899-11e1-b38d-0023ae8e59f0">
	<topic>databases/postgresql*-server -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql-server</name>
	<range><gt>8.3.*</gt><lt>8.3.20</lt></range>
	<range><gt>8.4.*</gt><lt>8.4.13</lt></range>
	<range><gt>9.0.*</gt><lt>9.0.9</lt></range>
	<range><gt>9.1.*</gt><lt>9.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL Global Development Group reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1407/">
	<p>The PostgreSQL Global Development Group today released
	security updates for all active branches of the PostgreSQL
	database system, including versions 9.1.5, 9.0.9, 8.4.13 and
	8.3.20. This update patches security holes associated with
	libxml2 and libxslt, similar to those affecting other open
	source projects. All users are urged to update their
	installations at the first available opportunity</p>
	<p>Users who are relying on the built-in XML functionality to
	validate external DTDs will need to implement a workaround, as
	this security patch disables that functionality. Users who are
	using xslt_process() to fetch documents or stylesheets from
	external URLs will no longer be able to do so. The PostgreSQL
	project regrets the need to disable both of these features in
	order to maintain our security standards. These security issues
	with XML are substantially similar to issues patched recently
	by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5
	(CVE-2012-0057) projects.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3488</cvename>
	<cvename>CVE-2012-3489</cvename>
	<url>http://www.postgresql.org/about/news/1407/</url>
	</references>
	<dates>
	<discovery>2012-08-17</discovery>
	<entry>2012-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="db1d3340-e83b-11e1-999b-e0cb4e266481">
	<topic>phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.5.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php">
	<p>Using a crafted table name, it was possible to produce a
	XSS : 1) On the Database Structure page, creating a new
	table with a crafted name 2) On the Database Structure page,
	using the Empty and Drop links of the crafted table name 3)
	On the Table Operations page of a crafted table, using the
	'Empty the table (TRUNCATE)' and 'Delete the table (DROP)'
	links 4) On the Triggers page of a database containing
	tables with a crafted name, when opening the 'Add Trigger'
	popup 5) When creating a trigger for a table with a crafted
	name, with an invalid definition. Having crafted data in a
	database table, it was possible to produce a XSS : 6) When
	visualizing GIS data, having a crafted label name.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4345</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php</url>
	</references>
	<dates>
	<discovery>2012-08-12</discovery>
	<entry>2012-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="48bcb4b2-e708-11e1-a59d-000d601460a4">
	<topic>typo3 -- Multiple vulernabilities in TYPO3 Core</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.19</lt></range>
	<range><ge>4.6.0</ge><lt>4.6.12</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo Security Team reports:</p>
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/">
	<p>It has been discovered that TYPO3 Core is vulnerable to Cross-Site
	Scripting, Information Disclosure, Insecure Unserialize leading to
	Arbitrary Code Execution.</p>
	<p>TYPO3 Backend Help System - Due to a missing signature (HMAC) for a
	parameter in the view_help.php file, an attacker could unserialize
	arbitrary objects within TYPO3. We are aware of a working exploit,
	which can lead to arbitrary code execution. A valid backend user
	login or multiple successful cross site request forgery attacks are
	required to exploit this vulnerability.</p>
	<p>TYPO3 Backend - Failing to properly HTML-encode user input in
	several places, the TYPO3 backend is susceptible to Cross-Site
	Scripting. A valid backend user is required to exploit these
	vulnerabilities.</p>
	<p>TYPO3 Backend - Accessing the configuration module discloses the
	Encryption Key. A valid backend user with access to the
	configuration module is required to exploit this vulnerability.</p>
	<p>TYPO3 HTML Sanitizing API - By not removing several HTML5
	JavaScript events, the API method t3lib_div::RemoveXSS() fails to
	filter specially crafted HTML injections, thus is susceptible to
	Cross-Site Scripting. Failing to properly encode for JavaScript the
	API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site
	Scripting.</p>
	<p>TYPO3 Install Tool - Failing to properly sanitize user input, the
	Install Tool is susceptible to Cross-Site Scripting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/</url>
	</references>
	<dates>
	<discovery>2012-08-15</discovery>
	<entry>2012-08-15</entry>
	</dates>
	</vuln>

	<vuln vid="83f9e943-e664-11e1-a66d-080027ef73ec">
	<topic>fetchmail -- two vulnerabilities in NTLM authentication</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><ge>5.0.8</ge><lt>6.3.21_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-02.txt">
	<p>With NTLM support enabled, fetchmail might mistake a server-side
	error message during NTLM protocol exchange for protocol data,
	leading to a SIGSEGV.</p>
	<p>Also, with a carefully crafted NTLM challenge, a malicious server
	might cause fetchmail to read from a bad memory location, betraying
	confidential data. It is deemed hard, although not impossible, to
	steal other accounts' data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3482</cvename>
	</references>
	<dates>
	<discovery>2012-08-12</discovery>
	<entry>2012-08-14</entry>
	<modified>2012-08-27</modified>
	</dates>
	</vuln>

	<vuln vid="55b498e2-e56c-11e1-bbd5-001c25e46b1d">
	<topic>Several vulnerabilities found in IcedTea-Web</topic>
	<affects>
	<package>
	<name>icedtea-web</name>
	<range><lt>1.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The IcedTea project team reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=840592">
	<p>CVE-2012-3422: Use of uninitialized instance pointers</p>
	<p>An uninitialized pointer use flaw was found in IcedTea-Web web
	browser plugin. A malicious web page could use this flaw make
	IcedTea-Web browser plugin pass invalid pointer to a web browser.
	Depending on the browser used, it may cause the browser to crash
	or possibly execute arbitrary code.</p>
	<p>The get_cookie_info() and get_proxy_info() call
	getFirstInTableInstance() with the instance_to_id_map hash as
	a parameter. If instance_to_id_map is empty (which can happen
	when plugin was recently removed), getFirstInTableInstance()
	returns an uninitialized pointer.</p>
	</blockquote>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=841345">
	<p>CVE-2012-3423: Incorrect handling of non 0-terminated strings</p>
	<p>It was discovered that the IcedTea-Web web browser plugin
	incorrectly assumed that all strings provided by browser are NUL
	terminated, which is not guaranteed by the NPAPI (Netscape Plugin
	Application Programming Interface). When used in a browser that
	does not NUL terminate NPVariant NPStrings, this could lead to
	buffer over-read or over-write, resulting in possible information
	leak, crash, or code execution.</p>
	<p>Mozilla browsers currently NUL terminate strings, however recent
	Chrome versions are known not to provide NUL terminated data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3422</cvename>
	<cvename>CVE-2012-3423</cvename>
	<mlist>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html</mlist>
	</references>
	<dates>
	<discovery>2012-07-31</discovery>
	<entry>2012-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="a14dee30-e3d7-11e1-a084-50e5492bd3dc">
	<topic>libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname</topic>
	<affects>
	<package>
	<name>py-libcloud</name>
	<range><lt>0.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The libcloud development team reports:</p>
	<blockquote cite="http://libcloud.apache.org/security.html">
	<p>When establishing a secure (SSL / TLS) connection to a target server an invalid regular
	expression has been used for performing the hostname verification. Subset instead of the
	full target server hostname has been marked an an acceptable match for the given hostname.
	For example, certificate with a hostname field of "aexample.com" was considered a valid
	certificate for domain "example.com".</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3446</cvename>
	<url>http://seclists.org/fulldisclosure/2012/Aug/55</url>
	</references>
	<dates>
	<discovery>2012-08-01</discovery>
	<entry>2012-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="aca0d7e0-e38a-11e1-999b-e0cb4e266481">
	<topic>phpMyAdmin -- Path disclosure due to missing library</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.5.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php">
	<p>The show_config_errors.php script does not include a
	library, so an error message shows the full path of this
	file, leading to possible further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-4219</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php</url>
	</references>
	<dates>
	<discovery>2012-08-03</discovery>
	<entry>2012-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="31db9a18-e289-11e1-a57d-080027a27dbf">
	<topic>rubygem-rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.2.8</lt></range>
	</package>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.8</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rails core team reports:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/">
	<p>This version contains three important security fixes, please upgrade immediately.</p>
	<p>One of security fixes impacts all users and is related to HTML escaping code. The
	other two fixes impacts people using select_tag's prompt option and strip_tags
	helper from ActionPack.</p>
	<p>CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.</p>
	<p>CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.</p>
	<p>CVE-2012-3465 XSS Vulnerability in strip_tags.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3463</cvename>
	<cvename>CVE-2012-3464</cvename>
	<cvename>CVE-2012-3465</cvename>
	<url>https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J</url>
	<url>https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J</url>
	<url>http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/</url>
	</references>
	<dates>
	<discovery>2012-08-08</discovery>
	<entry>2012-08-10</entry>
	</dates>
	</vuln>

	<vuln vid="8675efd5-e22c-11e1-a808-002354ed89bc">
	<topic>sudosh -- buffer overflow</topic>
	<affects>
	<package>
	<name>sudosh2</name>
	<range><le>1.0.2</le></range>
	</package>
	<package>
	<name>sudosh3</name>
	<range><le>3.2.0_2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISS reports:</p>
	<blockquote cite="http://xforce.iss.net/xforce/xfdb/55903">
	<p>sudosh2 and sudosh3 are vulnerable to a stack-based buffer
	overflow, caused by improper bounds checking by the replay()
	function. By persuading a victim to replay a specially-crafted
	recorded sudo session, a local attacker could overflow a buffer
	and execute arbitrary code on the system with elevated privileges
	or cause the application to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://xforce.iss.net/xforce/xfdb/55903</url>
	<url>http://secunia.com/advisories/38349</url>
	<url>http://secunia.com/advisories/38292</url>
	</references>
	<dates>
	<discovery>2010-01-17</discovery>
	<entry>2012-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="0f020b7b-e033-11e1-90a2-000c299b62e1">
	<topic>FreeBSD -- named(8) DNSSEC validation Denial of Service</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_10</lt></range>
	<range><ge>8.1</ge><lt>8.1_13</lt></range>
	<range><ge>8.2</ge><lt>8.2_10</lt></range>
	<range><ge>8.3</ge><lt>8.3_4</lt></range>
	<range><ge>9.0</ge><lt>9.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:05.bind.asc">
	<p>BIND 9 stores a cache of query names that are known to be failing
	due to misconfigured name servers or a broken chain of trust.
	Under high query loads, when DNSSEC validation is active, it is
	possible for a condition to arise in which data from this cache of
	failing queries could be used before it was fully initialized,
	triggering an assertion failure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:05.bind</freebsdsa>
	<cvename>CVE-2012-3817</cvename>
	</references>
	<dates>
	<discovery>2012-07-24</discovery>
	<entry>2012-08-07</entry>
	</dates>
	</vuln>

	<vuln vid="36235c38-e0a8-11e1-9f4d-002354ed89bc">
	<topic>automake -- Insecure 'distcheck' recipe granted world-writable distdir</topic>
	<affects>
	<package>
	<name>automake</name>
	<range><ge>1.5.0</ge><lt>1.12.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU reports:</p>
	<blockquote cite="https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html">
	<p>The recipe of the 'distcheck' target granted temporary
	world-write permissions on the extracted distdir. This introduced
	a locally exploitable race condition for those who run "make
	distcheck" with a non-restrictive umask (e.g., 022) in a directory
	that was accessible by others. A successful exploit would result
	in arbitrary code execution with the privileges of the user
	running "make distcheck".</p>
	<p>It is important to stress that this vulnerability impacts not only
	the Automake package itself, but all packages with
	Automake-generated makefiles. For an effective fix it is necessary
	to regenerate the Makefile.in files with a fixed Automake
	version.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3386</cvename>
	<url>https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html</url>
	</references>
	<dates>
	<discovery>2012-07-09</discovery>
	<entry>2012-08-06</entry>
	<modified>2012-08-25</modified>
	</dates>
	</vuln>

	<vuln vid="dbf338d0-dce5-11e1-b655-14dae9ebcf89">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>14.0.1,1</lt></range>
	<range><lt>10.0.6,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.6,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.11</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.6</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.11</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>14.0</lt></range>
	<range><lt>10.0.6</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/
	rv:10.0.6)</p>
	<p>MFSA 2012-43 Incorrect URL displayed in addressbar through drag and
	drop</p>
	<p>MFSA 2012-44 Gecko memory corruption</p>
	<p>MFSA 2012-45 Spoofing issue with location</p>
	<p>MFSA 2012-46 XSS through data: URLs</p>
	<p>MFSA 2012-47 Improper filtering of javascript in HTML feed-view</p>
	<p>MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden</p>
	<p>MFSA 2012-49 Same-compartment Security Wrappers can be bypassed</p>
	<p>MFSA 2012-50 Out of bounds read in QCMS</p>
	<p>MFSA 2012-51 X-Frame-Options header ignored when duplicated</p>
	<p>MFSA 2012-52 JSDependentString::undepend string conversion results
	in memory corruption</p>
	<p>MFSA 2012-53 Content Security Policy 1.0 implementation errors
	cause data leakage</p>
	<p>MFSA 2012-54 Clickjacking of certificate warning page</p>
	<p>MFSA 2012-55 feed: URLs with an innerURI inherit security context
	of page</p>
	<p>MFSA 2012-56 Code execution through javascript: URLs</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1949</cvename>
	<cvename>CVE-2012-1950</cvename>
	<cvename>CVE-2012-1951</cvename>
	<cvename>CVE-2012-1952</cvename>
	<cvename>CVE-2012-1953</cvename>
	<cvename>CVE-2012-1954</cvename>
	<cvename>CVE-2012-1955</cvename>
	<cvename>CVE-2012-1957</cvename>
	<cvename>CVE-2012-1958</cvename>
	<cvename>CVE-2012-1959</cvename>
	<cvename>CVE-2012-1960</cvename>
	<cvename>CVE-2012-1961</cvename>
	<cvename>CVE-2012-1962</cvename>
	<cvename>CVE-2012-1963</cvename>
	<cvename>CVE-2012-1964</cvename>
	<cvename>CVE-2012-1965</cvename>
	<cvename>CVE-2012-1966</cvename>
	<cvename>CVE-2012-1967</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-42.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-43.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-44.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-45.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-46.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-47.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-48.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-49.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-50.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-51.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-52.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-53.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-54.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-55.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-56.html</url>
	</references>
	<dates>
	<discovery>2012-07-17</discovery>
	<entry>2012-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="de2bc01f-dc44-11e1-9f4d-002354ed89bc">
	<topic>Apache -- Insecure LD_LIBRARY_PATH handling</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><le>2.2.22_5</le></range>
	</package>
	<package>
	<name>apache-event</name>
	<range><le>2.2.22_5</le></range>
	</package>
	<package>
	<name>apache-itk</name>
	<range><le>2.2.22_5</le></range>
	</package>
	<package>
	<name>apache-peruser</name>
	<range><le>2.2.22_5</le></range>
	</package>
	<package>
	<name>apache-worker</name>
	<range><le>2.2.22_5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	<p>Insecure handling of LD_LIBRARY_PATH was found that could lead to
	the current working directory to be searched for DSOs. This could
	allow a local user to execute code as root if an administrator runs
	apachectl from an untrusted directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0883</cvename>
	<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
	<url>http://www.apache.org/dist/httpd/CHANGES_2.4.2</url>
	</references>
	<dates>
	<discovery>2012-03-02</discovery>
	<entry>2012-08-01</entry>
	</dates>
	</vuln>

	<vuln vid="f01292a0-db3c-11e1-a84b-00e0814cab4e">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py26-django</name>
	<range><ge>1.4</ge><lt>1.4.1</lt></range>
	<range><ge>1.3</ge><lt>1.3.2</lt></range>
	</package>
	<package>
	<name>py27-django</name>
	<range><ge>1.4</ge><lt>1.4.1</lt></range>
	<range><ge>1.3</ge><lt>1.3.2</lt></range>
	</package>
	<package>
	<name>py26-django-devel</name>
	<range><lt>20120731,1</lt></range>
	</package>
	<package>
	<name>py27-django-devel</name>
	<range><lt>20120731,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/">
	<p>Today the Django team is issuing multiple releases --
	Django 1.3.2 and Django 1.4.1 -- to remedy security issues
	reported to us:</p>
	<ul>
	<li>Cross-site scripting in authentication views</li>
	<li>Denial-of-service in image validation</li>
	<li>Denial-of-service via get_image_dimensions()</li>
	</ul>
	<p>All users are encouraged to upgrade Django immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3442</cvename>
	<cvename>CVE-2012-3443</cvename>
	<cvename>CVE-2012-3444</cvename>
	<url>https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/</url>
	</references>
	<dates>
	<discovery>2012-07-30</discovery>
	<entry>2012-07-31</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="58253655-d82c-11e1-907c-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.7</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.9/">
	<p>The following security issues have been discovered in
	Bugzilla:</p>
	<h1>Information Leak</h1>
	<p>Versions: 4.1.1 to 4.2.1, 4.3.1</p>
	<p>In HTML bugmails, all bug IDs and attachment IDs are
	linkified, and hovering these links displays a tooltip
	with the bug summary or the attachment description if
	the user is allowed to see the bug or attachment.
	But when validating user permissions when generating the
	email, the permissions of the user who edited the bug were
	taken into account instead of the permissions of the
	addressee. This means that confidential information could
	be disclosed to the addressee if the other user has more
	privileges than the addressee.
	Plain text bugmails are not affected as bug and attachment
	IDs are not linkified.</p>
	<h1>Information Leak</h1>
	<p>Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to
	4.2.1, 4.3.1</p>
	<p>The description of a private attachment could be visible
	to a user who hasn't permissions to access this attachment
	if the attachment ID is mentioned in a public comment in
	a bug that the user can see.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1968</cvename>
	<cvename>CVE-2012-1969</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777398</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777586</url>
	</references>
	<dates>
	<discovery>2012-07-26</discovery>
	<entry>2012-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="17f369dc-d7e7-11e1-90a2-000c299b62e1">
	<topic>nsd -- Denial of Service</topic>
	<affects>
	<package>
	<name>nsd</name>
	<range><lt>3.2.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tom Hendrikx reports:</p>
	<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt">
	<p>It is possible to crash (SIGSEGV) a NSD child server process by
	sending it a DNS packet from any host on the internet and the per
	zone stats build option is enabled. A crashed child process will
	automatically be restarted by the parent process, but an attacker
	may keep the NSD server occupied restarting child processes by
	sending it a stream of such packets effectively preventing the
	NSD server to serve.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2979</cvename>
	<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt</url>
	</references>
	<dates>
	<discovery>2012-07-27</discovery>
	<entry>2012-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="ae2fa87c-4bca-4138-8be1-67ce2a19b3a8">
	<topic>rubygem-actionpack -- Denial of Service</topic>
	<affects>
	<package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM">
	<p>There is a DoS vulnerability in Action Pack digest authentication
	handling in authenticate_or_request_with_http_digest.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3424</cvename>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM</url>
	</references>
	<dates>
	<discovery>2012-07-26</discovery>
	<entry>2012-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="cdc4ff0e-d736-11e1-8221-e0cb4e266481">
	<topic>p5-RT-Authen-ExternalAuth -- privilege escalation</topic>
	<affects>
	<package>
	<name>p5-RT-Authen-ExternalAuth</name>
	<range><lt>0.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The RT development team reports:</p>
	<blockquote cite="http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html">
	<p>RT::Authen::ExternalAuth 0.10 and below (for all versions
	of RT) are vulnerable to an escalation of privilege attack
	where the URL of a RSS feed of the user can be used to
	acquire a fully logged-in session as that user.
	CVE-2012-2770 has been assigned to this vulnerability.</p>
	<p>Users of RT 3.8.2 and above should upgrade to
	RT::Authen::ExternalAuth 0.11, which resolves this
	vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html</url>
	<cvename>CVE-2012-2770</cvename>
	</references>
	<dates>
	<discovery>2012-07-25</discovery>
	<entry>2012-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="c7fa3618-d5ff-11e1-90a2-000c299b62e1">
	<topic>isc-dhcp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_5,2</lt></range>
	</package>
	<package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/announcement/bind-and-dhcp-security-updates-released">
	<p>An unexpected client identifier parameter can cause the ISC DHCP
	daemon to segmentation fault when running in DHCPv6 mode,
	resulting in a denial of service to further client requests. In
	order to exploit this condition, an attacker must be able to send
	requests to the DHCP server.</p>
	<p>An error in the handling of malformed client identifiers can cause
	a DHCP server running affected versions (see "Impact") to enter a
	state where further client requests are not processed and the
	server process loops endlessly, consuming all available CPU
	cycles.
	Under normal circumstances this condition should not be
	triggered, but a non-conforming or malicious client could
	deliberately trigger it in a vulnerable server. In order to
	exploit this condition an attacker must be able to send requests
	to the DHCP server.</p>
	<p>Two memory leaks have been found and fixed in ISC DHCP. Both are
	reproducible when running in DHCPv6 mode (with the -6 command-line
	argument.) The first leak is confirmed to only affect servers
	operating in DHCPv6 mode, but based on initial code analysis the
	second may theoretically affect DHCPv4 servers (though this has
	not been demonstrated.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3570</cvename>
	<cvename>CVE-2012-3571</cvename>
	<cvename>CVE-2012-3954</cvename>
	<url>https://kb.isc.org/article/AA-00714</url>
	<url>https://kb.isc.org/article/AA-00712</url>
	<url>https://kb.isc.org/article/AA-00737</url>
	</references>
	<dates>
	<discovery>2012-07-24</discovery>
	<entry>2012-07-25</entry>
	</dates>
	</vuln>

	<vuln vid="0bc67930-d5c3-11e1-bef6-0024e81297ae">
	<topic>dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.1.2</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.3.2</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.6.2</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://kb.isc.org/article/AA-00729">
	<p>High numbers of queries with DNSSEC validation enabled can
	cause an assertion failure in named, caused by using a 'bad cache'
	data structure before it has been initialized.</p>
	<p>BIND 9 stores a cache of query names that are known to be failing due
	to misconfigured name servers or a broken chain of trust. Under high query
	loads when DNSSEC validation is active, it is possible for a condition
	to arise in which data from this cache of failing queries could be used
	before it was fully initialized, triggering an assertion failure.</p>
	<p>This bug cannot be encountered unless your server is doing DNSSEC
	validation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3817</cvename>
	<url>https://kb.isc.org/article/AA-00729</url>
	</references>
	<dates>
	<discovery>2012-07-24</discovery>
	<entry>2012-07-24</entry>
	</dates>
	</vuln>

	<vuln vid="748aa89f-d529-11e1-82ab-001fd0af1a4c">
	<topic>rubygem-activerecord -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-activemodel</name>
	<range><lt>3.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>rubygem-activerecord -- multiple vulernabilities</p>
	<blockquote>
	<p>Due to the way Active Record interprets parameters in
	combination with the way that Rack parses query parameters, it
	is possible for an attacker to issue unexpected database
	queries with "IS NULL" where clauses. This issue does not
	let an attacker insert arbitrary values into an SQL query,
	however they can cause the query to check for NULL where most
	users wouldn't expect it.</p>
	<p>Due to the way Active Record handles nested query parameters,
	an attacker can use a specially crafted request to inject some
	forms of SQL into your application's SQL queries.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2660</cvename>
	<cvename>CVE-2012-2661</cvename>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8</url>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k</url>
	</references>
	<dates>
	<discovery>2012-05-31</discovery>
	<entry>2012-07-23</entry>
	<modified>2012-07-23</modified>
	</dates>
	</vuln>

	<vuln vid="bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89">
	<topic>php -- potential overflow in _php_stream_scandir</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><gt>5.4</gt><lt>5.4.5</lt></range>
	<range><ge>5.3</ge><lt>5.3.15</lt></range>
	<range><ge>5.2</ge><lt>5.2.17_10</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.15</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Development Team reports:</p>
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-07-19-1">
	<p>The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in
	_php_stream_scandir</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2688</cvename>
	<url>http://www.php.net/archive/2012.php#id2012-07-19-1</url>
	</references>
	<dates>
	<discovery>2012-07-19</discovery>
	<entry>2012-07-23</entry>
	<modified>2013-01-15</modified>
	</dates>
	</vuln>

	<vuln vid="ce82bfeb-d276-11e1-92c6-14dae938ec40">
	<topic>dns/nsd -- DoS vulnerability from non-standard DNS packet</topic>
	<affects>
	<package>
	<name>nsd</name>
	<range><lt>3.2.11_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marek Vavrusa and Lubos Slovak report:</p>
	<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt">
	<p>It is possible to crash (SIGSEGV) a NSD child server process
	by sending it a non-standard DNS packet from any host on the
	internet. A crashed child process will automatically be restarted
	by the parent process, but an attacker may keep the NSD server
	occupied restarting child processes by sending it a stream of
	such packets effectively preventing the NSD server to serve.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2978</cvename>
	<freebsdpr>ports/170024</freebsdpr>
	<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt</url>
	</references>
	<dates>
	<discovery>2012-07-19</discovery>
	<entry>2012-07-20</entry>
	<modified>2012-07-21</modified>
	</dates>
	</vuln>

	<vuln vid="a460035e-d111-11e1-aff7-001fd056c417">
	<topic>libjpeg-turbo -- heap-based buffer overflow</topic>
	<affects>
	<package>
	<name>libjpeg-turbo</name>
	<range><lt>1.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt">
	<p>The Changelog for version 1.2.1 says: Fixed a regression caused by
	1.2.0[6] in which decompressing corrupt JPEG images (specifically,
	images in which the component count was erroneously set to a large
	value) would cause libjpeg-turbo to segfault.</p>
	</blockquote>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=826849">
	<p>A Heap-based buffer overflow was found in the way libjpeg-turbo
	decompressed certain corrupt JPEG images in which the component count
	was erroneously set to a large value. An attacker could create a
	specially-crafted JPEG image that, when opened, could cause an
	application using libpng to crash or, possibly, execute arbitrary code
	with the privileges of the user running the application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2806</cvename>
	<url>http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=826849</url>
	</references>
	<dates>
	<discovery>2012-05-31</discovery>
	<entry>2012-07-18</entry>
	<modified>2012-07-19</modified>
	</dates>
	</vuln>

	<vuln vid="2fe4b57f-d110-11e1-ac76-10bf48230856">
	<topic>Dokuwiki -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20120125_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="http://secunia.com/advisories/49196/">
	<p>Secunia Research has discovered a vulnerability in DokuWiki, which can
	be exploited by malicious people to conduct cross-site scripting
	attacks.</p>
	<p>Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call"
	is set to "medialist" and "do" is set to "media") is not properly
	sanitised within the "tpl_mediaFileList()" function in inc/template.php
	before being returned to the user. This can be exploited to execute
	arbitrary HTML and script code in a user's browser session in context
	of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/49196/</url>
	<cvename>CVE-2012-0283</cvename>
	</references>
	<dates>
	<discovery>2012-07-13</discovery>
	<entry>2012-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="3a6960ef-c8a8-11e1-9924-001fd0af1a4c">
	<topic>puppet -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>puppet</name>
	<range><gt>2.7.*</gt><lt>2.7.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>puppet -- multiple vulnerabilities</p>
	<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18">
	<p>Arbitrary file read on the puppet master from authenticated
	clients (high). It is possible to construct an HTTP get request
	from an authenticated client with a valid certificate that will
	return the contents of an arbitrary file on the Puppet master
	that the master has read-access to.</p>
	<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated
	clients (high). Given a Puppet master with the "Delete"
	directive allowed in auth.conf for an authenticated host, an
	attacker on that host can send a specially crafted Delete
	request that can cause an arbitrary file deletion on the Puppet
	master, potentially causing a denial of service attack. Note
	that this vulnerability does not exist in Puppet as
	configured by default.</p>
	<p>The last_run_report.yaml is world readable (medium). The most
	recent Puppet run report is stored on the Puppet master with
	world-readable permissions. The report file contains the
	context diffs of any changes to configuration on an agent,
	which may contain sensitive information that an attacker can
	then access. The last run report is overwritten with every
	Puppet run.</p>
	<p>Arbitrary file read on the Puppet master by an agent (medium).
	This vulnerability is dependent upon vulnerability
	"last_run_report.yml is world readable" above. By creating a
	hard link of a Puppet-managed file to an arbitrary file that
	the Puppet master can read, an attacker forces the contents to
	be written to the puppet run summary. The context diff is
	stored in last_run_report.yaml, which can then be accessed by
	the attacker.</p>
	<p>Insufficient input validation for agent hostnames (low). An
	attacker could trick the administrator into signing an
	attacker's certificate rather than the intended one by
	constructing specially crafted certificate requests containing
	specific ANSI control sequences. It is possible to use the
	sequences to rewrite the order of text displayed to an
	administrator such that display of an invalid certificate and
	valid certificate are transposed. If the administrator signs
	the attacker's certificate, the attacker can then
	man-in-the-middle the agent.</p>
	<p>Agents with certnames of IP addresses can be impersonated
	(low). If an authenticated host with a certname of an IP
	address changes IP addresses, and a second host assumes the
	first host's former IP address, the second host will be treated
	by the puppet master as the first one, giving the second host
	access to the first host's catalog. Note: This will not be
	fixed in Puppet versions prior to the forthcoming 3.x. Instead,
	with this announcement IP-based authentication in Puppet < 3.x
	is deprecated.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3864</cvename>
	<cvename>CVE-2012-3865</cvename>
	<cvename>CVE-2012-3866</cvename>
	<cvename>CVE-2012-3867</cvename>
	<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3866/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
	</references>
	<dates>
	<discovery>2012-07-05</discovery>
	<entry>2012-07-10</entry>
	</dates>
	</vuln>

	<vuln vid="4c1ac2dd-c788-11e1-be25-14dae9ebcf89">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk</name>
	<range><gt>10.*</gt><lt>10.5.2</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.13.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Possible resource leak on uncompleted re-invite transactions.</p>
	<p>Remote crash vulnerability in voice mail application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3812</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-010.html</url>
	<url>http://downloads.digium.com/pub/security/AST-2012-011.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2012-07-05</discovery>
	<entry>2012-07-06</entry>
	<modified>2012-08-30</modified>
	</dates>
	</vuln>

	<vuln vid="c28ee9cd-916e-4dcf-8ed3-e97e5846db6c">
	<topic>typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.5</ge><lt>4.5.17</lt></range>
	<range><ge>4.6</ge><lt>4.6.10</lt></range>
	<range><ge>4.7</ge><lt>4.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo3 Security Report (TYPO3-CORE-SA-2012-003):</p>
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/">
	<p>TYPO3 bundles and uses an external JavaScript and Flash Upload Library
	called swfupload. TYPO3 can be configured to use this Flash uploader.
	Input passed via the "movieName" parameter to swfupload.swf is not
	properly sanitised before being used in a call to
	"ExternalInterface.call()". This can be exploited to execute arbitrary
	script code in a user's browser session in context of an affected site.
	The existance of the swfupload library is sufficient to be vulnerable
	to the reported problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/49780/</url>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/</url>
	</references>
	<dates>
	<discovery>2012-07-04</discovery>
	<entry>2012-07-06</entry>
	</dates>
	</vuln>

	<vuln vid="fd8bac56-c444-11e1-864b-001cc0877741">
	<topic>phpList -- SQL injection and XSS vulnerability</topic>
	<affects>
	<package>
	<name>phplist</name>
	<range><le>2.10.17</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Zero Science Lab reports:</p>
	<blockquote cite="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php">
	<p>Input passed via the parameter 'sortby' is not properly
	sanitised before being returned to the user or used in SQL queries.
	This can be exploited to manipulate SQL queries by injecting
	arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
	where the attacker can execute arbitrary HTML and script code in
	a user's browser session in context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2740</cvename>
	<cvename>CVE-2012-2741</cvename>
	<bid>52657</bid>
	<url>https://www.phplist.com/?lid=567</url>
	<url>http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php</url>
	</references>
	<dates>
	<discovery>2012-03-21</discovery>
	<entry>2012-07-02</entry>
	</dates>
	</vuln>

	<vuln vid="aed44c4e-c067-11e1-b5e0-000c299b62e1">
	<topic>FreeBSD -- Privilege escalation when returning from kernel</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_9</lt></range>
	<range><ge>8.1</ge><lt>8.1_12</lt></range>
	<range><ge>8.2</ge><lt>8.2_9</lt></range>
	<range><ge>8.3</ge><lt>8.3_3</lt></range>
	<range><ge>9.0</ge><lt>9.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc">
	<p>FreeBSD/amd64 runs on CPUs from different vendors. Due to varying
	behaviour of CPUs in 64 bit mode a sanity check of the kernel may be
	insufficient when returning from a system call.</p>
	<p>Successful exploitation of the problem can lead to local kernel privilege
	escalation, kernel data corruption and/or crash.
	To exploit this vulnerability, an attacker must be able to run code with user
	privileges on the target system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:04.sysret</freebsdsa>
	<cvename>CVE-2012-0217</cvename>
	</references>
	<dates>
	<discovery>2012-06-12</discovery>
	<entry>2012-06-27</entry>
	</dates>
	</vuln>

	<vuln vid="fc5231b6-c066-11e1-b5e0-000c299b62e1">
	<topic>FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_9</lt></range>
	<range><ge>8.1</ge><lt>8.1_11</lt></range>
	<range><ge>8.2</ge><lt>8.2_9</lt></range>
	<range><ge>8.3</ge><lt>8.3_3</lt></range>
	<range><ge>9.0</ge><lt>9.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:03.bind.asc">
	<p>The named(8) server does not properly handle DNS resource records where
	the RDATA field is zero length, which may cause various issues for the
	servers handling them.</p>
	<p>Resolving servers may crash or disclose some portion of memory to the
	client. Authoritative servers may crash on restart after transferring a
	zone containing records with zero-length RDATA fields. These would
	result in a denial of service, or leak of sensitive information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:03.bind</freebsdsa>
	<cvename>CVE-2012-1667</cvename>
	</references>
	<dates>
	<discovery>2012-06-12</discovery>
	<entry>2012-06-27</entry>
	</dates>
	</vuln>

	<vuln vid="185ff22e-c066-11e1-b5e0-000c299b62e1">
	<topic>FreeBSD -- Incorrect crypt() hashing</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_8</lt></range>
	<range><ge>8.1</ge><lt>8.1_10</lt></range>
	<range><ge>8.2</ge><lt>8.2_8</lt></range>
	<range><ge>8.3</ge><lt>8.3_2</lt></range>
	<range><ge>9.0</ge><lt>9.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc">
	<p>There is a programming error in the DES implementation used in crypt()
	when handling input which contains characters that cannot be represented
	with 7-bit ASCII.</p>
	<p>When the input contains characters with only the most significant bit set
	(0x80), that character and all characters after it will be ignored.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:02.crypt</freebsdsa>
	<cvename>CVE-2012-2143</cvename>
	</references>
	<dates>
	<discovery>2012-05-30</discovery>
	<entry>2012-06-27</entry>
	</dates>
	</vuln>

	<vuln vid="2ae114de-c064-11e1-b5e0-000c299b62e1">
	<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_8</lt></range>
	<range><ge>8.1</ge><lt>8.1_10</lt></range>
	<range><ge>8.2</ge><lt>8.2_8</lt></range>
	<range><ge>8.3</ge><lt>8.3_2</lt></range>
	<range><ge>9.0</ge><lt>9.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:01.openssl.asc">
	<p>OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0
	records when operating as a client or a server that accept SSL 3.0
	handshakes. As a result, in each record, up to 15 bytes of uninitialized
	memory may be sent, encrypted, to the SSL peer. This could include
	sensitive contents of previously freed memory. [CVE-2011-4576]</p>
	<p>OpenSSL support for handshake restarts for server gated cryptography (SGC)
	can be used in a denial-of-service attack. [CVE-2011-4619]</p>
	<p>If an application uses OpenSSL's certificate policy checking when
	verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK
	flag, a policy check failure can lead to a double-free. [CVE-2011-4109]</p>
	<p>A weakness in the OpenSSL PKCS #7 code can be exploited using
	Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the
	million message attack (MMA). [CVE-2012-0884]</p>
	<p>The asn1_d2i_read_bio() function, used by the d2i__bio and d2i__fp
	functions, in OpenSSL contains multiple integer errors that can cause
	memory corruption when parsing encoded ASN.1 data. This error can occur
	on systems that parse untrusted ASN.1 data, such as X.509 certificates
	or RSA public keys. [CVE-2012-2110]</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-12:01.openssl</freebsdsa>
	<cvename>CVE-2011-4576</cvename>
	<cvename>CVE-2011-4619</cvename>
	<cvename>CVE-2011-4109</cvename>
	<cvename>CVE-2012-0884</cvename>
	<cvename>CVE-2012-2110</cvename>
	</references>
	<dates>
	<discovery>2012-05-03</discovery>
	<entry>2012-06-27</entry>
	</dates>
	</vuln>

	<vuln vid="f45c0049-be72-11e1-a284-0023ae8e59f0">
	<topic>pycrypto -- vulnerable ElGamal key generation</topic>
	<affects>
	<package>
	<name>py-pycrypto</name>
	<range><ge>2.5</ge><lt>2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dwayne C. Litzenberger of PyCrypto reports:</p>
	<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html">
	<p>In the ElGamal schemes (for both encryption and signatures), g is
	supposed to be the generator of the entire Z^*_p group. However, in
	PyCrypto 2.5 and earlier, g is more simply the generator of a random
	sub-group of Z^*_p.</p>
	<p>The result is that the signature space (when the key is used for
	signing) or the public key space (when the key is used for encryption)
	may be greatly reduced from its expected size of log(p) bits, possibly
	down to 1 bit (the worst case if the order of g is 2).</p>
	<p>While it has not been confirmed, it has also been suggested that an
	attacker might be able to use this fact to determine the private key.</p>
	<p>Anyone using ElGamal keys should generate new keys as soon as
	practical.</p>
	<p>Any additional information about this bug will be tracked at
	https://bugs.launchpad.net/pycrypto/+bug/985164</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2417</cvename>
	<url>http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html</url>
	<url>https://bugs.launchpad.net/pycrypto/+bug/985164</url>
	</references>
	<dates>
	<discovery>2012-05-24</discovery>
	<entry>2012-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="f46c4c6a-ba25-11e1-806a-001143cd36d8">
	<topic>joomla -- Privilege Escalation</topic>
	<affects>
	<package>
	<name>joomla</name>
	<range><lt>2.5.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joomla! reported a Core Privilege Escalation::</p>
	<blockquote cite="http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html">
	<p>Inadequate checking leads to possible user privilege escalation..</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html</url>
	</references>
	<dates>
	<discovery>2012-04-29</discovery>
	<entry>2012-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="eb12ebee-b7af-11e1-b5e0-000c299b62e1">
	<topic>clamav -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.97.5</lt></range>
	</package>
	<package>
	<name>clamav-devel</name>
	<range><lt>20120612</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE Advisories report:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1419">
	<p>The TAR parser allows remote attackers to bypass malware detection
	via a POSIX TAR file with an initial [aliases] character sequence.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457">
	<p>The TAR parser allows remote attackers to bypass malware detection
	via a TAR archive entry with a length field that exceeds the total
	TAR file size.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1458">
	<p>The Microsoft CHM file parser allows remote attackers to bypass
	malware detection via a crafted reset interval in the LZXC header
	of a CHM file.</p>
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459">
	<p>The TAR file parser allows remote attackers to bypass malware
	detection via a TAR archive entry with a length field
	corresponding to that entire entry, plus part of the header ofxi
	the next entry.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1419</cvename>
	<cvename>CVE-2012-1457</cvename>
	<cvename>CVE-2012-1458</cvename>
	<cvename>CVE-2012-1459</cvename>
	</references>
	<dates>
	<discovery>2012-03-19</discovery>
	<entry>2012-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="3c8d1e5b-b673-11e1-be25-14dae9ebcf89">
	<topic>asterisk -- remote crash vulnerability</topic>
	<affects>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Skinny Channel Driver Remote Crash Vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-3553</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-009.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2012-06-14</discovery>
	<entry>2012-06-14</entry>
	</dates>
	</vuln>

	<vuln vid="5140dc69-b65e-11e1-9425-001b21614864">
	<topic>ImageMagick -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<range><lt>6.7.6.4</lt></range>
	</package>
	<package>
	<name>ImageMagick-nox11</name>
	<range><lt>6.7.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ImageMagick reports:</p>
	<blockquote cite="http://www.cert.fi/en/reports/2012/vulnerability635606.html">
	<p>Three vulnerabilities have been identified in ImageMagick's
	handling of JPEG and TIFF files. With these vulnerabilities, it is
	possible to cause a denial of service situation in the target
	system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0259</cvename>
	<cvename>CVE-2012-0260</cvename>
	<cvename>CVE-2012-1798</cvename>
	<url>http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629</url>
	<url>http://www.cert.fi/en/reports/2012/vulnerability635606.html</url>
	</references>
	<dates>
	<discovery>2012-03-28</discovery>
	<entry>2012-06-14</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="55587adb-b49d-11e1-8df1-0004aca374af">
	<topic>mantis -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>1.2.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mantis reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/06/09/1">
	<p>Roland Becker and Damien Regad (MantisBT developers) found that
	any user able to report issues via the SOAP interface could also
	modify any bugnotes (comments) created by other users. In a
	default/typical MantisBT installation, SOAP API is enabled and any
	user can sign up to report new issues. This vulnerability therefore
	impacts upon many public facing MantisBT installations.</p>
	<p>Roland Becker (MantisBT developer) found that the
	delete_attachments_threshold permission was not being checked when
	a user attempted to delete an attachment from an issue. The more
	generic update_bug_threshold permission was being checked instead.
	MantisBT administrators may have been under the false impression
	that their configuration of the delete_attachments_threshold was
	successfully preventing unwanted users from deleting
	attachments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2691</cvename>
	<cvename>CVE-2012-2692</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2012/06/09/1</mlist>
	<mlist>http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&forum_name=mantisbt-dev</mlist>
	</references>
	<dates>
	<discovery>2012-06-09</discovery>
	<entry>2012-06-12</entry>
	<modified>2012-06-13</modified>
	</dates>
	</vuln>

	<vuln vid="38195f00-b215-11e1-8132-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.236</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb12-14.html">
	<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2034</cvename>
	<cvename>CVE-2012-2035</cvename>
	<cvename>CVE-2012-2036</cvename>
	<cvename>CVE-2012-2037</cvename>
	<cvename>CVE-2012-2038</cvename>
	<cvename>CVE-2012-2039</cvename>
	<cvename>CVE-2012-2040</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb12-14.html</url>
	</references>
	<dates>
	<discovery>2012-06-08</discovery>
	<entry>2012-06-09</entry>
	</dates>
	</vuln>

	<vuln vid="bfecf7c1-af47-11e1-9580-4061862b8c22">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>13.0,1</lt></range>
	<range><lt>10.0.5,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.5,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.10</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.5</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.10</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>13.0</lt></range>
	<range><lt>10.0.5</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)</p>
	<p>MFSA 2012-36 Content Security Policy inline-script bypass</p>
	<p>MFSA 2012-37 Information disclosure though Windows file shares and shortcut files</p>
	<p>MFSA 2012-38 Use-after-free while replacing/inserting a node in a document</p>
	<p>MFSA 2012-39 NSS parsing errors with zero length items</p>
	<p>MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3101</cvename>
	<cvename>CVE-2012-0441</cvename>
	<cvename>CVE-2012-1938</cvename>
	<cvename>CVE-2012-1939</cvename>
	<cvename>CVE-2012-1937</cvename>
	<cvename>CVE-2012-1940</cvename>
	<cvename>CVE-2012-1941</cvename>
	<cvename>CVE-2012-1944</cvename>
	<cvename>CVE-2012-1945</cvename>
	<cvename>CVE-2012-1946</cvename>
	<cvename>CVE-2012-1947</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-34.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-36.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-37.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-38.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-39.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-40.html</url>
	</references>
	<dates>
	<discovery>2012-06-05</discovery>
	<entry>2012-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="1e14d46f-af1f-11e1-b242-00215af774f0">
	<topic>quagga -- BGP OPEN denial of service vulnerability</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><le>0.99.20.1</le></range>
	</package>
	<package>
	<name>quagga-re</name>
	<range><lt>0.99.17.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/962587">
	<p>If a pre-configured BGP peer sends a specially-crafted OPEN
	message with a malformed ORF capability TLV, Quagga bgpd process
	will erroneously try to consume extra bytes from the input packet
	buffer. The process will detect a buffer overrun attempt before
	it happens and immediately terminate with an error message. All
	BGP sessions established by the attacked router will be closed
	and its BGP routing disrupted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1820</cvename>
	<url>http://www.kb.cert.org/vuls/id/962587</url>
	</references>
	<dates>
	<discovery>2012-06-04</discovery>
	<entry>2012-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="de6d8290-aef7-11e1-898f-14dae938ec40">
	<topic>mail/sympa* -- Multiple vulnerabilities in Sympa archive management</topic>
	<affects>
	<package>
	<name>sympa</name>
	<range><lt>6.0.7</lt></range>
	<range><gt>6.1.*</gt><lt>6.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Verdin reports:</p>
	<blockquote cite="http://www.sympa.org/security_advisories#security_breaches_in_archives_management">
	<p>Multiple vulnerabilities have been discovered in Sympa archive
	management that allow to skip the scenario-based authorization
	mechanisms.</p>
	<p>This vulnerability allows the attacker to:</p>
	<ul>
	<li>display the archives management page ('arc_manage')</li>
	<li>download the list's archives</li>
	<li>delete the list's archives</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.sympa.org/security_advisories#security_breaches_in_archives_management</url>
	</references>
	<dates>
	<discovery>2012-05-15</discovery>
	<entry>2012-06-05</entry>
	</dates>
	</vuln>

	<vuln vid="1ecc0d3f-ae8e-11e1-965b-0024e88a8c98">
	<topic>dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory</topic>
	<affects>
	<package>
	<name>bind99</name>
	<range><lt>9.9.1.1</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.3.1</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.6.1</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2012-1667">
	<p>Processing of DNS resource records where the rdata field is zero length
	may cause various issues for the servers handling them.</p>
	<p>Processing of these records may lead to unexpected outcomes. Recursive
	servers may crash or disclose some portion of memory to the client.
	Secondary servers may crash on restart after transferring a zone
	containing these records. Master servers may corrupt zone data if the
	zone option "auto-dnssec" is set to "maintain". Other unexpected
	problems that are not listed here may also be encountered.</p>
	<p>Impact: This issue primarily affects recursive nameservers.
	Authoritative nameservers will only be impacted if an administrator
	configures experimental record types with no data. If the server is
	configured this way, then secondaries can crash on restart after
	transferring that zone. Zone data on the master can become corrupted if
	the zone with those records has named configured to manage the DNSSEC
	key rotation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1667</cvename>
	<url>http://www.isc.org/software/bind/advisories/cve-2012-1667</url>
	</references>
	<dates>
	<discovery>2012-06-04</discovery>
	<entry>2012-06-04</entry>
	<modified>2012-06-06</modified>
	</dates>
	</vuln>

	<vuln vid="a8864f8f-aa9e-11e1-a284-0023ae8e59f0">
	<topic>databases/postgresql*-server -- crypt vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql-server</name>
	<range><gt>8.3.*</gt><lt>8.3.18_1</lt></range>
	<range><gt>8.4.*</gt><lt>8.4.11_1</lt></range>
	<range><gt>9.0.*</gt><lt>9.0.7_2</lt></range>
	<range><gt>9.1.*</gt><lt>9.1.3_1</lt></range>
	<range><gt>9.2.*</gt><lt>9.2.b1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL Global Development Group reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1397/">
	<p>Today the PHP, OpenBSD and FreeBSD communities announced updates to
	patch a security hole involving their crypt() hashing algorithms. This
	issue is described in CVE-2012-2143. This vulnerability also affects a
	minority of PostgreSQL users, and will be fixed in an update release on
	June 4, 2012.</p>
	<p>Affected users are those who use the crypt(text, text) function
	with DES encryption in the optional pg_crypto module. Passwords
	affected are those that contain characters that cannot be
	represented with 7-bit ASCII. If a password contains a character
	that has the most significant bit set (0x80), and DES encryption
	is used, that character and all characters after it will be ignored.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2143</cvename>
	<url>http://www.postgresql.org/about/news/1397/</url>
	<url>http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9</url>
	</references>
	<dates>
	<discovery>2012-05-30</discovery>
	<entry>2012-05-30</entry>
	<modified>2012-05-31</modified>
	</dates>
	</vuln>

	<vuln vid="47f13540-c4cb-4971-8dc6-28d0dabfd9cd">
	<topic>nut -- upsd can be remotely crashed</topic>
	<affects>
	<package>
	<name>nut</name>
	<range><ge>2.4.0</ge><le>2.6.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Networkupstools project reports:</p>
	<blockquote cite="http://trac.networkupstools.org/projects/nut/changeset/3633">
	<p>NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to
	crashes when receiving random data from the network.</p>
	<p>This issue is related to the way NUT parses characters, especially
	from the network. Non printable characters were missed from strings
	operation (such as strlen), but still copied to the buffer, causing
	an overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2944</cvename>
	<url>http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html</url>
	<url>http://trac.networkupstools.org/projects/nut/changeset/3633</url>
	</references>
	<dates>
	<discovery>2012-05-30</discovery>
	<entry>2012-05-30</entry>
	</dates>
	</vuln>

	<vuln vid="359f615d-a9e1-11e1-8a66-14dae9ebcf89">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><le>1.6.2.24</le></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.12.1</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Remote crash vulnerability in IAX2 channel driver.</p>
	<p>Skinny Channel Driver Remote Crash Vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2947</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-007.html</url>
	<cvename>CVE-2012-2948</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-008.html</url>
	<url>https://www.asterisk.org/security</url>
	</references>
	<dates>
	<discovery>2012-05-29</discovery>
	<entry>2012-05-29</entry>
	<modified>2012-05-29</modified>
	</dates>
	</vuln>

	<vuln vid="617959ce-a5f6-11e1-a284-0023ae8e59f0">
	<topic>haproxy -- buffer overflow</topic>
	<affects>
	<package>
	<name>haproxy</name>
	<range><lt>1.4.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>HAProxy reports:</p>
	<blockquote cite="http://haproxy.1wt.eu/news.html">
	<p>A flaw was reported in HAProxy where, due to a boundary error
	when copying data into the trash buffer, an external attacker could
	cause a buffer overflow. Exploiting this flaw could lead to the
	execution of arbitrary code, however it requires non-default settings
	for the global.tune.bufsize configuration option (must be set to a
	value greater than the default), and also that header rewriting is
	enabled (via, for example, the regrep or rsprep directives).
	This flaw is reported against 1.4.20, prior versions may also be
	affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2391</cvename>
	<url>https://secunia.com/advisories/49261/</url>
	<url>http://haproxy.1wt.eu/download/1.4/src/CHANGELOG</url>
	<url>http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b</url>
	<url>http://haproxy.1wt.eu/news.html</url>
	</references>
	<dates>
	<discovery>2012-05-21</discovery>
	<entry>2012-05-24</entry>
	<modified>2012-05-29</modified>
	</dates>
	</vuln>

	<vuln vid="e0a969e4-a512-11e1-90b4-e0cb4e266481">
	<topic>RT -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>rt40</name>
	<range><ge>4.0</ge><lt>4.0.6</lt></range>
	</package>
	<package>
	<name>rt38</name>
	<range><lt>3.8.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BestPractical report:</p>
	<blockquote cite="http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html">
	<p>Internal audits of the RT codebase have uncovered a
	number of security vulnerabilities in RT. We are releasing
	versions 3.8.12 and 4.0.6 to resolve these vulnerabilities,
	as well as patches which apply atop all released versions of
	3.8 and 4.0.</p>
	<p>The vulnerabilities addressed by 3.8.12, 4.0.6, and the
	below patches include the following:</p>
	<p>The previously released tool to upgrade weak password
	hashes as part of CVE-2011-0009 was an incomplete fix and
	failed to upgrade passwords of disabled users.</p>
	<p>RT versions 3.0 and above contain a number of cross-site
	scripting (XSS) vulnerabilities which allow an attacker to
	run JavaScript with the user's credentials. CVE-2011-2083 is
	assigned to this vulnerability.</p>
	<p>RT versions 3.0 and above are vulnerable to multiple
	information disclosure vulnerabilities. This includes the
	ability for privileged users to expose users' previous
	password hashes -- this vulnerability is particularly
	dangerous given RT's weak hashing previous to the fix in
	CVE-2011-0009. A separate vulnerability allows privileged
	users to obtain correspondence history for any ticket in
	RT. CVE-2011-2084 is assigned to this vulnerability.</p>
	<p>All publicly released versions of RT are vulnerable to
	cross-site request forgery (CSRF). CVE-2011-2085 is assigned
	to this vulnerability.</p>
	<p>We have also added a separate configuration option
	($RestrictLoginReferrer) to prevent login CSRF, a different
	class of CSRF attack.</p>
	<p>RT versions 3.6.1 and above are vulnerable to a remote
	execution of code vulnerability if the optional VERP
	configuration options ($VERPPrefix and $VERPDomain) are
	enabled. RT 3.8.0 and higher are vulnerable to a limited
	remote execution of code which can be leveraged for
	privilege escalation. RT 4.0.0 and above contain a
	vulnerability in the global $DisallowExecuteCode option,
	allowing sufficiently privileged users to still execute code
	even if RT was configured to not allow it. CVE-2011-4458 is
	assigned to this set of vulnerabilities.</p>
	<p>RT versions 3.0 and above may, under some circumstances,
	still respect rights that a user only has by way of a
	currently-disabled group. CVE-2011-4459 is assigned to this
	vulnerability.</p>
	<p>RT versions 2.0 and above are vulnerable to a SQL
	injection attack, which allow privileged users to obtain
	arbitrary information from the database. CVE-2011-4460 is
	assigned to this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0009</cvename>
	<cvename>CVE-2011-2082</cvename>
	<cvename>CVE-2011-2083</cvename>
	<cvename>CVE-2011-2084</cvename>
	<cvename>CVE-2011-2085</cvename>
	<cvename>CVE-2011-4458</cvename>
	<cvename>CVE-2011-4459</cvename>
	<cvename>CVE-2011-4460</cvename>
	<url>http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html</url>
	</references>
	<dates>
	<discovery>2012-05-22</discovery>
	<entry>2012-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="78c39232-a345-11e1-9d81-d0df9acfd7e5">
	<topic>sympa -- Multiple Security Bypass Vulnerabilities</topic>
	<affects>
	<package>
	<name>sympa</name>
	<range><lt>6.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia team reports:</p>
	<blockquote cite="http://secunia.com/advisories/49045/">
	<p>Multiple vulnerabilities have been reported in Sympa, which can be
	exploited by malicious people to bypass certain security
	restrictions.</p>
	<p>The vulnerabilities are caused due to the application allowing
	access to archive functions without checking credentials. This can
	be exploited to create, download, and delete an archive.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2352</cvename>
	<url>http://secunia.com/advisories/49045/</url>
	</references>
	<dates>
	<discovery>2012-05-14</discovery>
	<entry>2012-05-21</entry>
	</dates>
	</vuln>

	<vuln vid="495b46fd-a30f-11e1-82c9-d0df9acfd7e5">
	<topic>foswiki -- Script Insertion Vulnerability via unchecked user registration fields</topic>
	<affects>
	<package>
	<name>foswiki</name>
	<range><lt>1.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Foswiki team reports:</p>
	<blockquote cite="http://foswiki.org/Support/SecurityAlert-CVE-2012-1004">
	<p>When a new user registers, the new user can add arbitrary HTML and
	script code into the user topic which is generated by the
	RegistrationAgent via standard registration fields such as
	"FirstName" or "OrganisationName".</p>
	<p>By design, Foswiki's normal editing features allow arbitrary HTML
	markup, including script code, to be inserted into any topic anyway,
	assuming the authenticated user has CHANGE permission - which is the
	case on many Foswiki sites. However, the assumption that only
	authenticated users with CHANGE permission may create script content
	is false if new users exploit the vulnerability detailed in this
	alert to manipulate the registration agent into creating that
	content for them.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1004</cvename>
	<url>http://foswiki.org/Support/SecurityAlert-CVE-2012-1004</url>
	</references>
	<dates>
	<discovery>2012-04-13</discovery>
	<entry>2012-05-21</entry>
	</dates>
	</vuln>

	<vuln vid="b8ae4659-a0da-11e1-a294-bcaec565249c">
	<topic>libxml2 -- An off-by-one out-of-bounds write by XPointer</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.7.8_3</lt></range>
	</package>
	<package>
	<name>linux-f10-libxml2</name>
	<range><lt>2.7.8_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google chrome team reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html">
	<p>An off-by-one out-of-bounds write flaw was found in the way libxml, a library
	for providing XML and HTML support, evaluated certain XPointer parts (XPointer
	is used by libxml to include only the part from the returned XML document, that
	can be accessed using the XPath expression given with the XPointer). A remote
	attacker could provide a specially-crafted XML file, which once opened in an
	application, linked against libxml, would lead to that application crash, or,
	potentially arbitrary code execution with the privileges of the user running
	the application.</p>
	<p>Note: The flaw to be exploited requires the particular application, linked
	against libxml, to use the XPointer evaluation functionality.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3202</cvename>
	<url>http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102</url>
	</references>
	<dates>
	<discovery>2012-05-15</discovery>
	<entry>2012-05-18</entry>
	<modified>2014-04-30</modified>
	</dates>
	</vuln>

	<vuln vid="f5f00804-a03b-11e1-a284-0023ae8e59f0">
	<topic>inspircd -- buffer overflow</topic>
	<affects>
	<package>
	<name>inspircd</name>
	<range><ge>1.2</ge><lt>1.2.9</lt></range>
	<range><ge>2.0</ge><lt>2.0.5_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>InspIRCd reports:</p>
	<blockquote cite="http://inspircd.github.com/">
	<p>InspIRCd contains a heap corruption vulnerability that exists in the
	dns.cpp code. The res[] buffer is allocated on the heap and can be
	overflowed. The res[] buffer can be exploited during its deallocation.
	The number of overflowed bytes can be controlled with DNS compression
	features.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1836</cvename>
	<url>http://inspircd.github.com/</url>
	</references>
	<dates>
	<discovery>2012-03-19</discovery>
	<entry>2012-05-17</entry>
	<modified>2012-06-21</modified>
	</dates>
	</vuln>

	<vuln vid="aa71daaa-9f8c-11e1-bd0a-0082a0c18826">
	<topic>pidgin-otr -- format string vulnerability</topic>
	<affects>
	<package>
	<name>pidgin-otr</name>
	<range><lt>3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The authors report:</p>
	<blockquote cite="http://www.cypherpunks.ca/otr/">
	<p>Versions 3.2.0 and earlier of the pidgin-otr plugin contain
	a format string security flaw. This flaw could potentially be
	exploited by a remote attacker to cause arbitrary code to be
	executed on the user's machine.</p>
	<p>The flaw is in pidgin-otr, not in libotr. Other applications
	that use libotr are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2369</cvename>
	<url>http://www.cypherpunks.ca/otr/</url>
	</references>
	<dates>
	<discovery>2012-05-16</discovery>
	<entry>2012-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="b3435b68-9ee8-11e1-997c-002354ed89bc">
	<topic>sudo -- netmask vulnerability</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><le>1.8.4_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.sudo.ws/sudo/alerts/netmask.html">
	<p>Sudo supports granting access to commands on a per-host basis.
	The host specification may be in the form of a host name, a
	netgroup, an IP address, or an IP network (an IP address with an
	associated netmask).</p>
	<p>When IPv6 support was added to sudo, a bug was introduced that
	caused the IPv6 network matching code to be called when an IPv4
	network address does not match. Depending on the value of the
	uninitialized portion of the IPv6 address, it is possible for the
	IPv4 network number to match when it should not. This bug only
	affects IP network matching and does not affect simple IP address
	matching.</p>
	<p>The reported configuration that exhibited the bug was an
	LDAP-based sudo installation where the sudoRole object contained
	multiple sudoHost entries, each containing a different IPv4
	network. File-based sudoers should be affected as well as the
	same matching code is used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2337</cvename>
	<url>http://www.sudo.ws/sudo/alerts/netmask.html</url>
	</references>
	<dates>
	<discovery>2012-05-16</discovery>
	<entry>2012-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="dba5d1c9-9f29-11e1-b511-003067c2616f">
	<topic>OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL security team reports:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20120510.txt">
	<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
	DTLS can be exploited in a denial of service attack on both clients and
	servers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2333</cvename>
	<url>http://www.openssl.org/news/secadv_20120510.txt</url>
	</references>
	<dates>
	<discovery>2012-05-10</discovery>
	<entry>2012-05-10</entry>
	</dates>
	</vuln>

	<vuln vid="6601127c-9e09-11e1-b5e0-000c299b62e1">
	<topic>socat -- Heap-based buffer overflow</topic>
	<affects>
	<package>
	<name>socat</name>
	<range><lt>1.7.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The socat development team reports:</p>
	<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv3.html">
	<p>This vulnerability can be exploited when socat is invoked with the
	READLINE address (this is usually only used interactively) without
	option "prompt" and without option "noprompt" and an attacker succeeds
	to provide malicious data to the other (arbitrary) address that is then
	transferred by socat to the READLINE address for output.</p>
	<p>Successful exploitation may allow an attacker to execute arbitrary
	code with the privileges of the socat process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0219</cvename>
	<url>www.dest-unreach.org/socat/contrib/socat-secadv3.html</url>
	</references>
	<dates>
	<discovery>2012-05-14</discovery>
	<entry>2012-05-14</entry>
	</dates>
	</vuln>

	<vuln vid="59b68b1e-9c78-11e1-b5e0-000c299b62e1">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><gt>5.4</gt><lt>5.4.3</lt></range>
	<range><lt>5.3.13</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.13</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP Development Team reports:</p>
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-08-1">
	<p>The release of PHP 5.4.13 and 5.4.3 complete a fix for the
	vulnerability in CGI-based setups as originally described in
	CVE-2012-1823. (CVE-2012-2311)</p>
	<p>Note: mod_php and php-fpm are not vulnerable to this attack.</p>
	<p>PHP 5.4.3 fixes a buffer overflow vulnerability in the
	apache_request_headers() (CVE-2012-2329).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1823</cvename>
	<cvename>CVE-2012-2311</cvename>
	<cvename>CVE-2012-2329</cvename>
	</references>
	<dates>
	<discovery>2012-05-08</discovery>
	<entry>2012-05-12</entry>
	</dates>
	</vuln>

	<vuln vid="64f8b72d-9c4e-11e1-9c94-000bcdf0a03b">
	<topic>libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests</topic>
	<affects>
	<package>
	<name>libpurple</name>
	<range><lt>2.10.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pidgin reports:</p>
	<blockquote cite="http://pidgin.im/news/security/?id=62">
	<p>A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2214</cvename>
	</references>
	<dates>
	<discovery>2012-05-06</discovery>
	<entry>2012-05-12</entry>
	</dates>
	</vuln>

	<vuln vid="0d3547ab-9b69-11e1-bdb1-525401003090">
	<topic>PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability</topic>
	<affects>
	<package>
	<name>pivotx</name>
	<range><le>2.3.2</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>High-Tech Bridge reports:</p>
	<blockquote cite="https://www.htbridge.com/advisory/HTB23087">
	<p>Input passed via the "file" GET parameter to
	/pivotx/ajaxhelper.php is not properly sanitised before
	being returned to the user. This can be exploited to
	execute arbitrary HTML and script code in administrator's
	browser session in context of the affected website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>52159</bid>
	<cvename>CVE-2012-2274</cvename>
	<url>https://www.htbridge.com/advisory/HTB23087</url>
	</references>
	<dates>
	<discovery>2012-05-09</discovery>
	<entry>2012-05-12</entry>
	<modified>2012-05-14</modified>
	</dates>
	</vuln>

	<vuln vid="b91234e7-9a8b-11e1-b666-001636d274f3">
	<topic>NVIDIA UNIX driver -- access to arbitrary system memory</topic>
	<affects>
	<package>
	<name>nvidia-driver</name>
	<range><gt>173.14.35_2</gt><lt>295.71</lt></range>
	<range><gt>96.43.20_3</gt><lt>173.14.35</lt></range>
	<range><gt>71.86.15_3</gt><lt>96.43.20_2</lt></range>
	<range><lt>71.86.15_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NVIDIA Unix security team reports:</p>
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3109">
	<p>Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver
	was disclosed to NVIDIA on March 20th, 2012. The vulnerability
	makes it possible for an attacker who has read and write access
	to the GPU device nodes to reconfigure GPUs to gain access to
	arbitrary system memory. NVIDIA is not aware of any reports of
	this vulnerability, outside of the disclosure which was made
	privately to NVIDIA.</p>
	<p>NVIDIA has identified the root cause of the vulnerability and
	has released updated drivers which close it. [NVIDIA encourages]
	all users with Geforce 8 or newer, G80 Quadro or newer, and all
	Tesla GPUs to update their drivers to 295.40 or later.</p>
	</blockquote>
	<p>Later, it was additionally discovered that similar exploit could
	be achieved through remapping of VGA window:</p>
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3140">
	<p>NVIDIA received notification of a security exploit that uses
	NVIDIA UNIX device files to map and program registers to redirect
	the VGA window. Through the VGA window, the exploit can access
	any region of physical system memory. This arbitrary memory
	access can be further exploited, for example, to escalate user
	privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0946</cvename>
	<cvename>CVE-2012-4225</cvename>
	</references>
	<dates>
	<discovery>2012-03-20</discovery>
	<entry>2012-05-10</entry>
	<modified>2012-09-12</modified>
	</dates>
	</vuln>

	<vuln vid="3d55b961-9a2e-11e1-a2ef-001fd0af1a4c">
	<topic>rubygem-mail -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-mail</name>
	<range><lt>2.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>rubygem-mail -- multiple vulnerabilities</p>
	<blockquote cite="http://seclists.org/oss-sec/2012/q2/190">
	<p>Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2139</cvename>
	<cvename>CVE-2012-2140</cvename>
	<url>http://seclists.org/oss-sec/2012/q2/190</url>
	</references>
	<dates>
	<discovery>2012-03-14</discovery>
	<entry>2012-05-09</entry>
	</dates>
	</vuln>

	<vuln vid="a1d0911f-987a-11e1-a2ef-001fd0af1a4c">
	<topic>node -- private information disclosure</topic>
	<affects>
	<package>
	<name>node</name>
	<name>node-devel</name>
	<range><lt>0.6.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Private information disclosure</p>
	<blockquote cite="http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/">
	<p>An attacker can cause private information disclosure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/</url>
	</references>
	<dates>
	<discovery>2012-04-17</discovery>
	<entry>2012-05-07</entry>
	</dates>
	</vuln>

	<vuln vid="725ab25a-987b-11e1-a2ef-001fd0af1a4c">
	<topic>p5-Config-IniFiles -- unsafe temporary file creation</topic>
	<affects>
	<package>
	<name>p5-Config-IniFiles</name>
	<range><lt>2.71</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unsafe Temporary file creation</p>
	<blockquote cite="https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59">
	<p>Config::IniFiles used a predictable name for its temporary
	file without opening it correctly.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2451</cvename>
	<url>https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59</url>
	</references>
	<dates>
	<discovery>2012-05-02</discovery>
	<entry>2012-05-07</entry>
	</dates>
	</vuln>

	<vuln vid="60de13d5-95f0-11e1-806a-001143cd36d8">
	<topic>php -- vulnerability in certain CGI-based setups</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><gt>5.4</gt><lt>5.4.2</lt></range>
	<range><lt>5.3.12</lt></range>
	</package>
	<package>
	<name>php53</name>
	<range><lt>5.3.12</lt></range>
	</package>
	<package>
	<name>php4</name>
	<range><lt>4.4.10</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>php development team reports:</p>
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-03-1">
	<p>Security Enhancements and Fixes in PHP 5.3.12:</p>
	<ul>
	<li>Initial fix for cgi-bin ?-s cmdarg parse issue
	(CVE-2012-1823)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1823</cvename>
	</references>
	<dates>
	<discovery>2012-05-03</discovery>
	<entry>2012-05-05</entry>
	</dates>
	</vuln>

	<vuln vid="18dffa02-946a-11e1-be9d-000c29cc39d3">
	<topic>WebCalendar -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>WebCalendar-devel</name>
	<range><le>1.2.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanno Boeck reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/04/28/1">
	<p>Fixes [are now available] for various security vulnerabilities
	including LFI (local file inclusion), XSS (cross site scripting)
	and others.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1495</cvename>
	<cvename>CVE-2012-1496</cvename>
	<url>http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html</url>
	<url>http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html</url>
	<url>http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html</url>
	</references>
	<dates>
	<discovery>2012-04-28</discovery>
	<entry>2012-05-02</entry>
	</dates>
	</vuln>

	<vuln vid="2cde1892-913e-11e1-b44c-001fd0af1a4c">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php53</name>
	<range><lt>5.3.11</lt></range>
	</package>
	<package>
	<name>php5</name>
	<range><lt>5.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>php development team reports:</p>
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-04-26-1">
	<p>Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:</p>
	<ul>
	<li>Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172) </li>
	<li>Add open_basedir checks to readline_write_history and readline_read_history.</li>
	</ul>
	<p>Security Enhancements for both PHP 5.3.11 only:</p>
	<ul>
	<li>Regression in magic_quotes_gpc fix for CVE-2012-0831.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0831</cvename>
	<cvename>CVE-2012-1172</cvename>
	<url>http://www.php.net/archive/2012.php#id2012-04-26-1</url>
	</references>
	<dates>
	<discovery>2012-03-01</discovery>
	<entry>2012-04-28</entry>
	<modified>2012-05-04</modified>
	</dates>
	</vuln>

	<vuln vid="0fa15e08-92ec-11e1-a94a-00215c6a37bb">
	<topic>samba -- incorrect permission checks vulnerability</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.17</lt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.15</lt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba project reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2012-2111">
	<p>Samba versions 3.4.x to 3.6.4 inclusive are affected
	by a vulnerability that allows arbitrary users to modify
	privileges on a file server.</p>
	<p>Security checks were incorrectly applied to the Local
	Security Authority (LSA) remote proceedure calls (RPC)
	CreateAccount, OpenAccount, AddAccountRights and
	RemoveAccountRights allowing any authenticated user
	to modify the privileges database.</p>
	<p>This is a serious error, as it means that authenticated
	users can connect to the LSA and grant themselves the
	"take ownership" privilege. This privilege is used by the
	smbd file server to grant the ability to change ownership
	of a file or directory which means users could take ownership
	of files or directories they do not own.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2111</cvename>
	</references>
	<dates>
	<discovery>2012-04-30</discovery>
	<entry>2012-04-30</entry>
	</dates>
	</vuln>

	<vuln vid="b428e6b3-926c-11e1-8d7b-003067b2972c">
	<topic>portupgrade-devel -- lack of distfile checksums</topic>
	<affects>
	<package>
	<name>portupgrade-devel</name>
	<range><lt>0,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ports security team reports:</p>
	<p>The portupgrade-devel port fetched directly from a git
	respository without checking against a known good
	SHA hash. This means that it is possible that packages
	built using this port may not match the one vetted
	by the maintainer. Users are advised to rebuild
	portupgrade-devel from known good sources.</p>
	</body>
	</description>
	<references>
	<mlist>http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI</mlist>
	<mlist>http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports</mlist>
	</references>
	<dates>
	<discovery>2012-04-30</discovery>
	<entry>2012-04-30</entry>
	<modified>2012-05-06</modified>
	</dates>
	</vuln>

	<vuln vid="5d85976a-9011-11e1-b5e0-000c299b62e1">
	<topic>net-snmp -- Remote DoS</topic>
	<affects>
	<package>
	<name>net-snmp</name>
	<range><lt>5.7.1_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Red Hat Security Response Team reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=815813">
	<p>An array index error, leading to out-of heap-based buffer read flaw was
	found in the way the net-snmp agent performed lookups in the
	extension table. When certain MIB subtrees were handled by the
	extend directive, a remote attacker (having read privileges to the
	subntree) could use this flaw to cause a denial of service condition
	via an SNMP GET request involving a non-existent extension table
	entry.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2141</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=815813</url>
	<url>http://www.openwall.com/lists/oss-security/2012/04/26/2</url>
	</references>
	<dates>
	<discovery>2012-04-26</discovery>
	<entry>2012-04-27</entry>
	</dates>
	</vuln>

	<vuln vid="380e8c56-8e32-11e1-9580-4061862b8c22">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>12.0,1</lt></range>
	<range><lt>10.0.4,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.4,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.9</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.4</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.9</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>12.0</lt></range>
	<range><lt>10.0.4</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)</p>
	<p>MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9</p>
	<p>MFSA 2012-22 use-after-free in IDBKeyRange</p>
	<p>MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface</p>
	<p>MFSA 2012-24 Potential XSS via multibyte content processing errors</p>
	<p>MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite</p>
	<p>MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error</p>
	<p>MFSA 2012-27 Page load short-circuit can lead to XSS</p>
	<p>MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions</p>
	<p>MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues</p>
	<p>MFSA 2012-30 Crash with WebGL content using textImage2D</p>
	<p>MFSA 2012-31 Off-by-one error in OpenType Sanitizer</p>
	<p>MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors</p>
	<p>MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1187</cvename>
	<cvename>CVE-2011-3062</cvename>
	<cvename>CVE-2012-0467</cvename>
	<cvename>CVE-2012-0468</cvename>
	<cvename>CVE-2012-0469</cvename>
	<cvename>CVE-2012-0470</cvename>
	<cvename>CVE-2012-0471</cvename>
	<cvename>CVE-2012-0472</cvename>
	<cvename>CVE-2012-0473</cvename>
	<cvename>CVE-2012-0474</cvename>
	<cvename>CVE-2012-0475</cvename>
	<cvename>CVE-2012-0477</cvename>
	<cvename>CVE-2012-0478</cvename>
	<cvename>CVE-2012-0479</cvename>
	<cvename>CVE-2012-1126</cvename>
	<cvename>CVE-2012-1127</cvename>
	<cvename>CVE-2012-1128</cvename>
	<cvename>CVE-2012-1129</cvename>
	<cvename>CVE-2012-1130</cvename>
	<cvename>CVE-2012-1131</cvename>
	<cvename>CVE-2012-1132</cvename>
	<cvename>CVE-2012-1133</cvename>
	<cvename>CVE-2012-1134</cvename>
	<cvename>CVE-2012-1135</cvename>
	<cvename>CVE-2012-1136</cvename>
	<cvename>CVE-2012-1137</cvename>
	<cvename>CVE-2012-1138</cvename>
	<cvename>CVE-2012-1139</cvename>
	<cvename>CVE-2012-1140</cvename>
	<cvename>CVE-2012-1141</cvename>
	<cvename>CVE-2012-1142</cvename>
	<cvename>CVE-2012-1143</cvename>
	<cvename>CVE-2012-1144</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-20.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-21.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-22.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-23.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-24.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-25.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-26.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-27.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-28.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-29.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-30.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-31.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-32.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-33.html</url>
	</references>
	<dates>
	<discovery>2012-04-24</discovery>
	<entry>2012-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="a04247f1-8d9c-11e1-93c7-00215c6a37bb">
	<topic>Dokuwiki -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20120125_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andy Webber reports:</p>
	<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&task_id=2487">
	<p>Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2128</cvename>
	<cvename>CVE-2012-2129</cvename>
	</references>
	<dates>
	<discovery>2012-04-17</discovery>
	<entry>2012-04-23</entry>
	</dates>
	</vuln>

	<vuln vid="1c5abbe2-8d7f-11e1-a374-14dae9ebcf89">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.24</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.11.1</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Remote Crash Vulnerability in SIP Channel Driver</p>
	<p>Heap Buffer Overflow in Skinny Channel Driver</p>
	<p>Asterisk Manager User Unauthorized Shell Access</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.digium.com/pub/security/AST-2012-004.html</url>
	<cvename>CVE-2012-2414</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-005.html</url>
	<cvename>CVE-2012-2415</cvename>
	<url>http://downloads.digium.com/pub/security/AST-2012-006.html</url>
	<cvename>CVE-2012-2416</cvename>
	</references>
	<dates>
	<discovery>2012-04-23</discovery>
	<entry>2012-04-23</entry>
	</dates>
	</vuln>

	<vuln vid="b384cc5b-8d56-11e1-8d7b-003067b2972c">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.3.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wordpress reports:</p>
	<blockquote cite="https://codex.wordpress.org/Version_3.3.2">
	<p>External code has been updated to
	non-vulnerable versions.
	In addition the following bugs have been fixed:</p>
	<ul>
	<li>Limited privilege escalation where a site administrator could
	deactivate network-wide plugins when running a WordPress network under
	particular circumstances.</li>
	<li>Cross-site scripting vulnerability when making URLs
	clickable.</li>
	<li>Cross-site scripting vulnerabilities in redirects after posting
	comments in older browsers, and when filtering URLs.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2399</cvename>
	<cvename>CVE-2012-2400</cvename>
	<cvename>CVE-2012-2401</cvename>
	<cvename>CVE-2012-2402</cvename>
	<cvename>CVE-2012-2403</cvename>
	<cvename>CVE-2012-2404</cvename>
	<url>https://codex.wordpress.org/Version_3.3.2</url>
	</references>
	<dates>
	<discovery>2012-04-20</discovery>
	<entry>2012-04-23</entry>
	</dates>
	</vuln>

	<vuln vid="7184f92e-8bb8-11e1-8d7b-003067b2972c">
	<topic>OpenSSL -- integer conversions result in memory corruption</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL security team reports:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20120419.txt">
	<p>A potentially exploitable vulnerability has been discovered in the OpenSSL
	function asn1_d2i_read_bio.
	Any application which uses BIO or FILE based functions to read untrusted DER
	format data is vulnerable. Affected functions are of the form d2i_*_bio or
	d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2110</cvename>
	<mlist msgid="20120419103522.GN30784@cmpxchg8b.com">http://marc.info/?l=full-disclosure&m=133483221408243</mlist>
	<url>http://www.openssl.org/news/secadv_20120419.txt</url>
	</references>
	<dates>
	<discovery>2012-04-19</discovery>
	<entry>2012-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="09c87973-8b9d-11e1-b393-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.9</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.8/">
	<p>The following security issues have been discovered in
	Bugzilla:</p>
	<h1>Unauthorized Access</h1>
	<p>Due to a lack of proper validation of the X-FORWARDED-FOR
	header of an authentication request, an attacker could bypass
	the current lockout policy used for protection against brute-
	force password discovery. This vulnerability can only be
	exploited if the 'inbound_proxies' parameter is set.</p>
	<h1>Cross Site Scripting</h1>
	<p>A JavaScript template used by buglist.cgi could be used
	by a malicious script to permit an attacker to gain access
	to some information about bugs he would not normally be
	allowed to see, using the victim's credentials. To be
	exploitable, the victim must be logged in when visiting
	the attacker's malicious page.</p>
	<p>All affected installations are encouraged to upgrade as soon
	as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0465</cvename>
	<cvename>CVE-2012-0466</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=728639</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=745397</url>
	</references>
	<dates>
	<discovery>2012-04-18</discovery>
	<entry>2012-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="67516177-88ec-11e1-9a10-0023ae8e59f0">
	<topic>typo -- Cross-Site Scripting</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.6.0</ge><le>4.6.7</le></range>
	<range><ge>4.5.0</ge><le>4.5.14</le></range>
	<range><ge>4.4.0</ge><le>4.4.14</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Typo Security Team reports:</p>
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/">
	<p>Failing to properly encode the output, the default TYPO3
	Exception Handler is susceptible to Cross-Site Scripting. We
	are not aware of a possibility to exploit this vulnerability
	without third party extensions being installed that put user
	input in exception messages. However, it has come to our
	attention that extensions using the extbase MVC framework can
	be used to exploit this vulnerability if these extensions
	accept objects in controller actions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2112</cvename>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/</url>
	</references>
	<dates>
	<discovery>2012-04-17</discovery>
	<entry>2012-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="0c14dfa7-879e-11e1-a2a0-00500802d8f7">
	<topic>nginx -- Buffer overflow in the ngx_http_mp4_module</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><lt>1.0.15</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><lt>1.1.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	<p>Buffer overflow in the ngx_http_mp4_module</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-2089</cvename>
	<url>http://nginx.org/en/security_advisories.html</url>
	</references>
	<dates>
	<discovery>2012-04-12</discovery>
	<entry>2012-04-16</entry>
	</dates>
	</vuln>

	<vuln vid="c80a3d93-8632-11e1-a374-14dae9ebcf89">
	<topic>phpmyfaq -- Remote PHP Code Execution Vulnerability</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><lt>2.7.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyFAQ project reports:</p>
	<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
	<p>The bundled ImageManager library allows injection of arbitrary
	PHP code to execute arbitrary PHP code and upload malware and
	trojan horses.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyfaq.de/advisory_2012-04-14.php</url>
	</references>
	<dates>
	<discovery>2012-04-14</discovery>
	<entry>2012-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="607d2108-a0e4-423a-bf78-846f2a8f01b0">
	<topic>puppet -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>puppet</name>
	<range><gt>2.7.*</gt><lt>2.7.12_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://puppetlabs.com/security/">
	<p>Multiple vulnerabilities exist in puppet that can result in
	arbitrary code execution, arbitrary file read access, denial of
	service, and arbitrary file write access. Please review the
	details in each of the CVEs for additional information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1906</cvename>
	<cvename>CVE-2012-1986</cvename>
	<cvename>CVE-2012-1987</cvename>
	<cvename>CVE-2012-1988</cvename>
	<cvename>CVE-2012-1989</cvename>
	<url>http://puppetlabs.com/security/cve/cve-2012-1906/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-1986/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-1987/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-1988/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-1989/</url>
	</references>
	<dates>
	<discovery>2012-03-26</discovery>
	<entry>2012-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="baf37cd2-8351-11e1-894e-00215c6a37bb">
	<topic>samba -- "root" credential remote code execution</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.16</lt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.14</lt></range>
	</package>
	<package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba development team reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2012-1182">
	<p>Samba versions 3.6.3 and all versions previous to this
	are affected by a vulnerability that allows remote code
	execution as the "root" user from an anonymous connection.</p>
	<p>As this does not require an authenticated connection it
	is the most serious vulnerability possible in a program,
	and users and vendors are encouraged to patch their Samba
	installations immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1182</cvename>
	</references>
	<dates>
	<discovery>2012-04-10</discovery>
	<entry>2012-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="7f448dc1-82ca-11e1-b393-20cf30e32f6d">
	<topic>bugzilla Cross-Site Request Forgery</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>4.0.0</ge><lt>4.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/4.0.4/">
	<p>The following security issues have been discovered in
	Bugzilla:</p>
	<ul>
	<li>Due to a lack of validation of the enctype form attribute
	when making POST requests to xmlrpc.cgi, a possible CSRF
	vulnerability was discovered. If a user visits an HTML page
	with some malicious HTML code in it, an attacker could make
	changes to a remote Bugzilla installation on behalf of the
	victim's account by using the XML-RPC API on a site running
	mod_perl. Sites running under mod_cgi are not affected.
	Also, the user would have had to be already logged in to the
	target site for the vulnerability to work.</li>
	</ul>
	<p>All affected installations are encouraged to upgrade as soon
	as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0453</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=725663</url>
	</references>
	<dates>
	<discovery>2012-02-22</discovery>
	<entry>2012-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="20923a0d-82ba-11e1-8d7b-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.228</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-07.html">
	<p>Multiple Priority 2 vulnerabilities could cause a crash and
	potentially allow an attacker to take control of the affected
	system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0724</cvename>
	<cvename>CVE-2012-0725</cvename>
	<cvename>CVE-2012-0772</cvename>
	<cvename>CVE-2012-0773</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb12-07.html</url>
	</references>
	<dates>
	<discovery>2012-04-05</discovery>
	<entry>2012-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="262b92fe-81c8-11e1-8899-001ec9578670">
	<topic>png -- memory corruption/possible remote code execution</topic>
	<affects>
	<package>
	<name>png</name>
	<name>linux-f10-png</name>
	<range><lt>1.4.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PNG project reports:</p>
	<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
	<p>libpng fails to correctly handle malloc() failures for text
	chunks (in png_set_text_2()), which can lead to memory
	corruption and the possibility of remote code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3048</cvename>
	<url>http://www.libpng.org/pub/png/libpng.html</url>
	</references>
	<dates>
	<discovery>2012-03-29</discovery>
	<entry>2012-04-08</entry>
	</dates>
	</vuln>

	<vuln vid="462e2d6c-8017-11e1-a571-bcaec565249c">
	<topic>freetype -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.4.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Freetype project reports:</p>
	<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view">
	<p>Multiple vulnerabilities exist in freetype that can result in
	application crashes and remote code execution. Please review
	the details in each of the CVEs for additional information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1126</cvename>
	<cvename>CVE-2012-1127</cvename>
	<cvename>CVE-2012-1128</cvename>
	<cvename>CVE-2012-1129</cvename>
	<cvename>CVE-2012-1130</cvename>
	<cvename>CVE-2012-1131</cvename>
	<cvename>CVE-2012-1132</cvename>
	<cvename>CVE-2012-1133</cvename>
	<cvename>CVE-2012-1134</cvename>
	<cvename>CVE-2012-1135</cvename>
	<cvename>CVE-2012-1136</cvename>
	<cvename>CVE-2012-1137</cvename>
	<cvename>CVE-2012-1138</cvename>
	<cvename>CVE-2012-1139</cvename>
	<cvename>CVE-2012-1140</cvename>
	<cvename>CVE-2012-1141</cvename>
	<cvename>CVE-2012-1142</cvename>
	<cvename>CVE-2012-1143</cvename>
	<cvename>CVE-2012-1144</cvename>
	<url>https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=806270</url>
	</references>
	<dates>
	<discovery>2012-03-08</discovery>
	<entry>2012-04-06</entry>
	</dates>
	</vuln>

	<vuln vid="49314321-7fd4-11e1-9582-001b2134ef46">
	<topic>mutt-devel -- failure to check SMTP TLS server certificate</topic>
	<affects>
	<package>
	<name>mutt-devel</name>
	<range><lt>1.5.21_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dave B reports on Full Disclosure:</p>
	<blockquote cite="http://seclists.org/fulldisclosure/2011/Mar/87">
	<p>It seems that mutt fails to check the validity of a SMTP
	servers certificate during a TLS connection. [...]
	This means that an attacker could potentially MITM a
	mutt user connecting to their SMTP server even when the
	user has forced a TLS connection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1429</cvename>
	<url>http://seclists.org/fulldisclosure/2011/Mar/87</url>
	</references>
	<dates>
	<discovery>2012-03-08</discovery>
	<entry>2012-04-06</entry>
	</dates>
	</vuln>

	<vuln vid="7289214f-7c55-11e1-ab3b-000bcdf0a03b">
	<topic>libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding</topic>
	<affects>
	<package>
	<name>libpurple</name>
	<range><lt>2.10.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1178">
	<p>The msn_oim_report_to_user function in oim.c in the MSN protocol
	plugin in libpurple in Pidgin before 2.10.2 allows remote servers
	to cause a denial of service (application crash) via an OIM message
	that lacks UTF-8 encoding.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1178</cvename>
	</references>
	<dates>
	<discovery>2012-03-15</discovery>
	<entry>2012-04-01</entry>
	</dates>
	</vuln>

	<vuln vid="a81161d2-790f-11e1-ac16-e0cb4e266481">
	<topic>phpMyAdmin -- Path disclosure due to missing verification of file presence</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.10.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php">
	<p>The show_config_errors.php scripts did not validate the presence
	of the configuration file, so an error message shows the full path
	of this file, leading to possible further attacks. For the error
	messages to be displayed, php.ini's error_reporting must be set to
	E_ALL and display_errors must be On (these settings are not
	recommended on a production server in the PHP manual).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1902</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php</url>
	</references>
	<dates>
	<discovery>2012-03-28</discovery>
	<entry>2012-03-28</entry>
	</dates>
	</vuln>

	<vuln vid="60f81af3-7690-11e1-9423-00235a5f2c9a">
	<topic>raptor/raptor2 -- XXE in RDF/XML File Interpretation</topic>
	<affects>
	<package>
	<name>raptor2</name>
	<range><lt>2.0.7</lt></range>
	</package>
	<package>
	<name>raptor</name>
	<range><lt>1.4.21_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timothy D. Morgan reports:</p>
	<blockquote cite="http://www.vsecurity.com/resources/advisory/20120324-1/">
	<p>In December 2011, VSR identified a vulnerability in multiple open
	source office products (including OpenOffice, LibreOffice, KOffice,
	and AbiWord) due to unsafe interpretation of XML files with custom
	entity declarations. Deeper analysis revealed that the
	vulnerability was caused by acceptance of external entities by the
	libraptor library, which is used by librdf and is in turn used by
	these office products.</p>
	<p>In the context of office applications, these vulnerabilities could
	allow for XML External Entity (XXE) attacks resulting in file theft
	and a loss of user privacy when opening potentially malicious ODF
	documents. For other applications which depend on librdf or
	libraptor, potentially serious consequences could result from
	accepting RDF/XML content from untrusted sources, though the impact
	may vary widely depending on the context.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0037</cvename>
	<url>http://seclists.org/fulldisclosure/2012/Mar/281</url>
	<url>http://www.vsecurity.com/resources/advisory/20120324-1/</url>
	</references>
	<dates>
	<discovery>2012-03-24</discovery>
	<entry>2012-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="42a2c82a-75b9-11e1-89b4-001ec9578670">
	<topic>quagga -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>0.99.20.1</lt></range>
	</package>
	<package>
	<name>quagga-re</name>
	<range><lt>0.99.17.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/551715">
	<p>The ospfd implementation of OSPF in Quagga allows a remote
	attacker (on a local network segment with OSPF enabled) to cause
	a denial of service (daemon aborts due to an assert) with a
	malformed OSPF LS-Update message.</p>
	<p>The ospfd implementation of OSPF in Quagga allows a remote
	attacker (on a local network segment with OSPF enabled) to cause
	a denial of service (daemon crash) with a malformed OSPF Network-
	LSA message.</p>
	<p>The bgpd implementation of BGP in Quagga allows remote attackers
	to cause a denial of service (daemon aborts due to an assert) via
	BGP Open message with an invalid AS4 capability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0249</cvename>
	<cvename>CVE-2012-0250</cvename>
	<cvename>CVE-2012-0255</cvename>
	<url>http://www.kb.cert.org/vuls/id/551715</url>
	</references>
	<dates>
	<discovery>2012-03-23</discovery>
	<entry>2012-03-24</entry>
	<modified>2012-03-26</modified>
	</dates>
	</vuln>

	<vuln vid="acab2f88-7490-11e1-865f-00e0814cab4e">
	<topic>Apache Traffic Server -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>trafficserver</name>
	<range><lt>3.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CERT-FI reports:</p>
	<blockquote cite="https://www.cert.fi/en/reports/2012/vulnerability612884.html">
	<p>A heap overflow vulnerability has been found in the HTTP
	(Hypertext Transfer Protocol) protocol handling of Apache
	Traffic Server. The vulnerability allows an attacker to cause
	a denial of service or potentially to execute his own code by
	sending a specially modified HTTP message to an affected
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0256</cvename>
	</references>
	<dates>
	<discovery>2012-03-22</discovery>
	<entry>2012-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="2e7e9072-73a0-11e1-a883-001cc0a36e12">
	<topic>libtasn1 -- ASN.1 length decoding vulnerability</topic>
	<affects>
	<package>
	<name>libtasn1</name>
	<range><lt>2.12</lt></range>
	</package>
	<package>
	<name>gnutls</name>
	<range><lt>2.12.18</lt></range>
	</package>
	<package>
	<name>gnutls-devel</name>
	<range><gt>2.99</gt><lt>3.0.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mu Dynamics, Inc. reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
	<p>Various functions using the ASN.1 length decoding logic in
	Libtasn1 were incorrectly assuming that the return value from
	asn1_get_length_der is always less than the length of the
	enclosing ASN.1 structure, which is only true for valid
	structures and not for intentionally corrupt or otherwise
	buggy structures.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1569</cvename>
	</references>
	<dates>
	<discovery>2012-03-20</discovery>
	<entry>2012-03-21</entry>
	<modified>2012-03-24</modified>
	</dates>
	</vuln>

	<vuln vid="aecee357-739e-11e1-a883-001cc0a36e12">
	<topic>gnutls -- possible overflow/Denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.12.18</lt></range>
	</package>
	<package>
	<name>gnutls-devel</name>
	<range><gt>2.99</gt><lt>3.0.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mu Dynamics, Inc. reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
	<p>The block cipher decryption logic in GnuTLS assumed that a
	record containing any data which was a multiple of the block
	size was valid for further decryption processing, leading to
	a heap corruption vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1573</cvename>
	</references>
	<dates>
	<discovery>2012-03-20</discovery>
	<entry>2012-03-21</entry>
	<modified>2012-03-24</modified>
	</dates>
	</vuln>

	<vuln vid="0d530174-6eef-11e1-afd6-14dae9ebcf89">
	<topic>asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.44</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.23</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.10.1</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="https://www.asterisk.org/security">
	<p>Stack Buffer Overflow in HTTP Manager</p>
	<p>Remote Crash Vulnerability in Milliwatt Application</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2012-002.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2012-003.html</url>
	</references>
	<dates>
	<discovery>2012-03-15</discovery>
	<entry>2012-03-15</entry>
	</dates>
	</vuln>

	<vuln vid="60eb344e-6eb1-11e1-8ad7-00e0815b8da8">
	<topic>OpenSSL -- CMS and S/MIME Bleichenbacher attack</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.0_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL Team reports:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20120312.txt">
	<p>A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
	using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
	also known as the million message attack (MMA).</p>
	<p>Only users of CMS, PKCS #7, or S/MIME decryption operations are
	affected. A successful attack needs on average 2^20 messages. In
	practice only automated systems will be affected as humans will
	not be willing to process this many messages.</p>
	<p>SSL/TLS applications are NOT affected by this problem since
	the SSL/TLS code does not use the PKCS#7 or CMS decryption
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0884</cvename>
	<url>http://www.openssl.org/news/secadv_20120312.txt</url>
	</references>
	<dates>
	<discovery>2012-03-12</discovery>
	<entry>2012-03-15</entry>
	</dates>
	</vuln>

	<vuln vid="29194cb8-6e9f-11e1-8376-f0def16c5c1b">
	<topic>nginx -- potential information leak</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><lt>1.0.14,1</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><lt>1.1.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>nginx development team reports:</p>
	<blockquote cite="http://nginx.net/CHANGES">
	<p>Matthew Daley recently discovered a security problem
	which may lead to a disclosure of previously freed memory
	on specially crafted response from an upstream server,
	potentially resulting in sensitive information leak.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://nginx.net/CHANGES</url>
	</references>
	<dates>
	<discovery>2012-03-15</discovery>
	<entry>2012-03-15</entry>
	</dates>
	</vuln>

	<vuln vid="a1050b8b-6db3-11e1-8b37-0011856a6e37">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>10.0.3,1</lt></range>
	<range><ge>3.6.*,1</ge><lt>3.6.28</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0.3,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.8</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.3</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.8</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>10.0.3</lt></range>
	<range><gt>3.1.*</gt><lt>3.1.20</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.28</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-13 XSS with Drag and Drop and Javascript: URL</p>
	<p>MFSA 2012-14 SVG issues found with Address Sanitizer</p>
	<p>MFSA 2012-15 XSS with multiple Content Security Policy headers</p>
	<p>MFSA 2012-16 Escalation of privilege with Javascript: URL as home page</p>
	<p>MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification</p>
	<p>MFSA 2012-18 window.fullScreen writeable by untrusted content</p>
	<p>MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0451</cvename>
	<cvename>CVE-2012-0455</cvename>
	<cvename>CVE-2012-0456</cvename>
	<cvename>CVE-2012-0457</cvename>
	<cvename>CVE-2012-0458</cvename>
	<cvename>CVE-2012-0459</cvename>
	<cvename>CVE-2012-0460</cvename>
	<cvename>CVE-2012-0461</cvename>
	<cvename>CVE-2012-0462</cvename>
	<cvename>CVE-2012-0463</cvename>
	<cvename>CVE-2012-0464</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-13.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-14.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-15.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-16.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-17.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-18.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-19.html</url>
	</references>
	<dates>
	<discovery>2012-03-13</discovery>
	<entry>2012-03-14</entry>
	<modified>2012-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="6d329b64-6bbb-11e1-9166-001e4f0fb9b1">
	<topic>portaudit -- auditfile remote code execution</topic>
	<affects>
	<package>
	<name>portaudit</name>
	<range><lt>0.6.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Gmelin and Jörg Scheinert has reported a remote
	command execution vulnerability in portaudit.</p>
	<p>An attacker who can get the user to use a specially crafted
	audit file will be able to run commands on the users system,
	with the privileges of the user running running portaudit
	(often root).</p>
	<p>The attack could e.g. happen through DNS hijacking or a man
	in the middle attack.</p>
	<p>Note that if the user has set up portaudit to run from
	periodic this attack could happen without direct user
	interaction.</p>
	<p>In the FreeBSD Ports Collection (bsd.port.mk) the check for
	vulnerable ports at install-time directly operates on the
	auditfile and has the same vulnerability as portaudit. As
	the Ports Collection infrastructure does not have a version
	number just be sure to have a Ports Collection new enough to
	contain the fix for portaudit. Note that this is <em>only</em>
	a problem for users which has portaudit installed, as they will
	not have the audit database installed or downloaded
	otherwise.</p>
	</body>
	</description>
	<references>
	<url>http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30</url>
	<url>http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707</url>
	</references>
	<dates>
	<discovery>2012-03-11</discovery>
	<entry>2012-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="9da3834b-6a50-11e1-91af-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.1r102.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-05.html">
	<p>These vulnerabilities could cause a crash and potentially allow
	an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0768</cvename>
	<cvename>CVE-2012-0769</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb12-05.html</url>
	</references>
	<dates>
	<discovery>2012-03-05</discovery>
	<entry>2012-03-09</entry>
	</dates>
	</vuln>

	<vuln vid="9448a82f-6878-11e1-865f-00e0814cab4e">
	<topic>jenkins -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>jenkins</name>
	<range><lt>1.453</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory reports:</p>
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05">
	<p>An XSS vulnerability was found in Jenkins core, which allows an
	attacker to inject malicious HTMLs to pages served by Jenkins.
	This allows an attacker to escalate his privileges by hijacking
	sessions of other users. This vulnerability affects all
	versions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05</url>
	</references>
	<dates>
	<discovery>2012-03-05</discovery>
	<entry>2012-03-07</entry>
	</dates>
	</vuln>

	<vuln vid="eba70db4-6640-11e1-98af-00262d8b701d">
	<topic>dropbear -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>dropbear</name>
	<range><ge>0.51</ge><lt>2012.55</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Dropbear project reports:</p>
	<blockquote cite="http://xforce.iss.net/xforce/xfdb/73444">
	<p>Dropbear SSH Server could allow a remote authenticated attacker
	to execute arbitrary code on the system, caused by a use-after-
	free error. If a command restriction is enforced, an attacker
	could exploit this vulnerability to execute arbitrary code on
	the system with root privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>52159</bid>
	<cvename>CVE-2012-0920</cvename>
	<url>http://secunia.com/advisories/48147</url>
	<url>http://xforce.iss.net/xforce/xfdb/73444</url>
	</references>
	<dates>
	<discovery>2012-02-22</discovery>
	<entry>2012-03-04</entry>
	</dates>
	</vuln>

	<vuln vid="46aeba13-64a1-11e1-bc16-0023ae8e59f0">
	<topic>openx -- undisclosed security issue</topic>
	<affects>
	<package>
	<name>openx</name>
	<range><lt>2.8.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenX does not provide information about vulnerabilities beyond their
	existence.</p>
	</body>
	</description>
	<references>
	<url>http://blog.openx.org/12/security-matters-3</url>
	</references>
	<dates>
	<discovery>2011-12-01</discovery>
	<entry>2012-03-02</entry>
	<modified>2012-07-08</modified>
	</dates>
	</vuln>

	<vuln vid="174b8864-6237-11e1-be18-14dae938ec40">
	<topic>databases/postgresql*-client -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql-client</name>
	<range><lt>8.3.18</lt></range>
	<range><ge>8.4</ge><lt>8.4.11</lt></range>
	<range><ge>9</ge><lt>9.0.7</lt></range>
	<range><ge>9.1</ge><lt>9.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL Global Development Group reports:</p>
	<blockquote cite="http://www.postgresql.org/about/news/1377/">
	<p>These vulnerabilities could allow users to define triggers that
	execute functions on which the user does not have EXECUTE
	permission, allow SSL certificate spoofing and allow line breaks
	in object names to be exploited to execute code when loading a
	pg_dump file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0866</cvename>
	<cvename>CVE-2012-0867</cvename>
	<cvename>CVE-2012-0868</cvename>
	<url>http://www.postgresql.org/about/news/1377/</url>
	</references>
	<dates>
	<discovery>2012-02-27</discovery>
	<entry>2012-02-28</entry>
	</dates>
	</vuln>

	<vuln vid="f63bf080-619d-11e1-91af-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.1r102.62</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-03.html">
	<p>These vulnerabilities could cause a crash and potentially allow
	an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0751</cvename>
	<cvename>CVE-2012-0752</cvename>
	<cvename>CVE-2012-0753</cvename>
	<cvename>CVE-2012-0754</cvename>
	<cvename>CVE-2012-0755</cvename>
	<cvename>CVE-2012-0756</cvename>
	<cvename>CVE-2012-0767</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb12-03.html</url>
	</references>
	<dates>
	<discovery>2012-02-15</discovery>
	<entry>2012-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="57f1a624-6197-11e1-b98c-bcaec565249c">
	<topic>libxml2 -- heap buffer overflow</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<name>linux-f10-libxml2</name>
	<range><lt>2.7.8_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Google chrome team reports:</p>
	<blockquote cite="http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html">
	<p>Heap-based buffer overflow in libxml2, allows remote attackers
	to cause a denial of service or possibly have unspecified other
	impact via unknown vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3919</cvename>
	<url>http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html</url>
	</references>
	<dates>
	<discovery>2012-01-05</discovery>
	<entry>2012-02-27</entry>
	</dates>
	</vuln>

	<vuln vid="ba51c2f7-5b43-11e1-8288-00262d5ed8ee">
	<topic>plib -- remote code execution via buffer overflow</topic>
	<affects>
	<package>
	<name>torcs</name>
	<range><lt>1.3.3</lt></range>
	</package>
	<package>
	<name>plib</name>
	<range><le>1.8.5_3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/47297/">
	<p>A vulnerability has been discovered in PLIB, which can be
	exploited by malicious people to compromise an application using
	the library.</p>
	<p>The vulnerability is caused due to a boundary error within the
	"ulSetError()" function (src/util/ulError.cxx) when creating the
	error message, which can be exploited to overflow a static
	buffer.</p>
	<p>Successful exploitation allows the execution of arbitrary code
	but requires that the attacker can e.g. control the content of
	an overly long error message passed to the "ulSetError()"
	function.</p>
	<p>The vulnerability is confirmed in version 1.8.5. Other versions
	may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4620</cvename>
	<url>http://secunia.com/advisories/47297/</url>
	<url>http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79</url>
	</references>
	<dates>
	<discovery>2011-12-21</discovery>
	<entry>2012-02-19</entry>
	</dates>
	</vuln>

	<vuln vid="fdd1c316-5a3d-11e1-8d3e-e0cb4e266481">
	<topic>phpMyAdmin -- XSS in replication setup</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.10.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php">
	<p>It was possible to conduct XSS using a crafted database name.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-1190</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php</url>
	</references>
	<dates>
	<discovery>2012-02-18</discovery>
	<entry>2012-02-18</entry>
	</dates>
	</vuln>

	<vuln vid="da317bc9-59a6-11e1-bc16-0023ae8e59f0">
	<topic>piwik -- xss and click-jacking issues</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><lt>1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Piwik Team reports:</p>
	<blockquote cite="http://piwik.org/blog/2012/02/7775/">
	<p>We would like to thank the following security researchers for
	their responsible disclosure of XSS and click-jacking issues:
	Piotr Duszynski, Sergey Markov, Mauro Gentile.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>"http://piwik.org/blog/2012/02/7775/"</url>
	</references>
	<dates>
	<discovery>2012-02-16</discovery>
	<entry>2012-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="d7dbd2db-599c-11e1-a2fb-14dae9ebcf89">
	<topic>mozilla -- heap-buffer overflow</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
	<range><ge>3.6.*,1</ge><lt>3.6.27</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.2</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.2</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.2</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.2</lt></range>
	<range><gt>3.1.*</gt><lt>3.1.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-11 libpng integer overflow</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3026</cvename>
	<url>https://www.mozilla.org/security/announce/2012/mfsa2012-11.html</url>
	</references>
	<dates>
	<discovery>2012-02-16</discovery>
	<entry>2012-02-17</entry>
	<modified>2012-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="b4f8be9e-56b2-11e1-9fb7-003067b2972c">
	<topic>Python -- DoS via malformed XML-RPC / HTTP POST request</topic>
	<affects>
	<package>
	<name>python32</name>
	<range><le>3.2.2_2</le></range>
	</package>
	<package>
	<name>python31</name>
	<range><le>3.1.4_2</le></range>
	</package>
	<package>
	<name>python27</name>
	<range><le>2.7.2_3</le></range>
	</package>
	<package>
	<name>python26</name>
	<range><le>2.6.7_2</le></range>
	</package>
	<package>
	<name>python25</name>
	<range><le>2.5.6_2</le></range>
	</package>
	<package>
	<name>python24</name>
	<range><le>2.4.5_8</le></range>
	</package>
	<package>
	<name>pypy</name>
	<!-- note that it also affects 1.8 but we do not yet have
	this version in ports. -->
	<range><le>1.7</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Lieskovsky reports,</p>
	<blockquote cite="http://bugs.python.org/issue14001">
	<p>A denial of service flaw was found in the way Simple XML-RPC
	Server module of Python processed client connections, that were
	closed prior the complete request body has been received. A
	remote attacker could use this flaw to cause Python Simple
	XML-RPC based server process to consume excessive amount of
	CPU.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0845</cvename>
	<url>http://bugs.python.org/issue14001</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=789790</url>
	<url>https://bugs.pypy.org/issue1047</url>
	</references>
	<dates>
	<discovery>2012-02-13</discovery>
	<entry>2012-02-14</entry>
	<modified>2012-02-26</modified>
	</dates>
	</vuln>

	<vuln vid="2b20fd5f-552e-11e1-9fb7-003067b2972c">
	<topic>WebCalendar -- Persistent XSS</topic>
	<affects>
	<package>
	<name>WebCalendar</name>
	<range><le>1.2.4</le></range>
	</package>
	<package>
	<name>WebCalendar-devel</name>
	<range><le>1.2.4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>tom reports,</p>
	<blockquote cite="http://seclists.org/bugtraq/2012/Jan/128">
	<p>There is no sanitation on the input of the location variable
	allowing for persistent XSS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0846</cvename>
	<url>http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870</url>
	</references>
	<dates>
	<discovery>2012-01-11</discovery>
	<entry>2012-02-12</entry>
	<modified>2012-02-13</modified>
	</dates>
	</vuln>

	<vuln vid="eba9aa94-549c-11e1-b6b7-0011856a6e37">
	<topic>mozilla -- use-after-free in nsXBLDocumentInfo::ReadPrototypeBindings</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0452</cvename>
	<url>https://www.mozilla.org/security/announce/2012/mfsa2012-10.html</url>
	</references>
	<dates>
	<discovery>2012-02-10</discovery>
	<entry>2012-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="1c4cab30-5468-11e1-9fb7-003067b2972c">
	<topic>bip -- buffer overflow</topic>
	<affects>
	<package>
	<name>bip</name>
	<range><le>0.8.8</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Julien Tinnes reports,</p>
	<blockquote cite="https://projects.duckcorp.org/issues/269">
	<p>Bip doesn't check if fd is equal or larger than FD_SETSIZE.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0806</cvename>
	<url>https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c</url>
	<url>https://projects.duckcorp.org/issues/269</url>
	</references>
	<dates>
	<discovery>2012-01-07</discovery>
	<entry>2012-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="039d057e-544e-11e1-9fb7-003067b2972c">
	<topic>surf -- private information disclosure</topic>
	<affects>
	<package>
	<name>surf</name>
	<range><le>0.4.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>surf does not protect its cookie jar against access read access from
	other local users</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0842</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296</url>
	</references>
	<dates>
	<discovery>2012-02-10</discovery>
	<entry>2012-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="7c769c89-53c2-11e1-8e52-00163e22ef61">
	<topic>glpi -- remote attack via crafted POST request</topic>
	<affects>
	<package>
	<name>glpi</name>
	<range><lt>0.80.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GLPI project reports:</p>
	<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en">
	<p>The autocompletion functionality in GLPI before 0.80.2 does not
	blacklist certain username and password fields, which allows
	remote attackers to obtain sensitive information via a crafted
	POST request.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en</url>
	<url>https://forge.indepnet.net/issues/3017</url>
	<cvename>CVE-2011-2720</cvename>
	</references>
	<dates>
	<discovery>2011-07-20</discovery>
	<entry>2012-02-10</entry>
	<modified>2013-06-19</modified>
	</dates>
	</vuln>

	<vuln vid="10720fe8-51e0-11e1-91c1-00215c6a37bb">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.23</lt></range>
	</package>
	<package>
	<name>drupal7</name>
	<range><lt>7.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal development team reports:</p>
	<blockquote cite="http://drupal.org/node/1425084">
	<h3>Cross Site Request Forgery vulnerability in Aggregator
	module</h3>
	<p>CVE: CVE-2012-0826</p>
	<p>An XSRF vulnerability can force an aggregator feed to update.
	Since some services are rate-limited (e.g. Twitter limits
	requests to 150 per hour) this could lead to a denial of
	service.</p>
	<p>This issue affects Drupal 6.x and 7.x.</p>
	<h3>OpenID not verifying signed attributes in SREG and AX</h3>
	<p>CVE: CVE-2012-0825</p>
	<p>A group of security researchers identified a flaw in how some
	OpenID relying parties implement Attribute Exchange (AX). Not
	verifying that attributes being passed through AX have been
	signed could allow an attacker to modify users' information.</p>
	<p>This issue affects Drupal 6.x and 7.x.</p>
	<h3>Access bypass in File module</h3>
	<p>CVE: CVE-2012-0827</p>
	<p>When using private files in combination with certain field
	access modules, the File module will allow users to download
	the file even if they do not have access to view the field it
	was attached to.</p>
	<p>This issue affects Drupal 7.x only.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0825</cvename>
	<cvename>CVE-2012-0826</cvename>
	<cvename>CVE-2012-0827</cvename>
	</references>
	<dates>
	<discovery>2012-02-01</discovery>
	<entry>2012-02-07</entry>
	</dates>
	</vuln>

	<vuln vid="309542b5-50b9-11e1-b0d8-00151735203a">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>2.4.*</ge><lt>3.6.8</lt></range>
	<range><ge>4.0.*</ge><lt>4.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
	<p>The following security issues have been discovered in
	Bugzilla:</p>
	<ul>
	<li>Account Impersonation:
	When a user creates a new account, Bugzilla doesn't correctly
	reject email addresses containing non-ASCII characters, which
	could be used to impersonate another user account. Such email
	addresses could look visually identical to other valid email
	addresses, and an attacker could try to confuse other users
	and be added to bugs he shouldn't have access to.</li>
	<li>Cross-Site Request Forgery:
	Due to a lack of validation of the Content-Type head when
	making POST requests to jsonrpc.cgi, a possible CSRF
	vulnerability was discovered. If a user visits an HTML page
	with some malicious JS code in it, an attacker could make
	changes to a remote Bugzilla installation on behalf of the
	victim's account by using the JSON-RPC API. The user would
	have had to be already logged in to the target site for the
	vulnerability to work.</li>
	</ul>
	<p>All affected installations are encouraged to upgrade as soon as
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0448</cvename>
	<cvename>CVE-2012-0440</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=714472</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=718319</url>
	</references>
	<dates>
	<discovery>2012-01-31</discovery>
	<entry>2012-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="3fd040be-4f0b-11e1-9e32-0025900931f8">
	<topic>php -- arbitrary remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><ge>5.3.9</ge><lt>5.3.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/47806/">
	<p>A vulnerability has been reported in PHP, which can be exploited
	by malicious people to compromise a vulnerable system.</p>
	<p>The vulnerability is caused due to a logic error within the
	"php_register_variable_ex()" function (php_variables.c) when
	hashing form posts and updating a hash table, which can be
	exploited to execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0830</cvename>
	<url>http://www.php.net/archive/2012.php#id2012-02-02-1</url>
	<url>http://secunia.com/advisories/47806/</url>
	</references>
	<dates>
	<discovery>2012-02-02</discovery>
	<entry>2012-02-04</entry>
	<modified>2012-02-06</modified>
	</dates>
	</vuln>

	<vuln vid="6e7ad1d7-4e27-11e1-8e12-90e6ba8a36a2">
	<topic>mathopd -- directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>mathopd</name>
	<range><lt>1.5p7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michiel Boland reports:</p>
	<blockquote cite="http://www.mathopd.org/security.html">
	<p>The software has a vulnerability that could lead to directory
	traversal if the '*' construct for mass virtual hosting is
	used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<mlist msgid="4F2AFEF2.5040708@boland.org">http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html</mlist>
	<url>http://www.mathopd.org/security.html</url>
	</references>
	<dates>
	<discovery>2012-02-02</discovery>
	<entry>2012-02-03</entry>
	</dates>
	</vuln>

	<vuln vid="4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0">
	<topic>apache -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><gt>2.*</gt><lt>2.2.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE MITRE reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
	<p>An exposure was found when using mod_proxy in reverse proxy
	mode. In certain configurations using RewriteRule with proxy
	flag or ProxyPassMatch, a remote attacker could cause the reverse
	proxy to connect to an arbitrary server, possibly disclosing
	sensitive information from internal web servers not directly
	accessible to attacker.</p>
	<p>Integer overflow in the ap_pregsub function in server/util.c in
	the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through
	2.2.21, when the mod_setenvif module is enabled, allows local
	users to gain privileges via a .htaccess file with a crafted
	SetEnvIf directive, in conjunction with a crafted HTTP request
	header, leading to a heap-based buffer overflow.</p>
	<p>An additional exposure was found when using mod_proxy in
	reverse proxy mode. In certain configurations using RewriteRule
	with proxy flag or ProxyPassMatch, a remote attacker could cause
	the reverse proxy to connect to an arbitrary server, possibly
	disclosing sensitive information from internal web servers
	not directly accessible to attacker.</p>
	<p>A flaw was found in mod_log_config. If the '%{cookiename}C' log
	format string is in use, a remote attacker could send a specific
	cookie causing a crash. This crash would only be a denial of
	service if using a threaded MPM.</p>
	<p>A flaw was found in the handling of the scoreboard. An
	unprivileged child process could cause the parent process to
	crash at shutdown rather than terminate cleanly.</p>
	<p>A flaw was found in the default error response for status code
	400. This flaw could be used by an attacker to expose
	"httpOnly" cookies when no custom ErrorDocument is specified.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3368</cvename>
	<cvename>CVE-2011-3607</cvename>
	<cvename>CVE-2011-4317</cvename>
	<cvename>CVE-2012-0021</cvename>
	<cvename>CVE-2012-0031</cvename>
	<cvename>CVE-2012-0053</cvename>
	</references>
	<dates>
	<discovery>2011-10-05</discovery>
	<entry>2012-01-31</entry>
	</dates>
	</vuln>

	<vuln vid="0a9e2b72-4cb7-11e1-9146-14dae9ebcf89">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>10.0,1</lt></range>
	<range><ge>3.6.*,1</ge><lt>3.6.26</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>10.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.7</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>10.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.7</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>10.0</lt></range>
	<range><gt>3.1.*</gt><lt>3.1.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/
	rv:1.9.2.26)</p>
	<p>MFSA 2012-02 Overly permissive IPv6 literal syntax</p>
	<p>MFSA 2012-03 iframe element exposed across domains via name
	attribute</p>
	<p>MFSA 2012-04 Child nodes from nsDOMAttribute still accessible
	after removal of nodes</p>
	<p>MFSA 2012-05 Frame scripts calling into untrusted objects bypass
	security checks</p>
	<p>MFSA 2012-06 Uninitialized memory appended when encoding icon
	images may cause information disclosure</p>
	<p>MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis
	files</p>
	<p>MFSA 2012-08 Crash with malformed embedded XSLT stylesheets</p>
	<p>MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe
	permission</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0442</cvename>
	<cvename>CVE-2012-0443</cvename>
	<cvename>CVE-2011-3670</cvename>
	<cvename>CVE-2012-0445</cvename>
	<cvename>CVE-2011-3659</cvename>
	<cvename>CVE-2012-0446</cvename>
	<cvename>CVE-2012-0447</cvename>
	<cvename>CVE-2012-0449</cvename>
	<cvename>CVE-2012-0450</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-01.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-02.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-03.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-04.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-05.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-06.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-07.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-08.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-09.html</url>
	</references>
	<dates>
	<discovery>2012-01-31</discovery>
	<entry>2012-02-01</entry>
	<modified>2012-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="7c920bb7-4b5f-11e1-9f47-00e0815b8da8">
	<topic>sudo -- format string vulnerability</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><ge>1.8.0</ge><lt>1.8.3_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.gratisoft.us/sudo/alerts/sudo_debug.html">
	<p>Sudo 1.8.0 introduced simple debugging support that was primarily
	intended for use when developing policy or I/O logging plugins.
	The sudo_debug() function contains a flaw where the program name
	is used as part of the format string passed to the fprintf()
	function. The program name can be controlled by the caller,
	either via a symbolic link or, on some systems, by setting argv[0]
	when executing sudo.</p>
	<p>Using standard format string vulnerability exploitation
	techniques it is possible to leverage this bug to achieve root
	privileges.</p>
	<p>Exploitation of the bug does not require that the attacker be
	listed in the sudoers file. As such, we strongly suggest that
	affected sites upgrade from affected sudo versions as soon as
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0809</cvename>
	<url>http://www.gratisoft.us/sudo/alerts/sudo_debug.html</url>
	</references>
	<dates>
	<discovery>2012-01-30</discovery>
	<entry>2012-01-30</entry>
	<modified>2012-01-31</modified>
	</dates>
	</vuln>

	<vuln vid="e51d5b1a-4638-11e1-9f47-00e0815b8da8">
	<topic>FreeBSD -- pam_ssh() does not validate service names</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc">
	<h1>Problem Description:</h1>
	<p>Some third-party applications, including KDE's kcheckpass command,
	allow the user to specify the name of the policy on the command
	line. Since OpenPAM treats the policy name as a path relative to
	/etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run
	such an application can craft their own policies and cause the
	application to load and execute their own modules.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:10.pam</freebsdsa>
	<cvename>CVE-2011-4122</cvename>
	</references>
	<dates>
	<discovery>2011-12-23</discovery>
	<entry>2012-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="eda151d8-4638-11e1-9f47-00e0815b8da8">
	<topic>FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc">
	<h1>Problem Description:</h1>
	<p>The OpenSSL library call used to decrypt private keys ignores the
	passphrase argument if the key is not encrypted. Because the
	pam_ssh module only checks whether the passphrase provided by the
	user is null, users with unencrypted SSH private keys may
	successfully authenticate themselves by providing a dummy
	passphrase.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:09.pam_ssh</freebsdsa>
	</references>
	<dates>
	<discovery>2011-12-23</discovery>
	<entry>2012-01-29</entry>
	<modified>2013-06-18</modified>
	</dates>
	</vuln>

	<vuln vid="f56390a4-4638-11e1-9f47-00e0815b8da8">
	<topic>FreeBSD -- Buffer overflow in handling of UNIX socket addresses</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_8</lt></range>
	<range><ge>7.4</ge><lt>7.4_4</lt></range>
	<range><ge>8.1</ge><lt>8.1_6</lt></range>
	<range><ge>8.2</ge><lt>8.2_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc">
	<h1>Problem Description:</h1>
	<p>When a UNIX-domain socket is attached to a location using the
	bind(2) system call, the length of the provided path is not
	validated. Later, when this address was returned via other system
	calls, it is copied into a fixed-length buffer.</p>
	<p>Linux uses a larger socket address structure for UNIX-domain
	sockets than FreeBSD, and the FreeBSD's linux emulation code did
	not translate UNIX-domain socket addresses into the correct size
	of structure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:05.unix</freebsdsa>
	</references>
	<dates>
	<discovery>2011-09-28</discovery>
	<entry>2012-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="fee94342-4638-11e1-9f47-00e0815b8da8">
	<topic>FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_7</lt></range>
	<range><ge>7.4</ge><lt>7.4_3</lt></range>
	<range><ge>8.1</ge><lt>8.1_5</lt></range>
	<range><ge>8.2</ge><lt>8.2_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc">
	<h1>Problem Description:</h1>
	<p>The code used to decompress a file created by compress(1) does not
	do sufficient boundary checks on compressed code words, allowing
	reference beyond the decompression table, which may result in a
	stack overflow or an infinite loop when the decompressor encounters
	a corrupted file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:04.compress</freebsdsa>
	<cvename>CVE-2011-2895</cvename>
	</references>
	<dates>
	<discovery>2011-09-28</discovery>
	<entry>2012-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="87261557-a450-11e2-9898-001060e06fd4">
	<topic>FreeBSD -- Network ACL mishandling in mountd(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_5</lt></range>
	<range><ge>7.4</ge><lt>7.4_1</lt></range>
	<range><ge>8.1</ge><lt>8.1_3</lt></range>
	<range><ge>8.2</ge><lt>8.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc">
	<h1>Problem Description:</h1>
	<p>While parsing the exports(5) table, a network mask in the form of
	"-network=netname/prefixlength" results in an incorrect network mask
	being computed if the prefix length is not a multiple of 8.</p>
	<p>For example, specifying the ACL for an export as "-network
	192.0.2.0/23" would result in a netmask of 255.255.127.0 being used
	instead of the correct netmask of 255.255.254.0.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:01.mountd</freebsdsa>
	<cvename>CVE-2011-1739</cvename>
	</references>
	<dates>
	<discovery>2011-04-20</discovery>
	<entry>2012-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="93688f8f-4935-11e1-89b4-001ec9578670">
	<topic>postfixadmin -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>postfixadmin</name>
	<range><lt>2.3.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Postfix Admin Team reports:</p>
	<blockquote cite="http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778">
	<p>Multiple XSS vulnerabilities exist:<br/>
	- XSS with $_GET[domain] in templates/menu.php and
	edit-vacation<br/>
	- XSS in some create-domain input fields<br/>
	- XSS in create-alias and edit-alias error message<br/>
	- XSS (by values stored in the database) in fetchmail list
	view, list-domain and list-virtual</p>
	<p>Multiple SQL injection issues exist:<br/>
	- SQL injection in pacrypt() (if $CONF[encrypt] ==
	'mysql_encrypt')<br/>
	- SQL injection in backup.php - the dump was not mysql_escape()d,
	therefore users could inject SQL (for example in the vacation message)
	which will be executed when restoring the database dump.
	WARNING: database dumps created with backup.php from 2.3.4 or older
	might contain malicious SQL. Double-check before using them!</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0811</cvename>
	<cvename>CVE-2012-0812</cvename>
	<url>http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778</url>
	</references>
	<dates>
	<discovery>2012-01-27</discovery>
	<entry>2012-01-27</entry>
	</dates>
	</vuln>

	<vuln vid="e465159c-4817-11e1-89b4-001ec9578670">
	<topic>mpack -- Information disclosure</topic>
	<affects>
	<package>
	<name>mpack</name>
	<range><lt>1.6_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The oss-security list reports:</p>
	<blockquote cite="http://openwall.com/lists/oss-security/2011/12/31/1">
	<p>Incorrect permissions on temporary files can lead to
	information disclosure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4919</cvename>
	<url>http://openwall.com/lists/oss-security/2011/12/31/1</url>
	</references>
	<dates>
	<discovery>2011-12-31</discovery>
	<entry>2012-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="fa2f386f-4814-11e1-89b4-001ec9578670">
	<topic>acroread9 -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>acroread9</name>
	<range><lt>9.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Adobe Security Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-04.html">
	<p>An unspecified vulnerability in the U3D component allows
	remote attackers to execute arbitrary code (or cause a denial
	of service attack) via unknown vectors.</p>
	</blockquote>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-24.html">
	<p>A heap-based buffer overflow allows attackers to execute
	arbitrary code via unspecified vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2462</cvename>
	<cvename>CVE-2011-1353</cvename>
	<cvename>CVE-2011-2431</cvename>
	<cvename>CVE-2011-2432</cvename>
	<cvename>CVE-2011-2433</cvename>
	<cvename>CVE-2011-2434</cvename>
	<cvename>CVE-2011-2435</cvename>
	<cvename>CVE-2011-2436</cvename>
	<cvename>CVE-2011-2437</cvename>
	<cvename>CVE-2011-2438</cvename>
	<cvename>CVE-2011-2439</cvename>
	<cvename>CVE-2011-2440</cvename>
	<cvename>CVE-2011-2441</cvename>
	<cvename>CVE-2011-2442</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb11-24.html</url>
	<url>http://www.adobe.com/support/security/advisories/apsa11-04.html</url>
	</references>
	<dates>
	<discovery>2011-12-07</discovery>
	<entry>2012-01-26</entry>
	</dates>
	</vuln>

	<vuln vid="3ebb2dc8-4609-11e1-9f47-00e0815b8da8">
	<topic>Wireshark -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
	</package>
	<package>
	<name>tshark</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark reports:</p>
	<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.6.5.html">
	<p>Laurent Butti discovered that Wireshark failed to properly check
	record sizes for many packet capture file formats</p>
	<p>Wireshark could dereference a NULL pointer and crash.</p>
	<p>The RLC dissector could overflow a buffer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0041</cvename>
	<cvename>CVE-2012-0066</cvename>
	<cvename>CVE-2012-0067</cvename>
	<cvename>CVE-2012-0068</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-01.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-02.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2012-03.html</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634</url>
	<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391</url>
	</references>
	<dates>
	<discovery>2010-01-10</discovery>
	<entry>2012-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="7d2336c2-4607-11e1-9f47-00e0815b8da8">
	<topic>spamdyke -- Buffer Overflow Vulnerabilities</topic>
	<affects>
	<package>
	<name>spamdyke</name>
	<range><lt>4.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
	<p>Fixed a number of very serious errors in the usage of
	snprintf()/vsnprintf().</p>
	<p>The return value was being used as the length of the string
	printed into the buffer, but the return value really indicates
	the length of the string that could be printed if the buffer
	were of infinite size. Because the returned value could be
	larger than the buffer's size, this meant remotely exploitable
	buffer overflows were possible, depending on spamdyke's
	configuration.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0802</cvename>
	<url>https://secunia.com/advisories/47548/</url>
	<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
	</references>
	<dates>
	<discovery>2012-01-15</discovery>
	<entry>2012-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="5c5f19ce-43af-11e1-89b4-001ec9578670">
	<topic>OpenSSL -- DTLS Denial of Service</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.0_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL Team reports:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20120118.txt">
	<p>A flaw in the fix to CVE-2011-4108 can be exploited in a
	denial of service attack. Only DTLS applications using OpenSSL
	1.0.0f and 0.9.8s are affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0050</cvename>
	<url>http://www.openssl.org/news/secadv_20120118.txt</url>
	</references>
	<dates>
	<discovery>2012-01-18</discovery>
	<entry>2012-01-20</entry>
	</dates>
	</vuln>

	<vuln vid="dd698b76-42f7-11e1-a1b6-14dae9ebcf89">
	<topic>asterisk -- SRTP Video Remote Crash Vulnerability</topic>
	<affects>
	<package>
	<name>asterisk18</name>
	<range><lt>1.8.8.2</lt></range>
	</package>
	<package>
	<name>asterisk10</name>
	<range><lt>10.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2012-001.html">
	<p>An attacker attempting to negotiate a secure video stream can
	crash Asterisk if video support has not been enabled and the
	res_srtp Asterisk module is loaded.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2012-001.html</url>
	</references>
	<dates>
	<discovery>2012-01-15</discovery>
	<entry>2012-01-20</entry>
	<modified>2013-06-19</modified>
	</dates>
	</vuln>

	<vuln vid="7f5ccb1d-439b-11e1-bc16-0023ae8e59f0">
	<topic>tomcat -- Denial of Service</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.35</lt></range>
	</package>
	<package>
	<name>tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.34</lt></range>
	</package>
	<package>
	<name>tomcat</name>
	<range><gt>7.0.0</gt><lt>7.0.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tomcat security team reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35">
	<p>Analysis of the recent hash collision vulnerability identified
	unrelated inefficiencies with Apache Tomcat's handling of large
	numbers of parameters and parameter values. These inefficiencies
	could allow an attacker, via a specially crafted request, to
	cause large amounts of CPU to be used which in turn could create
	a denial of service. The issue was addressed by modifying the
	Tomcat parameter handling code to efficiently process large
	numbers of parameters and parameter values.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0022</cvename>
	<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35</url>
	<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34</url>
	<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23</url>
	</references>
	<dates>
	<discovery>2011-10-21</discovery>
	<entry>2012-01-17</entry>
	</dates>
	</vuln>

	<vuln vid="1ac858b0-3fae-11e1-a127-0013d3ccd9df">
	<topic>OpenTTD -- Denial of service (server) via slow read attack</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>0.3.5</ge><lt>1.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://security.openttd.org/en/CVE-2012-0049">
	<p>Using a slow read type attack it is possible to prevent anyone
	from joining a server with virtually no resources. Once
	downloading the map no other downloads of the map can start, so
	downloading really slowly will prevent others from joining.
	This can be further aggravated by the pause-on-join setting in
	which case the game is paused and the players cannot continue
	the game during such an attack. This attack requires that the
	user is not banned and passes the authorization to the server,
	although for many servers there is no server password and thus
	authorization is easy.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0049</cvename>
	<url>http://security.openttd.org/en/CVE-2012-0049</url>
	</references>
	<dates>
	<discovery>2012-01-06</discovery>
	<entry>2012-01-16</entry>
	</dates>
	</vuln>

	<vuln vid="91be81e7-3fea-11e1-afc7-2c4138874f7d">
	<topic>Multiple implementations -- DoS via hash algorithm collision</topic>
	<affects>
	<package>
	<name>jruby</name>
	<range><lt>1.6.5.1</lt></range>
	</package>
	<package>
	<name>ruby</name>
	<name>ruby+nopthreads</name>
	<name>ruby+nopthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><lt>1.8.7.357,1</lt></range>
	</package>
	<package>
	<name>rubygem-rack</name>
	<range><lt>1.3.6,3</lt></range>
	</package>
	<package>
	<name>v8</name>
	<range><lt>3.8.5</lt></range>
	</package>
	<package>
	<name>redis</name>
	<range><le>2.4.6</le></range>
	</package>
	<package>
	<name>node</name>
	<range><lt>0.6.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2011-003.html">
	<p>A variety of programming languages suffer from a denial-of-service
	(DoS) condition against storage functions of key/value pairs in
	hash data structures, the condition can be leveraged by exploiting
	predictable collisions in the underlying hashing algorithms.</p>
	<p>The issue finds particular exposure in web server applications
	and/or frameworks. In particular, the lack of sufficient limits
	for the number of parameters in POST requests in conjunction with
	the predictable collision properties in the hashing functions of
	the underlying languages can render web applications vulnerable
	to the DoS condition. The attacker, using specially crafted HTTP
	requests, can lead to a 100% of CPU usage which can last up to
	several hours depending on the targeted application and server
	performance, the amplification effect is considerable and
	requires little bandwidth and time on the attacker side.</p>
	<p>The condition for predictable collisions in the hashing functions
	has been reported for the following language implementations:
	Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the
	Ruby language, the 1.9.x branch is not affected by the
	predictable collision condition since this version includes a
	randomization of the hashing function.</p>
	<p>The vulnerability outlined in this advisory is practically
	identical to the one reported in 2003 and described in the paper
	Denial of Service via Algorithmic Complexity Attacks which
	affected the Perl language.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4838</cvename>
	<cvename>CVE-2011-4815</cvename>
	<cvename>CVE-2011-5036</cvename>
	<cvename>CVE-2011-5037</cvename>
	<url>http://www.ocert.org/advisories/ocert-2011-003.html</url>
	<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
	</references>
	<dates>
	<discovery>2011-12-28</discovery>
	<entry>2012-01-16</entry>
	<modified>2012-01-20</modified>
	</dates>
	</vuln>

	<vuln vid="ea2ddc49-3e8e-11e1-8095-5404a67eef98">
	<topic>ffmpeg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range><lt>0.7.11,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ubuntu Security Notice USN-1320-1 reports:</p>
	<blockquote cite="http://www.ubuntu.com/usn/usn-1320-1">
	<p>Phillip Langlois discovered that FFmpeg incorrectly handled
	certain malformed QDM2 streams. If a user were tricked into opening
	a crafted QDM2 stream file, an attacker could cause a denial of
	service via application crash, or possibly execute arbitrary code
	with the privileges of the user invoking the program.
	(CVE-2011-4351)</p>
	<p>Phillip Langlois discovered that FFmpeg incorrectly handled
	certain malformed VP3 streams. If a user were tricked into opening
	a crafted file, an attacker could cause a denial of service via
	application crash, or possibly execute arbitrary code with the
	privileges of the user invoking the program. (CVE-2011-4352)</p>
	<p>Phillip Langlois discovered that FFmpeg incorrectly handled
	certain malformed VP5 and VP6 streams. If a user were tricked into
	opening a crafted file, an attacker could cause a denial of service
	via application crash, or possibly execute arbitrary code with the
	privileges of the user invoking the program. (CVE-2011-4353)</p>
	<p>It was discovered that FFmpeg incorrectly handled certain
	malformed VMD files. If a user were tricked into opening a crafted
	VMD file, an attacker could cause a denial of service via
	application crash, or possibly execute arbitrary code with the
	privileges of the user invoking the program. (CVE-2011-4364)</p>
	<p>Phillip Langlois discovered that FFmpeg incorrectly handled
	certain malformed SVQ1 streams. If a user were tricked into opening
	a crafted SVQ1 stream file, an attacker could cause a denial of
	service via application crash, or possibly execute arbitrary code
	with the privileges of the user invoking the program.
	(CVE-2011-4579)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4351</cvename>
	<cvename>CVE-2011-4352</cvename>
	<cvename>CVE-2011-4353</cvename>
	<cvename>CVE-2011-4364</cvename>
	<cvename>CVE-2011-4579</cvename>
	<url>http://www.ubuntu.com/usn/usn-1320-1</url>
	</references>
	<dates>
	<discovery>2011-09-14</discovery>
	<entry>2012-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="78cc8a46-3e56-11e1-89b4-001ec9578670">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.0_8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL Team reports:</p>
	<blockquote cite="http://openssl.org/news/secadv_20120104.txt">
	<p>6 security flaws have been fixed in OpenSSL 1.0.0f:</p>
	<p>If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8,
	then a policy check failure can lead to a double-free.</p>
	<p>OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the
	bytes used as block cipher padding in SSL 3.0 records.
	As a result, in each record, up to 15 bytes of
	uninitialized memory may be sent, encrypted, to the SSL
	peer. This could include sensitive contents of
	previously freed memory.</p>
	<p>RFC 3779 data can be included in certificates, and if
	it is malformed, may trigger an assertion failure.
	This could be used in a denial-of-service attack.</p>
	<p>Support for handshake restarts for server gated
	cryptograpy (SGC) can be used in a denial-of-service
	attack.</p>
	<p>A malicious TLS client can send an invalid set of GOST
	parameters which will cause the server to crash due to
	lack of error checking. This could be used in a
	denial-of-service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4108</cvename>
	<cvename>CVE-2011-4109</cvename>
	<cvename>CVE-2011-4576</cvename>
	<cvename>CVE-2011-4577</cvename>
	<cvename>CVE-2011-4619</cvename>
	<cvename>CVE-2012-0027</cvename>
	<url>http://openssl.org/news/secadv_20120104.txt</url>
	</references>
	<dates>
	<discovery>2012-01-04</discovery>
	<entry>2012-01-14</entry>
	</dates>
	</vuln>

	<vuln vid="1800886c-3dde-11e1-89b4-001ec9578670">
	<topic>isc-dhcp-server -- DoS in DHCPv6</topic>
	<affects>
	<package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.3_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/software/dhcp/advisories/cve-2011-4868">
	<p>Due to improper handling of a DHCPv6 lease structure, ISC DHCP
	servers that are serving IPv6 address pools AND using Dynamic
	DNS can encounter a segmentation fault error while updating lease
	status under certain conditions.</p>
	<p>The potential exists for this condition to be intentionally
	triggered, resulting in effective denial of service to
	clients expecting service from the affected server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4868</cvename>
	<url>https://www.isc.org/software/dhcp/advisories/cve-2011-4868</url>
	</references>
	<dates>
	<discovery>2012-01-13</discovery>
	<entry>2012-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="3338f87c-3d5f-11e1-a00a-000c6eb41cf7">
	<topic>PowerDNS -- Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>powerdns</name>
	<name>powerdns-devel</name>
	<range><lt>3.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PowerDNS Team reports:</p>
	<blockquote cite="http://www.powerdns.com/news/powerdns-security-advisory-2012-01.html">
	<p>Using well crafted UDP packets, one or more PowerDNS servers
	could be made to enter a tight packet loop, causing temporary
	denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0206</cvename>
	</references>
	<dates>
	<discovery>2012-01-10</discovery>
	<entry>2012-01-12</entry>
	</dates>
	</vuln>

	<vuln vid="d3921810-3c80-11e1-97e8-00215c6a37bb">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<name>php5-exif</name>
	<range><lt>5.3.9</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_5</lt></range>
	</package>
	<package>
	<name>php52-exif</name>
	<range><lt>5.2.17_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>php development team reports:</p>
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-01-11-1">
	<p>Security Enhancements and Fixes in PHP 5.3.9:</p>
	<ul>
	<li>Added max_input_vars directive to prevent attacks
	based on hash collisions. (CVE-2011-4885)</li>
	<li>Fixed bug #60150 (Integer overflow during the parsing
	of invalid exif header). (CVE-2011-4566)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4566</cvename>
	<cvename>CVE-2011-4885</cvename>
	<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
	</references>
	<dates>
	<discovery>2011-12-29</discovery>
	<entry>2012-01-11</entry>
	<modified>2012-01-19</modified>
	</dates>
	</vuln>

	<vuln vid="e7fd27b2-3ae9-11e1-8b5c-00262d5ed8ee">
	<topic>torcs -- untrusted local library loading</topic>
	<affects>
	<package>
	<name>torcs</name>
	<range><lt>1.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TORCS News reports:</p>
	<blockquote cite="http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77">
	<p>An insecure change to LD_LIBRARY_PATH allows loading of libraries
	in directories other than the standard paths. This can be a
	problem when downloading and installing untrusted content from the
	Internet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3384</cvename>
	<url>http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77</url>
	<url>http://sourceforge.net/tracker/index.php?func=detail&aid=3089384&group_id=3777&atid=103777</url>
	</references>
	<dates>
	<discovery>2010-10-20</discovery>
	<entry>2012-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="a47af810-3a17-11e1-a1be-00e0815b8da8">
	<topic>spamdyke -- STARTTLS Plaintext Injection Vulnerability</topic>
	<affects>
	<package>
	<name>spamdyke</name>
	<range><lt>4.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/47435/">
	<p>The vulnerability is caused due to the TLS implementation not
	properly clearing transport layer buffers when upgrading from
	plaintext to ciphertext after receiving the "STARTTLS" command.
	This can be exploited to insert arbitrary plaintext data (e.g.
	SMTP commands) during the plaintext phase, which will then be
	executed after upgrading to the TLS ciphertext phase.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2012-0070</cvename>
	<url>http://secunia.com/advisories/47435/</url>
	<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
	</references>
	<dates>
	<discovery>2012-01-04</discovery>
	<entry>2012-01-08</entry>
	<modified>2012-01-23</modified>
	</dates>
	</vuln>

	<vuln vid="0c7a3ee2-3654-11e1-b404-20cf30e32f6d">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>2.4.*</ge><lt>3.6.7</lt></range>
	<range><ge>4.0.*</ge><lt>4.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
	<p>The following security issues have been discovered in Bugzilla:</p>
	<ul>
	<li>Tabular and graphical reports, as well as new charts have
	a debug mode which displays raw data as plain text. This
	text is not correctly escaped and a crafted URL could use
	this vulnerability to inject code leading to XSS.</li>
	<li>The User.offer_account_by_email WebService method ignores
	the user_can_create_account setting of the authentication
	method and generates an email with a token in it which the
	user can use to create an account. Depending on the
	authentication method being active, this could allow the
	user to log in using this account.
	Installations where the createemailregexp parameter is
	empty are not vulnerable to this issue.</li>
	<li>The creation of bug reports and of attachments is not
	protected by a token and so they can be created without the
	consent of a user if the relevant code is embedded in an
	HTML page and the user visits this page. This behavior was
	intentional to let third-party applications submit new bug
	reports and attachments easily. But as this behavior can be
	abused by a malicious user, it has been decided to block
	submissions with no valid token starting from version 4.2rc1.
	Older branches are not patched to not break these third-party
	applications after the upgrade.</li>
	</ul>
	<p>All affected installations are encouraged to upgrade as soon
	as possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3657</cvename>
	<cvename>CVE-2011-3667</cvename>
	<cvename>CVE-2011-3668</cvename>
	<cvename>CVE-2011-3669</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=697699</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=711714</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703975</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703983</url>
	</references>
	<dates>
	<discovery>2011-11-28</discovery>
	<entry>2012-01-05</entry>
	</dates>
	</vuln>

	<vuln vid="810df820-3664-11e1-8fe3-00215c6a37bb">
	<topic>WordPress -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.3.1,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>WordPress development team reports:</p>
	<blockquote cite="http://wordpress.org/news/2012/01/wordpress-3-3-1/">
	<p>WordPress 3.3.1 is now available. This maintenance release
	fixes 15 issues with WordPress 3.3, as well as a fix for a
	cross-site scripting vulnerability that affected version 3.3.
	Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and
	the Go Daddy security team for responsibly disclosing the bug
	to our security team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312</url>
	</references>
	<dates>
	<discovery>2012-01-03</discovery>
	<entry>2012-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="048c77df-3211-11e1-9583-14dae938ec40">
	<topic>zabbix-frontend -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>zabbix-frontend</name>
	<range><lt>1.8.10,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martina Matari reports:</p>
	<blockquote cite="https://support.zabbix.com/browse/ZBX-4015">
	<p>These URLs (hostgroups.php, usergrps.php) are vulnerable to
	persistent XSS attacks due to improper sanitation of gname
	variable when creating user and host groups.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://support.zabbix.com/browse/ZBX-4015</url>
	</references>
	<dates>
	<discovery>2011-08-04</discovery>
	<entry>2011-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="c6521b04-314b-11e1-9cf4-5404a67eef98">
	<topic>lighttpd -- remote DoS in HTTP authentication</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.30</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4362">
	<p>Integer signedness error in the base64_decode function in the
	HTTP authentication functionality (http_auth.c) in lighttpd 1.4
	before 1.4.30 and 1.5 before SVN revision 2806 allows remote
	attackers to cause a denial of service (segmentation fault)
	via crafted base64 input that triggers an out-of-bounds read
	with a negative index.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4362</cvename>
	</references>
	<dates>
	<discovery>2011-11-29</discovery>
	<entry>2011-12-28</entry>
	</dates>
	</vuln>

	<vuln vid="4ddc78dc-300a-11e1-a2aa-0016ce01e285">
	<topic>krb5-appl -- telnetd code execution vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
	</package>
	<package>
	<name>krb5-appl</name>
	<range><lt>1.0.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos Team reports:</p>
	<blockquote cite="http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc">
	<p>When an encryption key is supplied via the TELNET protocol,
	its length is not validated before the key is copied into a
	fixed-size buffer. Also see MITKRB5-SA-2011-008.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:08.telnetd</freebsdsa>
	<cvename>CVE-2011-4862</cvename>
	<url>http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc</url>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt</url>
	</references>
	<dates>
	<discovery>2011-12-23</discovery>
	<entry>2011-12-26</entry>
	<modified>2012-01-29</modified>
	</dates>
	</vuln>

	<vuln vid="022a4c77-2da4-11e1-b356-00215c6a37bb">
	<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_6</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
	</package>
	<package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.3g_1</lt></range>
	</package>
	<package>
	<name>proftpd-devel</name>
	<range><lt>1.3.3.r4_3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:</p>
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc">
	<p>If ftpd is configured to place a user in a chroot environment,
	then an attacker who can log in as that user may be able to run
	arbitrary code(...).</p>
	</blockquote>
	<p>Proftpd shares the same problem of a similar nature.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:07.chroot</freebsdsa>
	<url>http://seclists.org/fulldisclosure/2011/Nov/452</url>
	</references>
	<dates>
	<discovery>2011-11-30</discovery>
	<entry>2011-12-23</entry>
	<modified>2012-01-29</modified>
	</dates>
	</vuln>

	<vuln vid="8c83145d-2c95-11e1-89b4-001ec9578670">
	<topic>phpMyAdmin -- Multiple XSS</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.9.r1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php">
	<p>Using crafted url parameters, it was possible to produce XSS on
	the export panels in the server, database and table sections.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php">
	<p>Crafted values entered in the setup interface can produce XSS;
	also, if the config directory exists and is writeable, the XSS
	payload can be saved to this directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4780</cvename>
	<cvename>CVE-2011-4782</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php</url>
	</references>
	<dates>
	<discovery>2011-12-16</discovery>
	<entry>2011-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="e3ff776b-2ba6-11e1-93c6-0011856a6e37">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>9.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>9.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.6</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>9.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.6</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>9.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)</p>
	<p>MFSA 2011-54 Potentially exploitable crash in the YARR regular
	expression library</p>
	<p>MFSA 2011-55 nsSVGValue out-of-bounds access</p>
	<p>MFSA 2011-56 Key detection without JavaScript via SVG
	animation</p>
	<p>MFSA 2011-58 Crash scaling video to extreme sizes</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3658</cvename>
	<cvename>CVE-2011-3660</cvename>
	<cvename>CVE-2011-3661</cvename>
	<cvename>CVE-2011-3663</cvename>
	<cvename>CVE-2011-3665</cvename>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-53.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-54.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-55.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-56.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-58.html</url>
	</references>
	<dates>
	<discovery>2011-12-20</discovery>
	<entry>2011-12-21</entry>
	<modified>2011-12-21</modified>
	</dates>
	</vuln>

	<vuln vid="7ba65bfd-2a40-11e1-b96e-00215af774f0">
	<topic>unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence</topic>
	<affects>
	<package>
	<name>unbound</name>
	<range><lt>1.4.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unbound developer reports:</p>
	<blockquote cite="http://www.unbound.net/downloads/CVE-2011-4528.txt">
	<p>Unbound crashes when confronted with a non-standard response
	from a server for a domain. This domain produces duplicate RRs
	from a certain type and is DNSSEC signed. Unbound also crashes
	when confronted with a query that eventually, and under specific
	circumstances, resolves to a domain that misses expected NSEC3
	records.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4528</cvename>
	<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt</url>
	</references>
	<dates>
	<discovery>2011-12-19</discovery>
	<entry>2011-12-19</entry>
	</dates>
	</vuln>

	<vuln vid="3c957a3e-2978-11e1-89b4-001ec9578670">
	<topic>typo3 -- Remote Code Execution</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><ge>4.6</ge><lt>4.6.2</lt></range>
	<range><lt>4.5.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The typo3 security team reports:</p>
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/">
	<p>A crafted request to a vulnerable TYPO3 installation will allow
	an attacker to load PHP code from an external source and to
	execute it on the TYPO3 installation.</p>
	<p>This is caused by a PHP file, which is part of the workspaces
	system extension, that does not validate passed arguments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4614</cvename>
	<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/</url>
	</references>
	<dates>
	<discovery>2011-12-16</discovery>
	<entry>2011-12-18</entry>
	</dates>
	</vuln>

	<vuln vid="6c7d9a35-2608-11e1-89b4-001ec9578670">
	<topic>krb5 -- KDC null pointer dereference in TGS handling</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.9</ge><lt>1.9.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos Team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt">
	<p>In releases krb5-1.9 and later, the KDC can crash due to a NULL
	pointer dereference in code that handles TGS (Ticket Granting
	Service) requests. The trigger condition is trivial to produce
	using unmodified client software, but requires the ability to
	authenticate as a principal in the KDC's realm.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1530</cvename>
	<url>http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt</url>
	</references>
	<dates>
	<discovery>2011-12-11</discovery>
	<entry>2011-12-14</entry>
	</dates>
	</vuln>

	<vuln vid="a4a809d8-25c8-11e1-b531-00215c6a37bb">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>11.60</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><lt>11.60,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera software reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1160/">
	<ul>
	<li>Fixed a moderately severe issue; details will be
	disclosed at a later date</li>
	<li>Fixed an issue that could allow pages to set cookies
	or communicate cross-site for some top level domains;
	see our <a href="http://www.opera.com/support/kb/view/1003/">advisory</a></li>
	<li>Improved handling of certificate revocation corner
	cases</li>
	<li>Added a fix for a weakness in the SSL v3.0 and TLS 1.0
	specifications, as reported by Thai Duong and Juliano Rizzo;
	see our <a href="http://www.opera.com/support/kb/view/1004/">advisory</a></li>
	<li>Fixed an issue where the JavaScript "in" operator
	allowed leakage of cross-domain information, as reported
	by David Bloom; see our <a href="http://www.opera.com/support/kb/view/1005/">advisory</a></li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3389</cvename>
	<cvename>CVE-2011-4681</cvename>
	<cvename>CVE-2011-4682</cvename>
	<cvename>CVE-2011-4683</cvename>
	<url>http://www.opera.com/support/kb/view/1003/</url>
	<url>http://www.opera.com/support/kb/view/1004/</url>
	<url>http://www.opera.com/support/kb/view/1005/</url>
	</references>
	<dates>
	<discovery>2011-12-06</discovery>
	<entry>2011-12-13</entry>
	</dates>
	</vuln>

	<vuln vid="bbd5f486-24f1-11e1-95bc-080027ef73ec">
	<topic>PuTTY -- Password vulnerability</topic>
	<affects>
	<package>
	<name>putty</name>
	<range><ge>0.59</ge><lt>0.62</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Tatham reports:</p>
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html">
	<p>PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61.
	If you log in using SSH-2 keyboard-interactive authentication
	(which is the usual method used by modern servers to request a
	password), the password you type was accidentally kept in PuTTY's
	memory for the rest of its run, where it could be retrieved by
	other processes reading PuTTY's memory, or written out to swap
	files or crash dumps.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4607</cvename>
	<mlist>http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html</mlist>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html</url>
	</references>
	<dates>
	<discovery>2011-12-10</discovery>
	<entry>2011-12-12</entry>
	<modified>2013-08-07</modified>
	</dates>
	</vuln>

	<vuln vid="bb389137-21fb-11e1-89b4-001ec9578670">
	<topic>asterisk -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk18</name>
	<range><lt>1.8.7.2</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><lt>1.6.2.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-013.html">
	<p>It is possible to enumerate SIP usernames when the general and
	user/peer NAT settings differ in whether to respond to the port
	a request is sent from or the port listed for responses in the
	Via header.</p>
	</blockquote>
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-014.html">
	<p>When the "automon" feature is enabled in features.conf, it is
	possible to send a sequence of SIP requests that cause Asterisk
	to dereference a NULL pointer and crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4597</cvename>
	<cvename>CVE-2011-4598</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-013.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-014.html</url>
	</references>
	<dates>
	<discovery>2011-12-08</discovery>
	<entry>2011-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="93be487e-211f-11e1-89b4-001ec9578670">
	<topic>isc-dhcp-server -- Remote DoS</topic>
	<affects>
	<package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.3_1</lt></range>
	</package>
	<package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_3,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4539">
	<p>A bug exists which allows an attacker who is able to send DHCP
	Request packets, either directly or through a relay, to remotely
	crash an ISC DHCP server if that server is configured to evaluate
	expressions using a regular expression (i.e. uses the "~=" or
	"~~" comparison operators).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4539</cvename>
	</references>
	<dates>
	<discovery>2011-12-07</discovery>
	<entry>2011-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="ed536336-1c57-11e1-86f4-e0cb4e266481">
	<topic>phpMyAdmin -- Multiple XSS</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.8.r1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php">
	<p>Using crafted database names, it was possible to produce XSS
	in the Database Synchronize and Database rename panels. Using
	an invalid and crafted SQL query, it was possible to produce
	XSS when editing a query on a table overview panel or when
	using the view creation dialog. Using a crafted column type,
	it was possible to produce XSS in the table search and create
	index dialogs.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4634</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php</url>
	</references>
	<dates>
	<discovery>2011-11-24</discovery>
	<entry>2011-12-01</entry>
	</dates>
	</vuln>

	<vuln vid="eef56761-11eb-11e1-bb94-001c140104d4">
	<topic>hiawatha -- memory leak in PreventSQLi routine</topic>
	<affects>
	<package>
	<name>hiawatha</name>
	<range><ge>7.6</ge><lt>7.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hugo Leisink reports via private mail to maintainer:</p>
	<blockquote>
	<p>The memory leak was introduced in version 7.6. It is in the
	routing that checks for SQL injections. So, if you have set
	PreventSQLi to 'no', there is no problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.hiawatha-webserver.org/changelog</url>
	</references>
	<dates>
	<discovery>2011-11-18</discovery>
	<entry>2011-11-18</entry>
	</dates>
	</vuln>

	<vuln vid="90cc1494-10ac-11e1-b3ec-0024e830109b">
	<topic>BIND -- Remote DOS</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R5.1</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.4.1</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Internet Systems Consortium reports:</p>
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4313">
	<p>Organizations across the Internet reported crashes interrupting
	service on BIND 9 nameservers performing recursive queries.
	Affected servers crashed after logging an error in query.c with
	the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))"
	Multiple versions were reported being affected, including all
	currently supported release versions of ISC BIND 9.</p>
	<p>Because it may be possible to trigger this bug even on networks
	that do not allow untrusted users to access the recursive name
	servers (perhaps via specially crafted e-mail messages, and/or
	malicious web sites) it is recommended that ALL operators of
	recursive name servers upgrade immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-11:06.bind</freebsdsa>
	<cvename>CVE-2011-4313</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313</url>
	<url>https://www.isc.org/software/bind/advisories/cve-2011-4313</url>
	</references>
	<dates>
	<discovery>2011-11-16</discovery>
	<entry>2011-11-16</entry>
	<modified>2012-01-29</modified>
	</dates>
	</vuln>

	<vuln vid="d8c901ff-0f0f-11e1-902b-20cf30e32f6d">
	<topic>Apache 1.3 -- mod_proxy reverse proxy exposure</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><lt>1.3.43</lt></range>
	</package>
	<package>
	<name>apache+ssl</name>
	<range><lt>1.3.43.1.59_2</lt></range>
	</package>
	<package>
	<name>apache+ipv6</name>
	<range><lt>1.3.43</lt></range>
	</package>
	<package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.43</lt></range>
	</package>
	<package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.41+2.8.31_4</lt></range>
	</package>
	<package>
	<name>apache+mod_ssl+ipv6</name>
	<range><lt>1.3.41+2.8.31_4</lt></range>
	</package>
	<package>
	<name>ru-apache-1.3</name>
	<range><lt>1.3.43+30.23_1</lt></range>
	</package>
	<package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.43+30.23_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache HTTP server project reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
	<p>An exposure was found when using mod_proxy in reverse proxy mode.
	In certain configurations using RewriteRule with proxy flag, a
	remote attacker could cause the reverse proxy to connect to an
	arbitrary server, possibly disclosing sensitive information from
	internal web servers not directly accessible to attacker. There
	is no patch against this issue!</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3368</cvename>
	<url>http://httpd.apache.org/security/vulnerabilities_13.html</url>
	<url>http://seclists.org/fulldisclosure/2011/Oct/232</url>
	</references>
	<dates>
	<discovery>2011-10-05</discovery>
	<entry>2011-11-14</entry>
	</dates>
	</vuln>

	<vuln vid="7fb9e739-0e6d-11e1-87cd-00235a5f2c9a">
	<topic>kdeutils4 -- Directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>kdeutils</name>
	<range><ge>4.0.*</ge><lt>4.7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Brown from Nth Dimention reports:</p>
	<blockquote cite="http://seclists.org/fulldisclosure/2011/Oct/351">
	<p>I recently discovered that the Ark archiving tool is vulnerable
	to directory traversal via malformed. When attempts are made to
	view files within the malformed Zip file in Ark's default view,
	the wrong file may be displayed due to incorrect construction of
	the temporary file name. Whilst this does not allow the wrong
	file to be overwritten, after closing the default view, Ark will
	then attempt to delete the temporary file which could result in
	the deletion of the incorrect file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2725</cvename>
	<url>http://seclists.org/fulldisclosure/2011/Oct/351</url>
	</references>
	<dates>
	<discovery>2011-10-19</discovery>
	<entry>2011-11-14</entry>
	</dates>
	</vuln>

	<vuln vid="38560d79-0e42-11e1-902b-20cf30e32f6d">
	<topic>Apache APR -- DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>apr0</name>
	<range><lt>0.9.20.0.9.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Portable Runtime Project reports:</p>
	<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-0.9">
	<p>Reimplement apr_fnmatch() from scratch using a non-recursive
	algorithm; now has improved compliance with the fnmatch()
	spec.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0419</cvename>
	<url>http://www.apache.org/dist/apr/Announcement0.9.html</url>
	</references>
	<dates>
	<discovery>2011-05-19</discovery>
	<entry>2011-11-13</entry>
	</dates>
	</vuln>

	<vuln vid="1f6ee708-0d22-11e1-b5bd-14dae938ec40">
	<topic>phpmyadmin -- Local file inclusion</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.7.1</lt></range>
	<range><lt>3.3.10.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Lieskovsky reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php">
	<p>Importing a specially-crafted XML file which contains an XML
	entity injection permits to retrieve a local file (limited by the
	privileges of the user running the web server).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4107</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php</url>
	</references>
	<dates>
	<discovery>2011-11-10</discovery>
	<entry>2011-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="0e8e1212-0ce5-11e1-849b-003067b2972c">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r183.11</lt></range>
	<range><gt>11</gt><lt>11.1r102.55</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-28.html">
	<p>Critical vulnerabilities have been identified in Adobe Flash
	Player 11.0.1.152 and earlier versions for Windows, Macintosh,
	Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier
	versions for Android.</p>
	</blockquote>
	<p>In addition a patch was released for users of flash10.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2445</cvename>
	<cvename>CVE-2011-2450</cvename>
	<cvename>CVE-2011-2451</cvename>
	<cvename>CVE-2011-2452</cvename>
	<cvename>CVE-2011-2453</cvename>
	<cvename>CVE-2011-2454</cvename>
	<cvename>CVE-2011-2455</cvename>
	<cvename>CVE-2011-2456</cvename>
	<cvename>CVE-2011-2457</cvename>
	<cvename>CVE-2011-2458</cvename>
	<cvename>CVE-2011-2459</cvename>
	<cvename>CVE-2011-2460</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb11-28.html</url>
	</references>
	<dates>
	<discovery>2011-11-10</discovery>
	<entry>2011-11-11</entry>
	</dates>
	</vuln>

	<vuln vid="7be92050-a450-11e2-9898-001060e06fd4">
	<topic>libxml -- Integer overflow</topic>
	<affects>
	<package>
	<name>libxml</name>
	<range><lt>1.8.17_5</lt></range>
	</package>
	<package>
	<name>libxml2</name>
	<name>linux-f10-libxml2</name>
	<range><lt>2.7.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Integer overflow in xpath.c, allows context-dependent attackers
	to to cause a denial of service (crash) and possibly execute
	arbitrary code via a crafted XML file that triggers a heap-based
	buffer overflow when adding a new namespace node, related to
	handling of XPath expressions.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1944</cvename>
	</references>
	<dates>
	<discovery>2011-09-02</discovery>
	<entry>2011-11-10</entry>
	<modified>2011-11-12</modified>
	</dates>
	</vuln>

	<vuln vid="ce4b3af8-0b7c-11e1-846b-00235409fd3e">
	<topic>libxml -- Multiple use-after-free vulnerabilities</topic>
	<affects>
	<package>
	<name>libxml</name>
	<range><lt>1.8.17_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple use-after-free vulnerabilities in libxml 1.8.17 that
	allow context-dependent attackers to cause a denial of service
	(application crash) via crafted (1) Notation or (2) Enumeration
	attribute types in an XML file.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2416</cvename>
	</references>
	<dates>
	<discovery>2009-08-03</discovery>
	<entry>2011-11-10</entry>
	<modified>2011-11-12</modified>
	</dates>
	</vuln>

	<vuln vid="5a7d4110-0b7a-11e1-846b-00235409fd3e">
	<topic>libxml -- Stack consumption vulnerability</topic>
	<affects>
	<package>
	<name>libxml</name>
	<range><lt>1.8.17_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stack consumption vulnerability allows context-dependent
	attackers to cause a denial of service (application crash) via
	a large depth of element declarations in a DTD.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2414</cvename>
	</references>
	<dates>
	<discovery>2009-08-03</discovery>
	<entry>2011-11-10</entry>
	<modified>2011-11-12</modified>
	</dates>
	</vuln>

	<vuln vid="bdec8dc2-0b3b-11e1-b722-001cc0476564">
	<topic>gnutls -- client session resumption vulnerability</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.12.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GnuTLS team reports:</p>
	<blockquote cite="http://www.gnu.org/software/gnutls/security.html">
	<p>GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4128</cvename>
	<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596</url>
	</references>
	<dates>
	<discovery>2011-11-08</discovery>
	<entry>2011-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="6c8ad3e8-0a30-11e1-9580-4061862b8c22">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>8.0,1</lt></range>
	<range><gt>3.6.*,1</gt><lt>3.6.24,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.24</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>8.0,1</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>8.0</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>8.0</lt></range>
	<range><lt>3.1.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope
	parameter (1.9.2 branch)</p>
	<p>MFSA 2011-47 Potential XSS against sites using Shift-JIS</p>
	<p>MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)</p>
	<p>MFSA 2011-49 Memory corruption while profiling using Firebug</p>
	<p>MFSA 2011-50 Cross-origin data theft using canvas and Windows
	D2D</p>
	<p>MFSA 2011-51 Cross-origin image theft on Mac with integrated
	Intel GPU</p>
	<p>MFSA 2011-52 Code execution via NoWaiverWrapper</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3647</cvename>
	<cvename>CVE-2011-3648</cvename>
	<cvename>CVE-2011-3649</cvename>
	<cvename>CVE-2011-3650</cvename>
	<cvename>CVE-2011-3651</cvename>
	<cvename>CVE-2011-3652</cvename>
	<cvename>CVE-2011-3653</cvename>
	<cvename>CVE-2011-3654</cvename>
	<cvename>CVE-2011-3655</cvename>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-46.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-47.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-48.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-49.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-50.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-51.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-52.html</url>
	</references>
	<dates>
	<discovery>2011-11-08</discovery>
	<entry>2011-11-08</entry>
	</dates>
	</vuln>

	<vuln vid="9dde9dac-08f4-11e1-af36-003067b2972c">
	<topic>caml-light -- insecure use of temporary files</topic>
	<affects>
	<package>
	<name>caml-light</name>
	<range><le>0.75</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>caml-light uses mktemp() insecurely, and also does
	unsafe things in /tmp during make install.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4119</cvename>
	<mlist msgid="20111106200911.GC13652@netbsd.org">http://seclists.org/oss-sec/2011/q4/249</mlist>
	</references>
	<dates>
	<discovery>2011-11-02</discovery>
	<entry>2011-11-06</entry>
	</dates>
	</vuln>

	<vuln vid="54075e39-04ac-11e1-a94e-bcaec565249c">
	<topic>freetype -- Some type 1 fonts handling vulnerabilities</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The FreeType project reports:</p>
	<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view">
	<p>A couple of vulnerabilities in handling Type 1 fonts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3256</cvename>
	<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view</url>
	<url>https://bugzilla.redhat.com/attachment.cgi?id=528829&action=diff</url>
	</references>
	<dates>
	<discovery>2011-10-12</discovery>
	<entry>2011-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="f08e2c15-ffc9-11e0-b0f3-bcaec565249c">
	<topic>cacti -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.7h</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cacti Group reports:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_7h.php">
	<p>SQL injection issue with user login, and cross-site scripting
	issues.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.cacti.net/release_notes_0_8_7h.php</url>
	</references>
	<dates>
	<discovery>2011-09-26</discovery>
	<entry>2011-10-26</entry>
	</dates>
	</vuln>

	<vuln vid="395e0faa-ffa7-11e0-8ac4-6c626dd55a41">
	<topic>phpmyfaq -- Remote PHP Code Injection Vulnerability</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><lt>2.6.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyFAQ project reports:</p>
	<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
	<p>The phpMyFAQ Team has learned of a serious security issue that
	has been discovered in our bundled ImageManager library we use
	in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library
	allows injection of arbitrary PHP code via POST requests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyfaq.de/advisory_2011-10-25.php</url>
	<url>http://forum.phpmyfaq.de/viewtopic.php?f=3&t=13402</url>
	</references>
	<dates>
	<discovery>2011-10-25</discovery>
	<entry>2011-10-26</entry>
	</dates>
	</vuln>

	<vuln vid="edf47177-fe3f-11e0-a207-0014a5e3cda6">
	<topic>phpLDAPadmin -- Remote PHP code injection vulnerability</topic>
	<affects>
	<package>
	<name>phpldapadmin</name>
	<range><ge>1.2.0</ge><lt>1.2.1.1_1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>EgiX (n0b0d13s at gmail dot com) reports:</p>
	<blockquote cite="http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt">
	<p>The $sortby parameter passed to 'masort' function in file
	lib/functions.php isn't properly sanitized before being used in
	a call to create_function() at line 1080. This can be exploited
	to inject and execute arbitrary PHP code. The only possible
	attack vector is when handling the 'query_engine' command, in
	which input passed through $_REQUEST['orderby'] is passed as
	$sortby parameter to 'masort' function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt</url>
	<url>http://sourceforge.net/tracker/?func=detail&aid=3417184&group_id=61828&atid=498546</url>
	</references>
	<dates>
	<discovery>2011-10-23</discovery>
	<entry>2011-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="6d21a287-fce0-11e0-a828-00235a5f2c9a">
	<topic>kdelibs4, rekonq -- input validation failure</topic>
	<affects>
	<package>
	<name>kdelibs</name>
	<range><ge>4.0.*</ge><lt>4.7.2</lt></range>
	</package>
	<package>
	<name>rekonq</name>
	<range><lt>0.8.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20111003-1.txt">
	<p>The default rendering type for a QLabel is QLabel::AutoText,
	which uses heuristics to determine whether to render the given
	content as plain text or rich text. KSSL and Rekonq did not
	properly force its QLabels to use QLabel::PlainText. As a result,
	if given a certificate containing rich text in its fields, they
	would render the rich text. Specifically, a certificate
	containing a common name (CN) that has a table element will cause
	the second line of the table to be displayed. This can allow
	spoofing of the certificate's common name.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.kde.org/info/security/advisory-20111003-1.txt</url>
	<url>http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc</url>
	<cvename>CVE-2011-3365</cvename>
	<cvename>CVE-2011-3366</cvename>
	</references>
	<dates>
	<discovery>2011-10-03</discovery>
	<entry>2011-10-23</entry>
	</dates>
	</vuln>

	<vuln vid="411ecb79-f9bc-11e0-a7e6-6c626dd55a41">
	<topic>piwik -- unknown critical vulnerabilities</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><gt>1.1</gt><lt>1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/46461/">
	<p>Multiple vulnerabilities with an unknown impact have been
	reported in Piwik. The vulnerabilities are caused due to
	unspecified errors. No further information is currently
	available.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/46461/</url>
	<url>http://piwik.org/blog/2011/10/piwik-1-6/</url>
	</references>
	<dates>
	<discovery>2011-10-18</discovery>
	<entry>2011-10-20</entry>
	</dates>
	</vuln>

	<vuln vid="8441957c-f9b4-11e0-a78a-bcaec565249c">
	<topic>Xorg server -- two vulnerabilities in X server lock handling code</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><lt>1.7.7_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthieu Herrb reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html">
	<p>It is possible to deduce if a file exists or not by exploiting
	the way that Xorg creates its lock files. This is caused by the
	fact that the X server is behaving differently if the lock file
	already exists as a symbolic link pointing to an existing or
	non-existing file.</p>
	<p>It is possible for a non-root user to set the permissions for
	all users on any file or directory to 444, giving unwanted read
	access or causing denies of service (by removing execute
	permission). This is caused by a race between creating the lock
	file and setting its access modes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4028</cvename>
	<cvename>CVE-2011-4029</cvename>
	</references>
	<dates>
	<discovery>2011-10-18</discovery>
	<entry>2011-10-18</entry>
	</dates>
	</vuln>

	<vuln vid="a95092a6-f8f1-11e0-a7ea-00215c6a37bb">
	<topic>asterisk -- remote crash vulnerability in SIP channel driver</topic>
	<affects>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.7.1</lt></range>
	</package>
	<package>
	<name>asterisk</name>
	<range><gt>10.0.0.*</gt><lt>10.0.0.r1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Asterisk project reports:</p>
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-012.html">
	<p>A remote authenticated user can cause a crash with a malformed
	request due to an unitialized variable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-4063</cvename>
	</references>
	<dates>
	<discovery>2011-10-17</discovery>
	<entry>2011-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="e454ca2f-f88d-11e0-b566-00163e01a509">
	<topic>PivotX -- Remote File Inclusion Vulnerability of TimThumb</topic>
	<affects>
	<package>
	<name>pivotx</name>
	<range><lt>2.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PivotX team reports:</p>
	<blockquote cite="http://blog.pivotx.net/page/security">
	<p>TimThumb domain name security bypass and insecure cache
	handling. PivotX before 2.3.0 includes a vulnerable version
	of TimThumb.</p>
	</blockquote>
	<blockquote cite="http://blog.pivotx.net/2011-10-14/timthumb-update-for-older-pivotx-installs">
	<p>If you are still running PivotX 2.2.6, you might be vulnerable
	to a security exploit, that was patched previously. Version
	2.3.0 doesn't have this issue, but any older version of PivotX
	might be vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>48963</bid>
	<url>https://secunia.com/advisories/45416/</url>
	</references>
	<dates>
	<discovery>2011-08-03</discovery>
	<entry>2011-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="9bad5ab1-f3f6-11e0-8b5c-b482fe3f522d">
	<topic>OpenTTD -- Multiple buffer overflows in validation of external data</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3343">
	<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow local
	users to cause a denial of service (daemon crash) or possibly
	gain privileges via (1) a crafted BMP file with RLE compression
	or (2) crafted dimensions in a BMP file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3343</cvename>
	<url>http://security.openttd.org/en/CVE-2011-3343</url>
	</references>
	<dates>
	<discovery>2011-08-25</discovery>
	<entry>2011-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="78c25ed7-f3f9-11e0-8b5c-b482fe3f522d">
	<topic>OpenTTD -- Buffer overflows in savegame loading</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3342">
	<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow remote
	attackers to cause a denial of service (daemon crash) or possibly
	execute arbitrary code via vectors related to (1) NAME, (2) PLYR,
	(3) CHTS, or (4) AIPL (aka AI config) chunk loading from a
	savegame.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3342</cvename>
	<url>http://security.openttd.org/en/CVE-2011-3342</url>
	</references>
	<dates>
	<discovery>2011-08-08</discovery>
	<entry>2011-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="e77befb5-f3f9-11e0-8b5c-b482fe3f522d">
	<topic>OpenTTD -- Denial of service via improperly validated commands</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>0.3.5</ge><lt>1.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3341">
	<p>Multiple off-by-one errors in order_cmd.cpp in OpenTTD before
	1.1.3 allow remote attackers to cause a denial of service (daemon
	crash) or possibly execute arbitrary code via a crafted
	CMD_INSERT_ORDER command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3341</cvename>
	<url>http://security.openttd.org/en/CVE-2011-3341</url>
	</references>
	<dates>
	<discovery>2011-08-25</discovery>
	<entry>2011-10-16</entry>
	</dates>
	</vuln>

	<vuln vid="ab9be2c8-ef91-11e0-ad5a-00215c6a37bb">
	<topic>quagga -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>0.99.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CERT-FI reports:</p>
	<blockquote cite="https://www.cert.fi/en/reports/2011/vulnerability539178.html">
	<p>Five vulnerabilities have been found in the BGP, OSPF, and
	OSPFv3 components of Quagga. The vulnerabilities allow an
	attacker to cause a denial of service or potentially to
	execute his own code by sending a specially modified packets
	to an affected server. Routing messages are typically accepted
	from the routing peers. Exploiting these vulnerabilities may
	require an established routing session (BGP peering or
	OSPF/OSPFv3 adjacency) to the router.</p>
	<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3327">CVE-2011-3327</a>
	is related to the extended communities handling in BGP
	messages. Receiving a malformed BGP update can result
	in a buffer overflow and disruption of IPv4 routing.</p>
	<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3326">CVE-2011-3326</a>
	results from the handling of LSA (Link State Advertisement)
	states in the OSPF service. Receiving a modified Link State
	Update message with malicious state information can result in
	denial of service in IPv4 routing.</p>
	<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3325">CVE-2011-3325</a>
	is a denial of service vulnerability related to Hello message
	handling by the OSPF service. As Hello messages are used to
	initiate adjacencies, exploiting the vulnerability may be
	feasible from the same broadcast domain without an established
	adjacency. A malformed packet may result in denial of service
	in IPv4 routing.</p>
	<p>The vulnerabilities <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3324">CVE-2011-3324</a>
	and <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3323">CVE-2011-3323</a>
	are related to the IPv6 routing protocol (OSPFv3) implemented
	in ospf6d daemon. Receiving modified Database Description and
	Link State Update messages, respectively, can result in denial
	of service in IPv6 routing.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3323</cvename>
	<cvename>CVE-2011-3324</cvename>
	<cvename>CVE-2011-3325</cvename>
	<cvename>CVE-2011-3326</cvename>
	<cvename>CVE-2011-3327</cvename>
	</references>
	<dates>
	<discovery>2011-09-26</discovery>
	<entry>2011-10-05</entry>
	</dates>
	</vuln>

	<vuln vid="1fade8a3-e9e8-11e0-9580-4061862b8c22">
	<topic>Mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>7.0,1</lt></range>
	<range><gt>3.6.*,1</gt><lt>3.6.23,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.23</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>7.0,1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.4</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>7.0</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.4</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>7.0</lt></range>
	<range><lt>3.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 /
	rv:1.9.2.23)</p>
	<p>MFSA 2011-37 Integer underflow when using JavaScript RegExp</p>
	<p>MFSA 2011-38 XSS via plugins and shadowed window.location
	object</p>
	<p>MFSA 2011-39 Defense against multiple Location headers due to
	CRLF Injection</p>
	<p>MFSA 2011-40 Code installation through holding down Enter</p>
	<p>MFSA 2011-41 Potentially exploitable WebGL crashes</p>
	<p>MFSA 2011-42 Potentially exploitable crash in the YARR regular
	expression library</p>
	<p>MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope
	parameter</p>
	<p>MFSA 2011-44 Use after free reading OGG headers</p>
	<p>MFSA 2011-45 Inferring Keystrokes from motion data</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2372</cvename>
	<cvename>CVE-2011-2995</cvename>
	<cvename>CVE-2011-2996</cvename>
	<cvename>CVE-2011-2997</cvename>
	<cvename>CVE-2011-2999</cvename>
	<cvename>CVE-2011-3000</cvename>
	<cvename>CVE-2011-3001</cvename>
	<cvename>CVE-2011-3002</cvename>
	<cvename>CVE-2011-3003</cvename>
	<cvename>CVE-2011-3004</cvename>
	<cvename>CVE-2011-3005</cvename>
	<cvename>CVE-2011-3232</cvename>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-36.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-37.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-38.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-39.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-40.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-41.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-42.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-43.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-44.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-45.html</url>
	</references>
	<dates>
	<discovery>2011-09-27</discovery>
	<entry>2011-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="53e531a7-e559-11e0-b481-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r183.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-26.html">
	<p>Critical vulnerabilities have been identified in Adobe Flash
	Player 10.3.183.7 and earlier versions for Windows, Macintosh,
	Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier
	versions for Android. These vulnerabilities could cause a crash
	and potentially allow an attacker to take control of the
	affected system.</p>
	<p>There are reports that one of these vulnerabilities
	(CVE-2011-2444) is being exploited in the wild in active
	targeted attacks designed to trick the user into clicking on
	a malicious link delivered in an email message. This universal
	cross-site scripting issue could be used to take actions on a
	user's behalf on any website or webmail provider if the user
	visits a malicious website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.adobe.com/support/security/bulletins/apsb11-26.html</url>
	<cvename>CVE-2011-2426</cvename>
	<cvename>CVE-2011-2427</cvename>
	<cvename>CVE-2011-2428</cvename>
	<cvename>CVE-2011-2429</cvename>
	<cvename>CVE-2011-2430</cvename>
	<cvename>CVE-2011-2444</cvename>
	</references>
	<dates>
	<discovery>2011-06-06</discovery>
	<entry>2011-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="e44fe906-df27-11e0-a333-001cc0a36e12">
	<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php">
	<p>Firstly, if a row contains javascript code, after inline
	editing this row and saving, the code is executed. Secondly,
	missing sanitization on the db, table and column names leads
	to XSS vulnerabilities.</p>
	<p>Versions 3.4.0 to 3.4.4 were found vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php</url>
	</references>
	<dates>
	<discovery>2011-09-11</discovery>
	<entry>2011-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="d01d10c7-de2d-11e0-b215-00215c6a37bb">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py27-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><ge>1.3</ge><lt>1.3.1</lt></range>
	<range><ge>1.2</ge><lt>1.2.7</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py27-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>16758,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Django project reports:</p>
	<blockquote cite="https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/">
	<p>Please reference CVE/URL list for details</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/</url>
	</references>
	<dates>
	<discovery>2011-09-09</discovery>
	<entry>2011-09-13</entry>
	<modified>2011-11-01</modified>
	</dates>
	</vuln>

	<vuln vid="4ae68e7c-dda4-11e0-a906-00215c6a37bb">
	<topic>roundcube -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>0.5.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RoundCube development Team reports:</p>
	<blockquote cite="http://sourceforge.net/news/?group_id=139281&id=302769">
	<p>We just published a new release which fixes a recently
	reported XSS vulnerability as an update to the stable 0.5
	branch. Please update your installations with this new
	version or patch them with the fix which is also published
	in the downloads section or our sourceforge.net page.</p>
	</blockquote>
	<p>and:</p>
	<blockquote cite="http://trac.roundcube.net/ticket/1488030">
	<p>During one of pen-tests I found that _mbox parameter is not
	properly sanitized and reflected XSS attack is possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2937</cvename>
	</references>
	<dates>
	<discovery>2011-08-09</discovery>
	<entry>2011-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="b9f3ffa3-dd6c-11e0-b7fc-000a5e1e33c6">
	<topic>libsndfile -- PAF file processing integer overflow</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<range><lt>1.0.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/45125/">
	<p>Hossein Lotfi has discovered a vulnerability in libsndfile,
	which can be exploited by malicious people to potentially
	compromise an application using the library. The vulnerability
	is caused due to an integer overflow error in the "paf24_init()"
	function (src/paf.c) when processing Paris Audio (PAF) files.
	This can be exploited to cause a heap-based buffer overflow via
	a specially crafted file. Successful exploitation may allow
	execution of arbitrary code. The vulnerability is confirmed in
	version 1.0.24. Other versions may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2696</cvename>
	<url>http://secunia.com/advisories/45125/</url>
	</references>
	<dates>
	<discovery>2011-07-12</discovery>
	<entry>2011-09-12</entry>
	</dates>
	</vuln>

	<vuln vid="2ecb7b20-d97e-11e0-b2e2-00215c6a37bb">
	<topic>OpenSSL -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>1.0.0</ge><lt>1.0.0_6</lt></range>
	<range><ge>0.9.8</ge><lt>1.0.0</lt></range>
	</package>
	<package>
	<name>linux-f10-openssl</name>
	<range><ge>0.9.8</ge><lt>0.9.8r</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL Team reports:</p>
	<blockquote cite="http://openssl.org/news/secadv_20110906.txt">
	<p>Two security flaws have been fixed in OpenSSL 1.0.0e</p>
	<p>Under certain circumstances OpenSSL's internal certificate
	verification routines can incorrectly accept a CRL whose
	nextUpdate field is in the past. (CVE-2011-3207)</p>
	<p>OpenSSL server code for ephemeral ECDH ciphersuites is not
	thread-safe, and furthermore can crash if a client violates
	the protocol by sending handshake messages in incorrect
	order. (CVE-2011-3210)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3207</cvename>
	<cvename>CVE-2011-3210</cvename>
	<url>http://www.openssl.org/news/secadv_20110906.txt</url>
	</references>
	<dates>
	<discovery>2011-09-06</discovery>
	<entry>2011-09-07</entry>
	<modified>2014-04-10</modified>
	</dates>
	</vuln>

	<vuln vid="a83f25df-d775-11e0-8bf1-003067b2972c">
	<topic>XSS issue in MantisBT</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><ge>1.2.0</ge><lt>1.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.mantisbt.org/blog/?p=142">
	<p>Net.Edit0r from BlACK Hat Group reported an XSS issue in
	search.php. All MantisBT users (including anonymous users that
	are not logged in to public bug trackers) could be impacted by
	this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/160368</freebsdpr>
	<cvename>CVE-2011-2938</cvename>
	</references>
	<dates>
	<discovery>2011-08-18</discovery>
	<entry>2011-09-05</entry>
	</dates>
	</vuln>

	<vuln vid="e55f948f-d729-11e0-abd1-0017f22d6707">
	<topic>security/cfs -- buffer overflow</topic>
	<affects>
	<package>
	<name>cfs</name>
	<range><le>1.4.1_6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="http://www.debian.org/security/2002/dsa-116">
	<p>Zorgon found several buffer overflows in cfsd, a daemon that
	pushes encryption services into the Unix(tm) file system.
	We are not yet sure if these overflows can successfully be
	exploited to gain root access to the machine running the CFS
	daemon. However, since cfsd can easily be forced to die, a
	malicious user can easily perform a denial of service attack
	to it.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2002-0351</cvename>
	<url>http://www.debian.org/security/2002/dsa-116</url>
	</references>
	<dates>
	<discovery>2002-03-02</discovery>
	<entry>2011-09-04</entry>
	</dates>
	</vuln>

	<vuln vid="1b27af46-d6f6-11e0-89a6-080027ef73ec">
	<topic>ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle</topic>
	<affects>
	<package>
	<name>ca_root_nss</name>
	<range><lt>3.12.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports that the ca-bundle.pl used in older
	versions of the ca_root_nss FreeBSD port before 3.12.11 did not
	take the Mozilla/NSS/CKBI untrusted markers into account and
	would add certificates to the trust bundle that were marked
	unsafe by Mozilla.</p>
	</body>
	</description>
	<references>
	<freebsdpr>ports/160455</freebsdpr>
	</references>
	<dates>
	<discovery>2011-09-04</discovery>
	<entry>2011-09-04</entry>
	</dates>
	</vuln>

	<vuln vid="aa5bc971-d635-11e0-b3cf-080027ef73ec">
	<topic>nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl</topic>
	<affects>
	<package>
	<name>nss</name>
	<range><lt>3.12.11</lt></range>
	<!-- this builds on the assumption that 3.12.11 in ports actually
	contains the CKBI 1.87 update to the built-in certificates
	as commited by kwm@ on September 3rd, 2011 -->
	</package>
	<package>
	<name>ca_root_nss</name>
	<range><lt>3.12.11</lt></range>
	<!-- this builds on the assumption that 3.12.11 in ports actually
	contains the CKBI 1.87 update to the built-in certificates
	as commited by mandree@ on September 4th, 2011 -->
	</package>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.22,1</lt></range>
	<range><gt>4.0.*,1</gt><lt>6.0.2,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.3.2</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.22,1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><gt>3.1.*</gt><lt>3.1.14</lt></range>
	<range><gt>5.0.*</gt><lt>6.0.2</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.14</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Heather Adkins, Google's Information Security Manager, reported that
	Google received</p>
	<blockquote cite="http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html">
	<p>[...] reports of attempted SSL man-in-the-middle (MITM)
	attacks against Google users, whereby someone tried to get between
	them and encrypted Google services. The people affected were
	primarily located in Iran. The attacker used a fraudulent SSL
	certificate issued by DigiNotar, a root certificate authority that
	should not issue certificates for Google (and has since revoked
	it). [...]</p>
	</blockquote>
	<p>VASCO Data Security International Inc., owner of DigiNotar, issued a
	press statement confirming this incident:</p>
	<blockquote cite="http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx">
	<p>On July 19th 2011, DigiNotar detected an intrusion
	into its Certificate Authority (CA) infrastructure, which resulted
	in the fraudulent issuance of public key certificate requests for
	a number of domains, including Google.com. [...] an external
	security audit concluded that all fraudulently issued certificates
	were
	revoked. Recently, it was discovered that at least one fraudulent
	certificate had not been revoked at the time. [...]</p>
	</blockquote>
	<p>Mozilla, maintainer of the NSS package, from which FreeBSD derived
	ca_root_nss, stated that they:</p>
	<blockquote cite="https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/">
	<p>revoked our trust in the DigiNotar certificate authority from
	all Mozilla software. This is not a temporary suspension, it is
	a complete removal from our trusted root program. Complete
	revocation of trust is a decision we treat with careful
	consideration, and employ as a last resort.
	</p><p>Three central issues informed our decision:</p>
	<ol><li>Failure to notify. [...]</li>
	<li>The scope of the breach remains unknown. [...]</li>
	<li>The attack is not theoretical.</li></ol>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-34.html</url>
	<url>http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html</url>
	</references>
	<dates>
	<discovery>2011-07-19</discovery>
	<entry>2011-09-03</entry>
	<modified>2011-09-06</modified>
	</dates>
	</vuln>

	<vuln vid="7f6108d2-cea8-11e0-9d58-0800279895ea">
	<topic>apache -- Range header DoS vulnerability</topic>
	<affects>
	<package>
	<name>apache</name>
	<name>apache-event</name>
	<name>apache-itk</name>
	<name>apache-peruser</name>
	<name>apache-worker</name>
	<range><gt>2.*</gt><lt>2.2.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache HTTP server project reports:</p>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192">
	<p>A denial of service vulnerability has been found in the way
	the multiple overlapping ranges are handled by Apache HTTPD
	server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3192</cvename>
	<url>https://people.apache.org/~dirkx/CVE-2011-3192.txt</url>
	<url>https://svn.apache.org/viewvc?view=revision&revision=1161534</url>
	<url>https://svn.apache.org/viewvc?view=revision&revision=1162874</url>
	</references>
	<dates>
	<discovery>2011-08-24</discovery>
	<entry>2011-08-30</entry>
	<modified>2011-09-01</modified>
	</dates>
	</vuln>

	<vuln vid="cdeb34e6-d00d-11e0-987e-00215c6a37bb">
	<topic>stunnel -- heap corruption vulnerability</topic>
	<affects>
	<package>
	<name>stunnel</name>
	<range><ge>4.40</ge><lt>4.42</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michal Trojnara reports:</p>
	<blockquote cite="http://www.stunnel.org/pipermail/stunnel-announce/2011-August/000059.html">
	<p>Version 4.42, 2011.08.18, urgency: HIGH:</p>
	<p>Fixed a heap corruption vulnerability in versions 4.40 and 4.41.
	It may possibly be leveraged to perform DoS or remote code
	execution attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>49254</bid>
	<cvename>CVE-2011-2940</cvename>
	</references>
	<dates>
	<discovery>2011-08-25</discovery>
	<entry>2011-08-26</entry>
	</dates>
	</vuln>

	<vuln vid="75e26236-ce9e-11e0-b26a-00215c6a37bb">
	<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php">
	<p>Multiple XSS in the Tracking feature.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-3181</cvename>
	</references>
	<dates>
	<discovery>2011-08-24</discovery>
	<entry>2011-08-24</entry>
	</dates>
	</vuln>

	<vuln vid="3f1df2f9-cd22-11e0-9bb2-00215c6a37bb">
	<topic>PHP -- crypt() returns only the salt for MD5</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><ge>5.3.7</ge><lt>5.3.7_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP development team reports:</p>
	<blockquote cite="https://bugs.php.net/bug.php?id=55439">
	<p>If crypt() is executed with MD5 salts, the return value
	consists of the salt only. DES and BLOWFISH salts work as
	expected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugs.php.net/bug.php?id=55439</url>
	</references>
	<dates>
	<discovery>2011-08-17</discovery>
	<entry>2011-08-23</entry>
	<modified>2011-08-30</modified>
	</dates>
	</vuln>

	<vuln vid="057bf770-cac4-11e0-aea3-00215c6a37bb">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<name>php5-sockets</name>
	<range><lt>5.3.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP development team reports:</p>
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.3.7">
	<p>Security Enhancements and Fixes in PHP 5.3.7:</p>
	<ul>
	<li>Updated crypt_blowfish to 1.2. (CVE-2011-2483)</li>
	<li>Fixed crash in error_log(). Reported by Mateusz
	Kocielski</li>
	<li>Fixed buffer overflow on overlog salt in crypt().</li>
	<li>Fixed bug #54939 (File path injection vulnerability
	in RFC1867 File upload filename). Reported by Krzysztof
	Kotowicz. (CVE-2011-2202)</li>
	<li>Fixed stack buffer overflow in socket_connect().
	(CVE-2011-1938)</li>
	<li>Fixed bug #54238 (use-after-free in substr_replace()).
	(CVE-2011-1148)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>49241</bid>
	<cvename>CVE-2011-2483</cvename>
	<cvename>CVE-2011-2202</cvename>
	<cvename>CVE-2011-1938</cvename>
	<cvename>CVE-2011-1148</cvename>
	</references>
	<dates>
	<discovery>2011-08-18</discovery>
	<entry>2011-08-20</entry>
	</dates>
	</vuln>

	<vuln vid="be77eff6-ca91-11e0-aea3-00215c6a37bb">
	<topic>rubygem-rails -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>3.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/49179/discuss">
	<p>Ruby on Rails is prone to multiple vulnerabilities
	including SQL-injection, information-disclosure,
	HTTP-header-injection, security-bypass and cross-site
	scripting issues.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>49179</bid>
	<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b</url>
	<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6</url>
	<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768</url>
	<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12</url>
	<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195</url>
	</references>
	<dates>
	<discovery>2011-08-16</discovery>
	<entry>2011-08-19</entry>
	</dates>
	</vuln>

	<vuln vid="0b53f5f7-ca8a-11e0-aea3-00215c6a37bb">
	<topic>dovecot -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<range><lt>1.2.17</lt></range>
	<range><gt>2.0</gt><lt>2.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timo Sirainen reports:</p>
	<blockquote cite="http://dovecot.org/pipermail/dovecot/2011-May/059086.html">
	<p> Fixed potential crashes and other problems when parsing header
	names that contained NUL characters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>47930</bid>
	<cvename>CVE-2011-1929</cvename>
	</references>
	<dates>
	<discovery>2011-05-25</discovery>
	<entry>2011-08-19</entry>
	</dates>
	</vuln>

	<vuln vid="86baa0d4-c997-11e0-8a8e-00151735203a">
	<topic>OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><gt>2.1.*</gt><lt>3.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://otrs.org/advisory/OSA-2011-03-en/">
	<ul>
	<li>An attacker with valid session and admin permissions could
	get read access to any file on the servers local operating
	system. For this it would be needed minimum one installed
	OTRS package.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2746</cvename>
	<url>http://otrs.org/advisory/OSA-2011-03-en/</url>
	</references>
	<dates>
	<discovery>2011-08-16</discovery>
	<entry>2011-08-18</entry>
	</dates>
	</vuln>

	<vuln vid="834591a9-c82f-11e0-897d-6c626dd55a41">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.20,1</lt></range>
	<range><gt>5.0.*,1</gt><lt>6.0,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><lt>2.3</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.20,1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>3.1.12</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-29 Security issues addressed in Firefox 6</p>
	<p>MFSA 2011-28 Security issues addressed in Firefox 3.6.20</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-29.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-30.html</url>
	<cvename>CVE-2011-2982</cvename>
	<cvename>CVE-2011-0084</cvename>
	<cvename>CVE-2011-2981</cvename>
	<cvename>CVE-2011-2378</cvename>
	<cvename>CVE-2011-2984</cvename>
	<cvename>CVE-2011-2980</cvename>
	<cvename>CVE-2011-2983</cvename>
	<cvename>CVE-2011-2989</cvename>
	<cvename>CVE-2011-2991</cvename>
	<cvename>CVE-2011-2992</cvename>
	<cvename>CVE-2011-2985</cvename>
	<cvename>CVE-2011-2993</cvename>
	<cvename>CVE-2011-2988</cvename>
	<cvename>CVE-2011-2987</cvename>
	<cvename>CVE-2011-0084</cvename>
	<cvename>CVE-2011-2990</cvename>
	<cvename>CVE-2011-2986</cvename>
	</references>
	<dates>
	<discovery>2011-08-16</discovery>
	<entry>2011-08-16</entry>
	</dates>
	</vuln>

	<vuln vid="56f4b3a6-c82c-11e0-a498-00215c6a37bb">
	<topic>Samba -- cross site scripting and request forgery vulnerabilities</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.14</lt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba security advisory reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2522">
	<p>All current released versions of Samba are vulnerable to a
	cross-site request forgery in the Samba Web Administration Tool
	(SWAT). By tricking a user who is authenticated with SWAT into
	clicking a manipulated URL on a different web page, it is
	possible to manipulate SWAT.</p>
	</blockquote>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2694">
	<p>All current released versions of Samba are vulnerable to a
	cross-site scripting issue in the Samba Web Administration Tool
	(SWAT). On the "Change Password" field, it is possible to insert
	arbitrary content into the "user" field.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>48901</bid>
	<bid>48899</bid>
	<cvename>CVE-2011-2522</cvename>
	<cvename>CVE-2011-2694</cvename>
	</references>
	<dates>
	<discovery>2011-07-27</discovery>
	<entry>2011-08-16</entry>
	</dates>
	</vuln>

	<vuln vid="510b630e-c43b-11e0-916c-00e0815b8da8">
	<topic>isc-dhcp-server -- server halt upon processing certain packets</topic>
	<affects>
	<package>
	<name>isc-dhcp31-server</name>
	<range><lt>3.1.ESV_1,1</lt></range>
	</package>
	<package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_2,2</lt></range>
	</package>
	<package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-2748">
	<p>A pair of defects cause the server to halt upon processing
	certain packets. The patch is to properly discard or process
	those packets.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2748</cvename>
	<cvename>CVE-2011-2749</cvename>
	</references>
	<dates>
	<discovery>2011-08-10</discovery>
	<entry>2011-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="dc8741b9-c5d5-11e0-8a8e-00151735203a">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>2.4.*</ge><lt>3.6.6</lt></range>
	<range><ge>4.0.*</ge><lt>4.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.4.11/">
	<p>The following security issues have been discovered in Bugzilla:</p>
	<ul>
	<li>Internet Explorer 8 and older, and Safari before 5.0.6 do
	content sniffing when viewing a patch in "Raw Unified" mode,
	which could trigger a cross-site scripting attack due to
	the execution of malicious code in the attachment.</li>
	<li>It is possible to determine whether or not certain group
	names exist while creating or updating bugs.</li>
	<li>Attachment descriptions with a newline in them could lead
	to the injection of crafted headers in email notifications sent
	to the requestee or the requester when editing an attachment
	flag.</li>
	<li>If an attacker has access to a user's session, he can modify
	that user's email address without that user being notified
	of the change.</li>
	<li>Temporary files for uploaded attachments are not deleted
	on Windows, which could let a user with local access to
	the server read them.</li>
	<li>Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised,
	it can be used to inject HTML code when viewing a bug report,
	leading to a cross-site scripting attack.</li>
	</ul>
	<p>All affected installations are encouraged to upgrade as soon as
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2379</cvename>
	<cvename>CVE-2011-2380</cvename>
	<cvename>CVE-2011-2979</cvename>
	<cvename>CVE-2011-2381</cvename>
	<cvename>CVE-2011-2978</cvename>
	<cvename>CVE-2011-2977</cvename>
	<cvename>CVE-2011-2976</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=637981</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=653477</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=674497</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=657158</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=670868</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660502</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660053</url>
	</references>
	<dates>
	<discovery>2011-08-04</discovery>
	<entry>2011-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="879b0242-c5b6-11e0-abd1-0017f22d6707">
	<topic>dtc -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dtc</name>
	<range><lt>0.32.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ansgar Burchardt reports:</p>
	<blockquote cite="http://www.debian.org/security/2011/dsa-2179">
	<p>Ansgar Burchardt discovered several vulnerabilities in DTC, a
	web control panel for admin and accounting hosting services:
	The bw_per_moth.php graph contains an SQL injection
	vulnerability; insufficient checks in bw_per_month.php can lead
	to bandwidth usage information disclosure; after a registration,
	passwords are sent in cleartext email messages and Authenticated
	users could delete accounts using an obsolete interface which
	was incorrectly included in the package.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0434</cvename>
	<cvename>CVE-2011-0435</cvename>
	<cvename>CVE-2011-0436</cvename>
	<cvename>CVE-2011-0437</cvename>
	<url>http://www.debian.org/security/2011/dsa-2179</url>
	</references>
	<dates>
	<discovery>2011-03-02</discovery>
	<entry>2011-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="304409c3-c3ef-11e0-8aa5-485d60cb5385">
	<topic>libXfont -- possible local privilege escalation</topic>
	<affects>
	<package>
	<name>libXfont</name>
	<range><lt>1.4.4_1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tomas Hoger reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=725760">
	<p>The compress/ LZW decompress implentation does not correctly
	handle compressed streams that contain code words that were not
	yet added to the decompression table. This may lead to
	arbitrary memory corruption. Successfull exploitation may
	possible lead to a local privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2895</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=725760</url>
	</references>
	<dates>
	<discovery>2011-07-26</discovery>
	<entry>2011-08-11</entry>
	<modified>2012-03-13</modified>
	</dates>
	</vuln>

	<vuln vid="5d374b01-c3ee-11e0-8aa5-485d60cb5385">
	<topic>freetype2 -- execute arbitrary code or cause denial of service</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.4.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vincent Danen reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226">
	<p>Due to an error within the t1_decoder_parse_charstrings()
	function (src/psaux/t1decode.c) and can be exploited to corrupt
	memory by tricking a user into processing a specially-crafted
	postscript Type1 font in an application that uses the freetype
	library.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0226</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226</url>
	</references>
	<dates>
	<discovery>2011-07-19</discovery>
	<entry>2011-08-11</entry>
	</dates>
	</vuln>

	<vuln vid="2c12ae0c-c38d-11e0-8eb7-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r183.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-21.html">
	<p>Critical vulnerabilities have been identified in Adobe Flash
	Player 10.3.181.36 and earlier versions for Windows, Macintosh,
	Linux and Solaris, and Adobe Flash Player 10.3.185.25 and
	earlier versions for Android. These vulnerabilities could
	cause a crash and potentially allow an attacker to take control
	of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2130</cvename>
	<cvename>CVE-2011-2134</cvename>
	<cvename>CVE-2011-2135</cvename>
	<cvename>CVE-2011-2136</cvename>
	<cvename>CVE-2011-2137</cvename>
	<cvename>CVE-2011-2138</cvename>
	<cvename>CVE-2011-2139</cvename>
	<cvename>CVE-2011-2140</cvename>
	<cvename>CVE-2011-2414</cvename>
	<cvename>CVE-2011-2415</cvename>
	<cvename>CVE-2011-2416</cvename>
	<cvename>CVE-2011-2417</cvename>
	<cvename>CVE-2011-2425</cvename>
	<url>https://www.adobe.com/support/security/bulletins/apsb11-21.html</url>
	</references>
	<dates>
	<discovery>2011-05-13</discovery>
	<entry>2011-08-10</entry>
	<modified>2012-11-05</modified>
	</dates>
	</vuln>

	<vuln vid="30cb4522-b94d-11e0-8182-485d60cb5385">
	<topic>libsoup -- unintentionally allow access to entire local filesystem</topic>
	<affects>
	<package>
	<name>libsoup</name>
	<range><lt>2.32.2_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dan Winship reports:</p>
	<blockquote cite="http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html">
	<p>Fixed a security hole that caused some SoupServer users to
	unintentionally allow accessing the entire local filesystem when
	they thought they were only providing access to a single
	directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2054</cvename>
	<url>http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=653258</url>
	</references>
	<dates>
	<discovery>2011-06-23</discovery>
	<entry>2011-07-28</entry>
	</dates>
	</vuln>

	<vuln vid="d79fc873-b5f9-11e0-89b4-001ec9578670">
	<topic>phpmyadmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php">
	<p>XSS in table Print view.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php">
	<p>Via a crafted MIME-type transformation parameter, an attacker can
	perform a local file inclusion.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php">
	<p>In the 'relational schema' code a parameter was not sanitized before
	being used to concatenate a class name.</p>
	<p>The end result is a local file inclusion vulnerability and code
	execution.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php">
	<p>It was possible to manipulate the PHP session superglobal using
	some of the Swekey authentication code.</p>
	<p>This is very similar to PMASA-2011-5, documented in
	7e4e5c53-a56c-11e0-b180-00216aa06fc2</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2642</cvename>
	<cvename>CVE-2011-2643</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php</url>
	</references>
	<dates>
	<discovery>2011-07-23</discovery>
	<entry>2011-07-24</entry>
	<modified>2011-07-28</modified>
	</dates>
	</vuln>

	<vuln vid="9f14cb36-b6fc-11e0-a044-445c73746d79">
	<topic>opensaml2 -- unauthenticated login</topic>
	<affects>
	<package>
	<name>opensaml2</name>
	<range><gt>0</gt><lt>2.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSAML developer reports:</p>
	<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20110725.txt">
	<p>The Shibboleth software relies on the OpenSAML libraries to
	perform verification of signed XML messages such as attribute
	queries or SAML assertions. Both the Java and C++ versions are
	vulnerable to a so-called "wrapping attack" that allows a remote,
	unauthenticated attacker to craft specially formed messages that
	can be successfully verified, but contain arbitrary content.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1411</cvename>
	<mlist msgid="CA530061.113D6%cantor.2@osu.edu">https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9</mlist>
	</references>
	<dates>
	<discovery>2011-07-25</discovery>
	<entry>2011-07-25</entry>
	</dates>
	</vuln>

	<vuln vid="9a777c23-b310-11e0-832d-00215c6a37bb">
	<topic>rsync -- incremental recursion memory corruption vulnerability</topic>
	<affects>
	<package>
	<name>rsync</name>
	<range><gt>3.0</gt><lt>3.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>rsync development team reports:</p>
	<blockquote cite="http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS">
	<p>Fixed a data-corruption issue when preserving hard-links
	without preserving file ownership, and doing deletions either
	before or during the transfer (CVE-2011-1097). This
	fixes some assert errors in the hard-linking code, and some
	potential failed checksums (via -c) that should have matched.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1097</cvename>
	<url>https://bugzilla.samba.org/show_bug.cgi?id=7936</url>
	</references>
	<dates>
	<discovery>2011-04-08</discovery>
	<entry>2011-07-20</entry>
	</dates>
	</vuln>

	<vuln vid="fd64188d-a71d-11e0-89b4-001ec9578670">
	<topic>BIND -- Remote DoS against authoritative and recursive servers</topic>
	<affects>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R4.3</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.3.3</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2464">
	<p>A defect in the affected BIND 9 versions allows an attacker to
	remotely cause the "named" process to exit using a specially
	crafted packet.</p>
	<p>This defect affects both recursive and authoritative servers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2464</cvename>
	<url>https://www.isc.org/software/bind/advisories/cve-2011-2464</url>
	</references>
	<dates>
	<discovery>2011-07-05</discovery>
	<entry>2011-07-05</entry>
	</dates>
	</vuln>

	<vuln vid="4ccee784-a721-11e0-89b4-001ec9578670">
	<topic>BIND -- Remote DoS with certain RPZ configurations</topic>
	<affects>
	<package>
	<name>bind98</name>
	<range><lt>9.8.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2465">
	<p>Two defects were discovered in ISC's BIND 9.8 code. These
	defects only affect BIND 9.8 servers which have recursion
	enabled and which use a specific feature of the software known
	as Response Policy Zones (RPZ) and where the RPZ zone contains
	a specific rule/action pattern.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2465</cvename>
	<url>https://www.isc.org/software/bind/advisories/cve-2011-2465</url>
	</references>
	<dates>
	<discovery>2011-07-05</discovery>
	<entry>2011-07-05</entry>
	</dates>
	</vuln>

	<vuln vid="7e4e5c53-a56c-11e0-b180-00216aa06fc2">
	<topic>phpmyadmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin development team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php">
	<p>It was possible to manipulate the PHP session superglobal using
	some of the Swekey authentication code. This could open a path
	for other attacks.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php">
	<p>An unsanitized key from the Servers array is written in a comment
	of the generated config. An attacker can modify this key by
	modifying the SESSION superglobal array. This allows the attacker
	to close the comment and inject code.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php">
	<p>Through a possible bug in PHP running on Windows systems a NULL
	byte can truncate the pattern string allowing an attacker to
	inject the /e modifier causing the preg_replace function to
	execute its second argument as PHP code.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php">
	<p>Fixed filtering of a file path in the MIME-type transformation
	code, which allowed for directory traversal.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2505</cvename>
	<cvename>CVE-2011-2506</cvename>
	<cvename>CVE-2011-2507</cvename>
	<cvename>CVE-2011-2508</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php</url>
	</references>
	<dates>
	<discovery>2011-07-02</discovery>
	<entry>2011-07-03</entry>
	<modified>2011-07-28</modified>
	</dates>
	</vuln>

	<vuln vid="40544e8c-9f7b-11e0-9bec-6c626dd55a41">
	<topic>Asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.41.2</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.18.2</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk Development Team reports:</p>
	<blockquote cite="http://www.asterisk.org/node/51650">
	<p>AST-2011-008: If a remote user sends a SIP packet containing a
	NULL, Asterisk assumes available data extends past the null to
	the end of the packet when the buffer is actually truncated when
	copied. This causes SIP header parsing to modify data past the
	end of the buffer altering unrelated memory structures. This
	vulnerability does not affect TCP/TLS connections.</p>
	<p>AST-2011-009: A remote user sending a SIP packet containing a
	Contact header with a missing left angle bracket causes Asterisk
	to access a null pointer.</p>
	<p>AST-2011-010: A memory address was inadvertently transmitted
	over the network via IAX2 via an option control frame and the
	remote party would try to access it.</p>
	<p>Possible enumeration of SIP users due to differing
	authentication responses.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2529</cvename>
	<cvename>CVE-2011-2535</cvename>
	<cvename>CVE-2011-2536</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-008.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-009.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-010.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-011.html</url>
	</references>
	<dates>
	<discovery>2011-06-24</discovery>
	<entry>2011-06-25</entry>
	<modified>2011-06-29</modified>
	</dates>
	</vuln>

	<vuln vid="01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6">
	<topic>ejabberd -- remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>ejabberd</name>
	<range><lt>2.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>It's reported in CVE advisory that:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1753">
	<p>expat_erl.c in ejabberd before 2.1.7 and 3.x before
	3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect
	recursion during entity expansion, which allows remote attackers
	to cause a denial of service (memory and CPU consumption) via a
	crafted XML document containing a large number of nested entity
	references, a similar issue to CVE-2003-1564.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1753</cvename>
	<url>http://www.ejabberd.im/ejabberd-2.1.7</url>
	</references>
	<dates>
	<discovery>2011-04-27</discovery>
	<entry>2011-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="dfe40cff-9c3f-11e0-9bec-6c626dd55a41">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.20,1</lt></range>
	<range><gt>3.6.*,1</gt><lt>3.6.18,1</lt></range>
	<range><gt>4.0.*,1</gt><lt>5.0,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.18,1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>3.1.11</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-19 Miscellaneous memory safety hazards
	(rv:3.0/1.9.2.18)</p>
	<p>MFSA 2011-20 Use-after-free vulnerability when viewing XUL
	document with script disabled</p>
	<p>MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace
	images</p>
	<p>MFSA 2011-22 Integer overflow and arbitrary code execution in
	Array.reduceRight()</p>
	<p>MFSA 2011-23 Multiple dangling pointer vulnerabilities</p>
	<p>MFSA 2011-24 Cookie isolation error</p>
	<p>MFSA 2011-25 Stealing of cross-domain images using WebGL
	textures</p>
	<p>MFSA 2011-26 Multiple WebGL crashes</p>
	<p>MFSA 2011-27 XSS encoding hazard with inline SVG</p>
	<p>MFSA 2011-28 Non-whitelisted site can trigger xpinstall</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-19.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-20.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-21.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-22.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-23.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-24.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-25.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-26.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-27.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-28.html</url>
	</references>
	<dates>
	<discovery>2011-06-21</discovery>
	<entry>2011-06-21</entry>
	<modified>2011-06-23</modified>
	</dates>
	</vuln>

	<vuln vid="bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41">
	<topic>Samba -- Denial of service - memory corruption</topic>
	<affects>
	<package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.12</lt></range>
	</package>
	<package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba team reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2011-0719.html">
	<p>Samba is vulnerable to a denial of service, caused by a memory
	corruption error related to missing range checks on file
	descriptors being used in the "FD_SET" macro. By performing a
	select on a bad file descriptor set, a remote attacker could
	exploit this vulnerability to cause the application to crash or
	possibly execute arbitrary code on the system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0719</cvename>
	<url>http://www.samba.org/samba/security/CVE-2011-0719.html</url>
	<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719</url>
	</references>
	<dates>
	<discovery>2011-02-28</discovery>
	<entry>2011-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="23c8423e-9bff-11e0-8ea2-0019d18c446a">
	<topic>Piwik -- remote command execution vulnerability</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><ge>1.2</ge><lt>1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Piwik security advisory reports:</p>
	<blockquote cite="http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/">
	<p>The Piwik 1.5 release addresses a critical security
	vulnerability, which affect all Piwik users that have let
	granted some access to the "anonymous" user.</p>
	<p>Piwik contains a remotely exploitable vulnerability that could
	allow a remote attacker to execute arbitrary code. Only
	installations that have granted untrusted view access to their
	stats (ie. grant "view" access to a website to anonymous) are
	at risk.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/158084</freebsdpr>
	<url>http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/</url>
	</references>
	<dates>
	<discovery>2011-06-21</discovery>
	<entry>2011-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="0b535cd0-9b90-11e0-800a-00215c6a37bb">
	<topic>Dokuwiki -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20110525a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dokuwiki reports:</p>
	<blockquote cite="http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind">
	<p>We just released a Hotfix Release "2011-05-25a Rincewind".
	It contains the following changes:</p>
	<p>Security fix for a Cross Site Scripting vulnerability.
	Malicious users could abuse DokuWiki's RSS embedding mechanism
	to create links containing arbitrary JavaScript. Note: this
	security problem is present in at least Anteater and Rincewind
	but probably in older releases as well.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind</url>
	</references>
	<dates>
	<discovery>2011-06-14</discovery>
	<entry>2011-06-20</entry>
	</dates>
	</vuln>

	<vuln vid="55a528e8-9787-11e0-b24a-001b2134ef46">
	<topic>linux-flashplugin -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r181.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-18.html">
	<p>A critical vulnerability has been identified in Adobe Flash
	Player 10.3.181.23 and earlier versions for Windows, Macintosh,
	Linux and Solaris, and Adobe Flash Player 10.3.185.23 and
	earlier versions for Android. This memory corruption
	vulnerability (CVE-2011-2110) could cause a crash and
	potentially allow an attacker to take control of the affected
	system. There are reports that this vulnerability is being
	exploited in the wild in targeted attacks via malicious Web
	pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2110</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb11-18.html</url>
	</references>
	<dates>
	<discovery>2011-05-13</discovery>
	<entry>2011-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="3145faf1-974c-11e0-869e-000c29249b2e">
	<topic>ikiwiki -- tty hijacking via ikiwiki-mass-rebuild</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>3.20110608</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The IkiWiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index40h2">
	<p>Ludwig Nussel discovered a way for users to hijack root's tty
	when ikiwiki-mass-rebuild was run. Additionally, there was
	some potential for information disclosure via symlinks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1408</cvename>
	<url>http://ikiwiki.info/security/#index40h2</url>
	</references>
	<dates>
	<discovery>2011-06-08</discovery>
	<entry>2011-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="57573136-920e-11e0-bdc9-001b2134ef46">
	<topic>linux-flashplugin -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r181.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-13.html">
	<p>An important vulnerability has been identified in Adobe
	Flash Player 10.3.181.16 and earlier versions for Windows,
	Macintosh, Linux and Solaris, and Adobe Flash Player
	10.3.185.22 and earlier versions for Android. This universal
	cross-site scripting vulnerability (CVE-2011-2107) could be
	used to take actions on a user's behalf on any website or
	webmail provider, if the user visits a malicious website.
	There are reports that this vulnerability is being exploited
	in the wild in active targeted attacks designed to trick
	the user into clicking on a malicious link delivered in an
	email message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2107</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb11-13.html</url>
	</references>
	<dates>
	<discovery>2011-05-13</discovery>
	<entry>2011-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="1e1421f0-8d6f-11e0-89b4-001ec9578670">
	<topic>BIND -- Large RRSIG RRsets and Negative Caching DoS</topic>
	<affects>
	<package>
	<name>bind9-sdb-ldap</name>
	<name>bind9-sdb-postgresql</name>
	<range><lt>9.4.3.4</lt></range>
	</package>
	<package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R4.1</lt></range>
	</package>
	<package>
	<name>bind97</name>
	<range><lt>9.7.3.1</lt></range>
	</package>
	<package>
	<name>bind98</name>
	<range><lt>9.8.0.2</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_6</lt></range>
	<range><ge>7.4</ge><lt>7.4_2</lt></range>
	<range><ge>8.1</ge><lt>8.1_4</lt></range>
	<range><ge>8.2</ge><lt>8.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2011-1910">
	<p>A BIND 9 DNS server set up to be a caching resolver is
	vulnerable to a user querying a domain with very large resource
	record sets (RRSets) when trying to negatively cache a response.
	This can cause the BIND 9 DNS server (named process) to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1910</cvename>
	<freebsdsa>SA-11:02.bind</freebsdsa>
	<url>http://www.isc.org/software/bind/advisories/cve-2011-1910</url>
	</references>
	<dates>
	<discovery>2011-05-26</discovery>
	<entry>2011-06-04</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="f7d838f2-9039-11e0-a051-080027ef73ec">
	<topic>fetchmail -- STARTTLS denial of service</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><lt>6.3.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2011-01.txt">
	<p>Fetchmail version 5.9.9 introduced STLS support for POP3,
	version 6.0.0 added STARTTLS for IMAP. However, the actual
	S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded
	by a timeout.</p>
	<p>Depending on the operating system defaults as to TCP stream
	keepalive mode, fetchmail hangs in excess of one week after
	sending STARTTLS were observed if the connection failed without
	notifying the operating system, for instance, through network
	outages or hard server crashes.</p>
	<p>A malicious server that does not respond, at the network level,
	after acknowledging fetchmail's STARTTLS or STLS request, can
	hold fetchmail in this protocol state, and thus render fetchmail
	unable to complete the poll, or proceed to the next server,
	effecting a denial of service.</p>
	<p>SSL-wrapped mode on dedicated ports was unaffected by this
	problem, so can be used as a workaround.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1947</cvename>
	<url>http://www.fetchmail.info/fetchmail-SA-2011-01.txt</url>
	<url>https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314</url>
	</references>
	<dates>
	<discovery>2011-04-28</discovery>
	<entry>2011-06-06</entry>
	</dates>
	</vuln>

	<vuln vid="34ce5817-8d56-11e0-b5a2-6c626dd55a41">
	<topic>asterisk -- Remote crash vulnerability</topic>
	<affects>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk Development Team reports:</p>
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-June/000325.html">
	<p>If a remote user initiates a SIP call and the recipient picks
	up, the remote user can reply with a malformed Contact header
	that Asterisk will improperly handle and cause a crash due to a
	segmentation fault.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-2216</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-007.pdf</url>
	</references>
	<dates>
	<discovery>2011-06-02</discovery>
	<entry>2011-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="e27a1af3-8d21-11e0-a45d-001e8c75030d">
	<topic>Subversion -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><lt>1.6.17</lt></range>
	</package>
	<package>
	<name>subversion-freebsd</name>
	<range><lt>1.6.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion team reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-1752-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module will
	dereference a NULL pointer if asked to deliver baselined WebDAV
	resources.</p>
	<p>This can lead to a DoS. An exploit has been tested, and tools
	or users have been observed triggering this problem in the
	wild.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-1783-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module may in
	certain scenarios enter a logic loop which does not exit and
	which allocates memory in each iteration, ultimately exhausting
	all the available memory on the server.</p>
	<p>This can lead to a DoS. There are no known instances of this
	problem being observed in the wild, but an exploit has been
	tested.</p>
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-1921-advisory.txt">
	<p>Subversion's mod_dav_svn Apache HTTPD server module may leak to
	remote users the file contents of files configured to be
	unreadable by those users.</p>
	<p>There are no known instances of this problem being observed in
	the wild, but an exploit has been tested.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1752</cvename>
	<cvename>CVE-2011-1783</cvename>
	<cvename>CVE-2011-1921</cvename>
	</references>
	<dates>
	<discovery>2011-05-28</discovery>
	<entry>2011-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="1acf9ec5-877d-11e0-b937-001372fd0af2">
	<topic>drupal6 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal6</name>
	<range><lt>6.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/node/1168756">
	<p>A reflected cross site scripting vulnerability was discovered
	in Drupal's error handler. Drupal displays PHP errors in the
	messages area, and a specially crafted URL can cause malicious
	scripts to be injected into the message. The issue can be
	mitigated by disabling on-screen error display at admin /
	settings / error-reporting. This is the recommended setting
	for production sites.</p>
	<p>When using re-colorable themes, color inputs are not sanitized.
	Malicious color values can be used to insert arbitrary CSS and
	script code. Successful exploitation requires the "Administer
	themes" permission.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/1168756</url>
	</references>
	<dates>
	<discovery>2011-05-25</discovery>
	<entry>2011-05-26</entry>
	</dates>
	</vuln>

	<vuln vid="e4833927-86e5-11e0-a6b4-000a5e1e33c6">
	<topic>Erlang -- ssh library uses a weak random number generator</topic>
	<affects>
	<package>
	<name>erlang</name>
	<range><lt>r14b03</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/178990">
	<p>The Erlang/OTP ssh library implements a number of
	cryptographic operations that depend on cryptographically
	strong random numbers. Unfortunately the RNG used by the
	library is not cryptographically strong, and is further
	weakened by the use of predictable seed material. The RNG
	(Wichman-Hill) is not mixed with an entropy source.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0766</cvename>
	<url>http://www.erlang.org/download/otp_src_R14B03.readme</url>
	<url>https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5</url>
	</references>
	<dates>
	<discovery>2011-05-25</discovery>
	<entry>2011-05-25</entry>
	</dates>
	</vuln>

	<vuln vid="dc96ac1f-86b1-11e0-9e85-00215af774f0">
	<topic>Unbound -- an empty error packet handling assertion failure</topic>
	<affects>
	<package>
	<name>unbound</name>
	<range><lt>1.4.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unbound developer reports:</p>
	<blockquote cite="http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt">
	<p>NLnet Labs was notified of an error in Unbound's code-path
	for error replies which is triggered under special conditions.
	The error causes the program to abort.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1922</cvename>
	<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt</url>
	</references>
	<dates>
	<discovery>2011-05-25</discovery>
	<entry>2011-05-25</entry>
	</dates>
	</vuln>

	<vuln vid="115a1389-858e-11e0-a76c-000743057ca2">
	<topic>Pubcookie Login Server -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>pubcookie-login-server</name>
	<range><lt>3.3.2d</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nathan Dors, Pubcookie Project reports:</p>
	<blockquote cite="http://pubcookie.org/news/20070606-login-secadv.html">
	<p>A new non-persistent XSS vulnerability was found in the
	Pubcookie login server's compiled binary "index.cgi" CGI
	program. The CGI program mishandles untrusted data when
	printing responses to the browser. This makes the program
	vulnerable to carefully crafted requests containing script
	or HTML. If an attacker can lure an unsuspecting user to
	visit carefully staged content, the attacker can use it to
	redirect the user to his or her local Pubcookie login page
	and attempt to exploit the XSS vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://pubcookie.org/news/20070606-login-secadv.html</url>
	</references>
	<dates>
	<discovery>2007-05-25</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="1ca8228f-858d-11e0-a76c-000743057ca2">
	<topic>mod_pubcookie -- Empty Authentication Security Advisory</topic>
	<affects>
	<package>
	<name>ap20-mod_pubcookie</name>
	<range><ge>3.1.0</ge><lt>3.3.2b</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nathan Dors, Pubcookie Project reports:</p>
	<blockquote cite="http://pubcookie.org/news/20061106-empty-auth-secadv.html">
	<p>An Abuse of Functionality vulnerability in the Pubcookie
	authentication process was found. This vulnerability allows an
	attacker to appear as if he or she were authenticated using an
	empty userid when such a userid isn't expected. Unauthorized
	access to web content and applications may result where access
	is restricted to users who can authenticate successfully but
	where no additional authorization is performed after
	authentication.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://pubcookie.org/news/20061106-empty-auth-secadv.html</url>
	</references>
	<dates>
	<discovery>2006-10-04</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="7af2fb85-8584-11e0-96b7-00300582f9fc">
	<topic>ViewVC -- user-reachable override of cvsdb row limit</topic>
	<affects>
	<package>
	<name>viewvc</name>
	<range><lt>1.1.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ViewVC.org reports:</p>
	<blockquote cite="http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2536&r2=2574">
	<p>Security fix: remove user-reachable override of cvsdb row limit.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://viewvc.tigris.org/source/browse/checkout/viewvc/branches/1.1.x/CHANGES</url>
	</references>
	<dates>
	<discovery>2011-05-17</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="99a5590c-857e-11e0-96b7-00300582f9fc">
	<topic>Apache APR -- DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>apr1</name>
	<range><lt>1.4.5.1.3.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Portable Runtime Project reports:</p>
	<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
	<p>A flaw was discovered in the apr_fnmatch() function in the
	Apache Portable Runtime (APR) library 1.4.4 (or any backported
	versions that contained the upstream fix for CVE-2011-0419).
	This could cause httpd workers to enter a hung state (100% CPU
	utilization).</p>
	<p>apr-util 1.3.11 could cause crashes with httpd's
	mod_authnz_ldap in some situations.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>47929</bid>
	<cvename>CVE-2011-1928</cvename>
	<cvename>CVE-2011-0419</cvename>
	<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928</url>
	</references>
	<dates>
	<discovery>2011-05-19</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="d226626c-857f-11e0-95cc-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r181.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-12.html">
	<p>Critical vulnerabilities have been identified in Adobe Flash
	Player 10.2.159.1 and earlier versions (Adobe Flash Player
	10.2.154.28 and earlier for Chrome users) for Windows,
	Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51
	and earlier versions for Android. These vulnerabilities could
	cause the application to crash and could potentially allow an
	attacker to take control of the affected system. There are
	reports of malware attempting to exploit one of the
	vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf)
	file embedded in a Microsoft Word (.doc) or Microsoft Excel
	(.xls) file delivered as an email attachment targeting the
	Windows platform. However, to date, Adobe has not obtained a
	sample that successfully completes an attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0579</cvename>
	<cvename>CVE-2011-0618</cvename>
	<cvename>CVE-2011-0619</cvename>
	<cvename>CVE-2011-0620</cvename>
	<cvename>CVE-2011-0621</cvename>
	<cvename>CVE-2011-0622</cvename>
	<cvename>CVE-2011-0623</cvename>
	<cvename>CVE-2011-0624</cvename>
	<cvename>CVE-2011-0625</cvename>
	<cvename>CVE-2011-0626</cvename>
	<cvename>CVE-2011-0627</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb11-12.html</url>
	</references>
	<dates>
	<discovery>2011-01-20</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="e666498a-852a-11e0-8f78-080027ef73ec">
	<topic>Opera -- code injection vulnerability through broken frameset handling</topic>
	<affects>
	<package><name>opera</name><range><lt>11.11</lt></range></package>
	<package><name>opera-devel</name><range><lt>11.11</lt></range></package>
	<package><name>linux-opera</name><range><lt>11.11</lt></range></package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Software ASA reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1111/">
	<p>Fixed an issue with framesets that could allow execution of
	arbitrary code, as reported by an anonymous contributor working
	with the SecuriTeam Secure Disclosure program.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/docs/changelogs/unix/1111/</url>
	<url>http://www.opera.com/support/kb/view/992/</url>
	</references>
	<dates>
	<discovery>2011-05-18</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="1495f931-8522-11e0-a1c1-00215c6a37bb">
	<topic>pureftpd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>pure-ftpd</name>
	<range><lt>1.0.32</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pure-FTPd development team reports:</p>
	<blockquote cite="http://www.pureftpd.org/project/pure-ftpd/news">
	<p>Support for braces expansion in directory listings has been
	disabled -- Cf. CVE-2011-0418.</p>
	<p>Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411.
	If you're using TLS, upgrading is recommended.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>46767</bid>
	<cvename>CVE-2011-0418</cvename>
	<cvename>CVE-2011-1575</cvename>
	</references>
	<dates>
	<discovery>2011-04-01</discovery>
	<entry>2011-05-23</entry>
	</dates>
	</vuln>

	<vuln vid="36594c54-7be7-11e0-9838-0022156e8794">
	<topic>Exim -- remote code execution and information disclosure</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><ge>4.70</ge><lt>4.76</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Release notes for Exim 4.76 says:</p>
	<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.76">
	<p>Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to
	a format-string attack -- SECURITY: remote arbitrary code
	execution.</p>
	<p>DKIM signature header parsing was double-expanded, second
	time unintentionally subject to list matching rules, letting
	the header cause arbitrary Exim lookups (of items which can
	occur in lists, not arbitrary string expansion). This
	allowed for information disclosure.</p>
	</blockquote>
	<p>Also, impact assessment was redone shortly after the original
	announcement:</p>
	<blockquote cite="https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html">
	<p>Further analysis revealed that the second security was
	more severe than I realised at the time that I wrote the
	announcement. The second security issue has been assigned
	CVE-2011-1407 and is also a remote code execution flaw.
	For clarity: both issues were introduced with 4.70.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1764</cvename>
	<cvename>CVE-2011-1407</cvename>
	<mlist msgid="20110512102909.GA58484@redoubt.spodhuis.org">https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html</mlist>
	<url>http://bugs.exim.org/show_bug.cgi?id=1106</url>
	</references>
	<dates>
	<discovery>2011-05-10</discovery>
	<entry>2011-05-14</entry>
	</dates>
	</vuln>

	<vuln vid="00b296b6-7db1-11e0-96b7-00300582f9fc">
	<topic>Apache APR -- DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>apr1</name>
	<range><lt>1.4.4.1.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Portable Runtime Project reports:</p>
	<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
	<p>Note especially a security fix to APR 1.4.4, excessive CPU
	consumption was possible due to an unconstrained, recursive
	invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards.
	Reimplement apr_fnmatch() from scratch using a non-recursive
	algorithm now has improved compliance with the fnmatch() spec.
	(William Rowe)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0419</cvename>
	<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
	</references>
	<dates>
	<discovery>2011-05-10</discovery>
	<entry>2011-05-12</entry>
	</dates>
	</vuln>

	<vuln vid="34e8ccf5-7d71-11e0-9d83-000c29cc39d3">
	<topic>Zend Framework -- potential SQL injection when using PDO_MySql</topic>
	<affects>
	<package>
	<name>ZendFramework</name>
	<range><lt>1.11.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Zend Framework team reports:</p>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2011-02">
	<p>Developers using non-ASCII-compatible encodings in conjunction
	with the MySQL PDO driver of PHP may be vulnerable to SQL
	injection attacks. Developers using ASCII-compatible encodings
	like UTF8 or latin1 are not affected by this PHP issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://framework.zend.com/security/advisory/ZF2011-02</url>
	<url>http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html</url>
	</references>
	<dates>
	<discovery>2011-05-06</discovery>
	<entry>2011-05-13</entry>
	</dates>
	</vuln>

	<vuln vid="3fadb7c6-7b0a-11e0-89b4-001ec9578670">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><lt>1.16.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mediawiki reports:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html">
	<p>(Bug 28534) XSS vulnerability for IE 6 clients. This is the
	third attempt at fixing bug 28235.</p>
	<p>(Bug 28639) Potential privilege escalation when
	$wgBlockDisablesLogin is enabled.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28534</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28639</url>
	<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html</url>
	<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES</url>
	</references>
	<dates>
	<discovery>2011-04-14</discovery>
	<entry>2011-05-12</entry>
	</dates>
	</vuln>

	<vuln vid="3eb2c100-738b-11e0-89f4-001e90d46635">
	<topic>Postfix -- memory corruption vulnerability</topic>
	<affects>
	<package>
	<name>postfix</name>
	<name>postfix-base</name>
	<range><ge>2.8.*,1</ge><lt>2.8.3,1</lt></range>
	<range><ge>2.7.*,1</ge><lt>2.7.4,1</lt></range>
	<range><ge>2.6.*,1</ge><lt>2.6.10,1</lt></range>
	<range><ge>2.5.*,2</ge><lt>2.5.13,2</lt></range>
	<range><le>2.4.16,1</le></range>
	</package>
	<package>
	<name>postfix-current</name>
	<name>postfix-current-base</name>
	<range><lt>2.9.20110501,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Postfix SMTP server has a memory corruption error, when the
	Cyrus SASL library is used with authentication mechanisms other
	than PLAIN and LOGIN (ANONYMOUS is not affected, but should not
	be used for other reasons). This memory corruption is known to
	result in a program crash (SIGSEV).</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1720</cvename>
	<url>http://www.postfix.org/CVE-2011-1720.html</url>
	</references>
	<dates>
	<discovery>2011-05-09</discovery>
	<entry>2011-05-09</entry>
	</dates>
	</vuln>

	<vuln vid="04b7d46c-7226-11e0-813a-6c626dd55a41">
	<topic>Mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.17,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.19,1</lt></range>
	<range><gt>4.0.*,1</gt><lt>4.0.1,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.17</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.17,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.19</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-12 Miscellaneous memory safety hazards</p>
	<p>MFSA 2011-13 Multiple dangling pointer vulnerabilities</p>
	<p>MFSA 2011-14 Information stealing via form history</p>
	<p>MFSA 2011-15 Escalation of privilege through Java Embedding Plugin</p>
	<p>MFSA 2011-16 Directory traversal in resource: protocol</p>
	<p>MFSA 2011-17 WebGLES vulnerabilities</p>
	<p>MFSA 2011-18 XSLT generate-id() function heap address leak</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-12.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-13.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-14.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-15.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-16.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-17.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-18.html</url>
	</references>
	<dates>
	<discovery>2011-04-28</discovery>
	<entry>2011-04-29</entry>
	</dates>
	</vuln>

	<vuln vid="3c7d565a-6c64-11e0-813a-6c626dd55a41">
	<topic>Asterisk -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.40.1</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.17.3</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.3.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk Development Team reports:</p>
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-April/000316.html">
	<p>It is possible for a user of the Asterisk Manager Interface to
	bypass a security check and execute shell commands when they
	should not have that ability. Sending the "Async" header with
	the "Application" header during an Originate action, allows
	authenticated manager users to execute shell commands. Only
	users with the "system" privilege should be able to do this.</p>
	<p>On systems that have the Asterisk Manager Interface, Skinny, SIP
	over TCP, or the built in HTTP server enabled, it is possible for
	an attacker to open as many connections to asterisk as he wishes.
	This will cause Asterisk to run out of available file descriptors
	and stop processing any new calls. Additionally, disk space can
	be exhausted as Asterisk logs failures to open new file
	descriptors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1507</cvename>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-005.pdf</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-006.pdf</url>
	</references>
	<dates>
	<discovery>2011-04-21</discovery>
	<entry>2011-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="6a4bfe75-692a-11e0-bce7-001eecdd401a">
	<topic>VLC -- Heap corruption in MP4 demultiplexer</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><ge>1.0.0</ge><lt>1.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>VideoLAN project reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa1103.html">
	<p>When parsing some MP4 (MPEG-4 Part 14) files, insufficient
	buffer size might lead to corruption of the heap.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.videolan.org/security/sa1103.html</url>
	</references>
	<dates>
	<discovery>2011-04-07</discovery>
	<entry>2011-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="32b05547-6913-11e0-bdc4-001b2134ef46">
	<topic>linux-flashplugin -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.2r159.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-02.html">
	<p>A critical vulnerability exists in Flash Player 10.2.153.1
	and earlier versions (Adobe Flash Player 10.2.154.25 and
	earlier for Chrome users) for Windows, Macintosh, Linux
	and Solaris, Adobe Flash Player 10.2.156.12 and earlier
	versions for Android, and the Authplay.dll component that
	ships with Adobe Reader and Acrobat X (10.0.2) and earlier
	10.x and 9.x versions for Windows and Macintosh operating
	systems.</p>
	<p>This vulnerability (CVE-2011-0611) could cause a crash
	and potentially allow an attacker to take control of the
	affected system. There are reports that this vulnerability
	is being exploited in the wild in targeted attacks via a
	malicious Web page or a Flash (.swf) file embedded in a
	Microsoft Word (.doc) or Microsoft Excel (.xls) file
	delivered as an email attachment, targeting the Windows
	platform. At this time, Adobe is not aware of any attacks
	via PDF targeting Adobe Reader and Acrobat. Adobe Reader
	X Protected Mode mitigations would prevent an exploit of
	this kind from executing.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0611</cvename>
	<url>http://www.adobe.com/support/security/advisories/apsa11-02.html</url>
	</references>
	<dates>
	<discovery>2011-01-20</discovery>
	<entry>2011-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="bf171509-68dd-11e0-afe6-0003ba02bf30">
	<topic>rt -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>rt36</name>
	<range><lt>3.6.11</lt></range>
	</package>
	<package>
	<name>rt38</name>
	<range><lt>3.8.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Best Practical reports:</p>
	<blockquote cite="http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html">
	<p>In the process of preparing the release of RT 4.0.0, we performed
	an extensive security audit of RT's source code. During this
	audit, several vulnerabilities were found which affect earlier
	releases of RT.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1685</cvename>
	<cvename>CVE-2011-1686</cvename>
	<cvename>CVE-2011-1687</cvename>
	<cvename>CVE-2011-1688</cvename>
	<cvename>CVE-2011-1689</cvename>
	<cvename>CVE-2011-1690</cvename>
	<url>http://secunia.com/advisories/44189</url>
	</references>
	<dates>
	<discovery>2011-04-14</discovery>
	<entry>2011-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="6a3c3e5c-66cb-11e0-a116-c535f3aa24f0">
	<topic>krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285]</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.4</lt></range>
	<range><eq>1.9</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by the MIT Kerberos team says:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt">
	<p>The password-changing capability of the MIT krb5 administration
	daemon (kadmind) has a bug that can cause it to attempt to free()
	an invalid pointer under certain error conditions. This can cause
	the daemon to crash or induce the execution of arbitrary code
	(which is believed to be difficult). No exploit that executes
	arbitrary code is known to exist, but it is easy to trigger a
	denial of service manually.</p>
	<p>Some platforms detect attempted freeing of invalid pointers and
	protectively terminate the process, preventing arbitrary code
	execution on those platforms.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0285</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt</url>
	</references>
	<dates>
	<discovery>2011-04-12</discovery>
	<entry>2011-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="7edac52a-66cd-11e0-9398-5d45f3aa24f0">
	<topic>krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.4</lt></range>
	<range><eq>1.9</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by the MIT Kerberos team says:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt">
	<p>The MIT Kerberos 5 Key Distribution Center (KDC) daemon is
	vulnerable to a double-free condition if the Public Key
	Cryptography for Initial Authentication (PKINIT) capability is
	enabled, resulting in daemon crash or arbitrary code execution
	(which is believed to be difficult).</p>
	<p>An unauthenticated remote attacker can induce a double-free
	event, causing the KDC daemon to crash (denial of service),
	or to execute arbitrary code. Exploiting a double-free event
	to execute arbitrary code is believed to be difficult.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0284</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt</url>
	</references>
	<dates>
	<discovery>2011-03-15</discovery>
	<entry>2011-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="4ab413ea-66ce-11e0-bf05-d445f3aa24f0">
	<topic>krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><le>1.8.4</le></range>
	<range><eq>1.9</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by the MIT Kerberos team says:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt">
	<p>The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable
	to denial of service attacks from unauthenticated remote
	attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs
	using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9
	KDCs.</p>
	<p>Exploit code is not known to exist, but the vulnerabilities are
	easy to trigger manually. The trigger for CVE-2011-0281 has
	already been disclosed publicly, but that fact might not be
	obvious to casual readers of the message in which it was
	disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283
	have not yet been disclosed publicly, but they are also
	trivial.</p>
	<p>CVE-2011-0281: An unauthenticated remote attacker can cause a KDC
	configured with an LDAP back end to become completely unresponsive
	until restarted.</p>
	<p>CVE-2011-0282: An unauthenticated remote attacker can cause a KDC
	configured with an LDAP back end to crash with a null pointer
	dereference.</p>
	<p>CVE-2011-0283: An unauthenticated remote attacker can cause a
	krb5-1.9 KDC with any back end to crash with a null pointer
	dereference.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0281</cvename>
	<cvename>CVE-2011-0282</cvename>
	<cvename>CVE-2011-0283</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt</url>
	</references>
	<dates>
	<discovery>2011-02-08</discovery>
	<entry>2011-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="64f24a1e-66cf-11e0-9deb-f345f3aa24f0">
	<topic>krb5 -- MITKRB5-SA-2011-001, kpropd denial of service</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.4</lt></range>
	<range><eq>1.9</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by the MIT Kerberos team says:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt">
	<p>The MIT krb5 KDC database propagation daemon (kpropd) is
	vulnerable to a denial-of-service attack triggered by invalid
	network input. If a kpropd worker process receives invalid
	input that causes it to exit with an abnormal status, it can
	cause the termination of the listening process that spawned it,
	preventing the slave KDC it was running on from receiving
	database updates from the master KDC.</p>
	<p>Exploit code is not known to exist, but the vulnerabilities are
	easy to trigger manually.</p>
	<p>An unauthenticated remote attacker can cause kpropd running in
	standalone mode (the "-S" option) to terminate its listening
	process, preventing database propagations to the KDC host on
	which it was running. Configurations where kpropd runs in
	incremental propagation mode ("iprop") or as an inetd server
	are not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4022</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt</url>
	</references>
	<dates>
	<discovery>2011-02-08</discovery>
	<entry>2011-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="2eccb24f-61c0-11e0-b199-0015f2db7bde">
	<topic>xrdb -- root hole via rogue hostname</topic>
	<affects>
	<package>
	<name>xrdb</name>
	<range><lt>1.0.6_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Hopf reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html">
	<p>By crafting hostnames with shell escape characters, arbitrary
	commands can be executed in a root environment when a display
	manager reads in the resource database via xrdb.</p>
	<p>These specially crafted hostnames can occur in two environments:</p>
	<p>Systems are affected are: systems set their hostname via DHCP,
	and the used DHCP client allows setting of hostnames with illegal
	characters. And systems that allow remote logins via xdmcp.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0465</cvename>
	<url>http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html</url>
	</references>
	<dates>
	<discovery>2011-04-05</discovery>
	<entry>2011-04-14</entry>
	</dates>
	</vuln>

	<vuln vid="a4372a68-652c-11e0-a25a-00151735203a">
	<topic>OTRS -- Several XSS attacks possible</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><gt>2.3.*</gt><lt>3.0.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://otrs.org/advisory/OSA-2011-01-en/">
	<ul>
	<li>Several XSS attacks possible:
	An attacker could trick a logged in user to following a prepared
	URL inside of the OTRS system which causes a page to be shown that
	possibly includes malicious !JavaScript code because of incorrect
	escaping during the generation of the HTML page.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1518</cvename>
	<url>http://otrs.org/advisory/OSA-2011-01-en/</url>
	</references>
	<dates>
	<discovery>2011-03-12</discovery>
	<entry>2011-04-12</entry>
	</dates>
	</vuln>

	<vuln vid="7e69f00d-632a-11e0-9f3a-001d092480a4">
	<topic>isc-dhcp-client -- dhclient does not strip or escape shell meta-characters</topic>
	<affects>
	<package>
	<name>isc-dhcp31-client</name>
	<range><lt>3.1.ESV_1,1</lt></range>
	</package>
	<package>
	<name>isc-dhcp41-client</name>
	<range><lt>4.1.e,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0997">
	<p>ISC dhclient did not strip or escape certain shell meta-characters
	in responses from the dhcp server (like hostname) before passing the
	responses on to dhclient-script. Depending on the script and OS,
	this can result in execution of exploit code on the client.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0997</cvename>
	<certvu>107886</certvu>
	</references>
	<dates>
	<discovery>2011-04-05</discovery>
	<entry>2011-04-10</entry>
	</dates>
	</vuln>

	<vuln vid="b9281fb9-61b2-11e0-b1ce-0019d1a7ece2">
	<topic>tinyproxy -- ACL lists ineffective when range is configured</topic>
	<affects>
	<package>
	<name>tinyproxy</name>
	<range><lt>1.8.2_2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>When including a line to allow a network of IP addresses, the access to tinyproxy
	56 is actually allowed for all IP addresses.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1499</cvename>
	<url>https://banu.com/bugzilla/show_bug.cgi?id=90</url>
	</references>
	<dates>
	<discovery>2010-05-18</discovery>
	<entry>2011-04-08</entry>
	</dates>
	</vuln>

	<vuln vid="b2a40507-5c88-11e0-9e85-00215af774f0">
	<topic>quagga -- two DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>0.99.17_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Quagga developers report:</p>
	<blockquote cite="http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200">
	<p>Quagga 0.99.18 has been released.
	This release fixes 2 denial of services in bgpd, which can be
	remotely triggered by malformed AS-Pathlimit or Extended-Community
	attributes. These issues have been assigned CVE-2010-1674 and
	CVE-2010-1675. Support for AS-Pathlimit has been removed with this
	release.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1674</cvename>
	<cvename>CVE-2010-1675</cvename>
	<url>http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200</url>
	</references>
	<dates>
	<discovery>2010-04-30</discovery>
	<entry>2011-04-01</entry>
	</dates>
	</vuln>

	<vuln vid="c6fbd447-59ed-11e0-8d04-0015f2db7bde">
	<topic>gdm -- privilege escalation vulnerability</topic>
	<affects>
	<package>
	<name>gdm</name>
	<range><lt>2.30.5_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Krahmer reports:</p>
	<blockquote cite="http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html">
	<p>It was discovered that the GNOME Display Manager (gdm) cleared the cache
	directory, which is owned by an unprivileged user, with the privileges of the
	root user. A race condition exists in gdm where a local user could take
	advantage of this by writing to the cache directory between ending the session
	and the signal to clean up the session, which could lead to the execution of
	arbitrary code as the root user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0727</cvename>
	<url>http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=688323</url>
	</references>
	<dates>
	<discovery>2011-03-28</discovery>
	<entry>2011-03-29</entry>
	</dates>
	</vuln>

	<vuln vid="fe853666-56ce-11e0-9668-001fd0d616cf">
	<topic>php -- ZipArchive segfault with FL_UNCHANGED on empty archive</topic>
	<affects>
	<package>
	<name>php5-zip</name>
	<range><lt>5.3.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0421">
	<p>The _zip_name_locate function in zip_name_locate.c in the Zip extension
	in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED
	argument, which might allow context-dependent attackers to cause a
	denial of service (application crash) via an empty ZIP archive that is
	processed with a (1) locateName or (2) statName operation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0421</cvename>
	</references>
	<dates>
	<discovery>2011-03-20</discovery>
	<entry>2011-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="cc3bfec6-56cd-11e0-9668-001fd0d616cf">
	<topic>php -- crash on crafted tag in exif</topic>
	<affects>
	<package>
	<name>php5-exif</name>
	<range><lt>5.3.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT/NIST reports:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0708">
	<p>exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms
	performs an incorrect cast, which allows remote attackers to cause a
	denial of service (application crash) via an image with a crafted
	Image File Directory (IFD) that triggers a buffer over-read.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0708</cvename>
	</references>
	<dates>
	<discovery>2011-03-20</discovery>
	<entry>2011-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="501ee07a-5640-11e0-985a-001b2134ef46">
	<topic>linux-flashplugin -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.2r153</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-01.html">
	<p>A critical vulnerability exists in Adobe Flash Player
	10.2.152.33 and earlier versions (Adobe Flash Player
	10.2.154.18 and earlier for Chrome users) for Windows,
	Macintosh, Linux and Solaris operating systems, Adobe
	Flash Player 10.1.106.16 and earlier versions for Android,
	and the Authplay.dll component that ships with Adobe Reader
	and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of
	Reader and Acrobat for Windows and Macintosh operating systems.</p>
	<p>This vulnerability (CVE-2011-0609) could cause a crash and
	potentially allow an attacker to take control of the affected
	system. There are reports that this vulnerability is being
	exploited in the wild in targeted attacks via a Flash (.swf)
	file embedded in a Microsoft Excel (.xls) file delivered as
	an email attachment.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0609</cvename>
	<url>http://www.adobe.com/support/security/advisories/apsa11-01.html</url>
	</references>
	<dates>
	<discovery>2011-01-20</discovery>
	<entry>2011-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="b2f09169-55af-11e0-9d6f-000f20797ede">
	<topic>mozilla -- update to HTTPS certificate blacklist</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.16,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.18,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.16</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.16,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.18</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-11 Update to HTTPS certificate blacklist</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-11.html</url>
	</references>
	<dates>
	<discovery>2011-03-22</discovery>
	<entry>2011-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="14a6f516-502f-11e0-b448-bbfa2731f9c7">
	<topic>postfix -- plaintext command injection with SMTP over TLS</topic>
	<affects>
	<package>
	<name>postfix</name>
	<name>postfix-base</name>
	<range><ge>2.7.*,1</ge><lt>2.7.3,1</lt></range>
	<range><ge>2.6.*,1</ge><lt>2.6.9,1</lt></range>
	<range><ge>2.5.*,2</ge><lt>2.5.12,2</lt></range>
	<range><ge>2.4.*,1</ge><lt>2.4.16,1</lt></range>
	</package>
	<package>
	<name>postfix-current</name>
	<name>postfix-current-base</name>
	<range><lt>2.9.20100120,4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wietse Venema has discovered a software flaw that allows
	an attacker to inject client commands into an SMTP session
	during the unprotected plaintext SMTP protocol phase, such
	that the server will execute those commands during the SMTP-
	over-TLS protocol phase when all communication is supposed
	to be protected.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0411</cvename>
	<url>http://www.postfix.org/CVE-2011-0411.html</url>
	<url>http://secunia.com/advisories/43646/</url>
	</references>
	<dates>
	<discovery>2011-03-07</discovery>
	<entry>2011-03-19</entry>
	</dates>
	</vuln>

	<vuln vid="b13414c9-50ba-11e0-975a-000c29cc39d3">
	<topic>hiawatha -- integer overflow in Content-Length header parsing</topic>
	<affects>
	<package>
	<name>hiawatha</name>
	<range><lt>7.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hugo Leisink reports:</p>
	<blockquote cite="http://www.hiawatha-webserver.org/weblog/16">
	<p>A bug has been found in version 7.4 of the Hiawatha webserver,
	which could lead to a server crash. This is caused by an integer
	overflow in the routine that reads the HTTP request. A too large
	value of the Content-Length HTTP header results in an overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.hiawatha-webserver.org/weblog/16</url>
	<url>http://secunia.com/advisories/43660/</url>
	<url>http://securityvulns.com/Zdocument902.html</url>
	<url>http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html</url>
	<url>http://seclists.org/bugtraq/2011/Mar/65</url>
	</references>
	<dates>
	<discovery>2011-02-25</discovery>
	<entry>2011-03-17</entry>
	</dates>
	</vuln>

	<vuln vid="bfe9c75e-5028-11e0-b2d2-00215c6a37bb">
	<topic>asterisk -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.17.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk Development Team reports:</p>
	<blockquote cite="http://www.venturevoip.com/news.php?rssid=2521">
	<p>The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1
	resolve two issues:</p>
	<ul>
	<li>Resource exhaustion in Asterisk Manager Interface
	(AST-2011-003)</li>
	<li>Remote crash vulnerability in TCP/TLS server
	(AST-2011-004)</li>
	</ul>
	<p>The issues and resolutions are described in the AST-2011-003
	and AST-2011-004 security advisories.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-003.html</url>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-004.html</url>
	</references>
	<dates>
	<discovery>2011-03-01</discovery>
	<entry>2011-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="8b986a05-4dbe-11e0-8b9a-02e0184b8d35">
	<topic>avahi -- denial of service</topic>
	<affects>
	<package>
	<name>avahi</name>
	<name>avahi-app</name>
	<name>avahi-autoipd</name>
	<name>avahi-gtk</name>
	<name>avahi-libdns</name>
	<name>avahi-qt3</name>
	<name>avahi-qt4</name>
	<name>avahi-sharp</name>
	<range><lt>0.6.29</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Avahi developers reports:</p>
	<blockquote cite="http://secunia.com/advisories/43361/">
	<p>A vulnerability has been reported in Avahi, which can be exploited
	by malicious people to cause a DoS (Denial of Service).
	The vulnerability is caused due to an error when processing certain
	UDP packets, which can be exploited to trigger an infinite loop by
	e.g. sending an empty packet to port 5353/UDP.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1002</cvename>
	<cvename>CVE-2010-2244</cvename>
	<url>http://secunia.com/advisories/43361/</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=667187</url>
	</references>
	<dates>
	<discovery>2011-02-21</discovery>
	<entry>2011-03-13</entry>
	</dates>
	</vuln>

	<vuln vid="64691c49-4b22-11e0-a226-00e0815b8da8">
	<topic>mailman -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>mailman</name>
	<range><lt>2.1.14_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0707">
	<p>Multiple cross-site scripting (XSS) vulnerabilities in
	Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote
	attackers to inject arbitrary web script or HTML via the (1)
	full name or (2) username field in a confirmation message.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0707</cvename>
	<url>http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html</url>
	</references>
	<dates>
	<discovery>2011-02-13</discovery>
	<entry>2011-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="cf96cd8d-48fb-11e0-98a6-0050569b2d21">
	<topic>redmine -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><gt>1.0</gt><lt>1.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jean-Philippe Lang reports:</p>
	<blockquote cite="http://www.redmine.org/news/53">
	<p>This maintenance release for 1.1.x users includes
	13 bug fixes since 1.1.1 and a security fix (XSS
	vulnerability affecting all Redmine versions from
	1.0.1 to 1.1.1).
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/news/53</url>
	</references>
	<dates>
	<discovery>2011-03-07</discovery>
	<entry>2011-03-07</entry>
	</dates>
	</vuln>

	<vuln vid="e27ca763-4721-11e0-bdc4-001e8c75030d">
	<topic>subversion -- remote HTTP DoS vulnerability</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><ge>1.6</ge><le>1.6.15</le></range>
	<range><ge>1.5</ge><le>1.6.9</le></range>
	</package>
	<package>
	<name>subversion-freebsd</name>
	<range><ge>1.6</ge><le>1.6.15</le></range>
	<range><ge>1.5</ge><le>1.6.9</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Subversion project reports:</p>
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-0715-advisory.txt">
	<p>Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive)
	are vulnerable to a remotely triggerable NULL-pointer dereference.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0715</cvename>
	</references>
	<dates>
	<discovery>2011-02-27</discovery>
	<entry>2011-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="45f102cd-4456-11e0-9580-4061862b8c22">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.14,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.17,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.14</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.14,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.17</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><ge>3.1</ge><lt>3.1.8</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><lt>3.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)</p>
	<p>MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true</p>
	<p>MFSA 2011-03 Use-after-free error in JSON.stringify</p>
	<p>MFSA 2011-04 Buffer overflow in JavaScript upvarMap</p>
	<p>MFSA 2011-05 Buffer overflow in JavaScript atom map</p>
	<p>MFSA 2011-06 Use-after-free error using Web Workers</p>
	<p>MFSA 2011-07 Memory corruption during text run construction (Windows)</p>
	<p>MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents</p>
	<p>MFSA 2011-09 Crash caused by corrupted JPEG image</p>
	<p>MFSA 2011-10 CSRF risk with plugins and 307 redirects</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1585</cvename>
	<cvename>CVE-2011-0051</cvename>
	<cvename>CVE-2011-0053</cvename>
	<cvename>CVE-2011-0054</cvename>
	<cvename>CVE-2011-0055</cvename>
	<cvename>CVE-2011-0056</cvename>
	<cvename>CVE-2011-0057</cvename>
	<cvename>CVE-2011-0058</cvename>
	<cvename>CVE-2011-0059</cvename>
	<cvename>CVE-2011-0061</cvename>
	<cvename>CVE-2011-0062</cvename>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-01.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-02.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-03.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-04.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-05.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-06.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-07.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-08.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-09.html</url>
	<url>https://www.mozilla.org/security/announce/2011/mfsa2011-10.html</url>
	</references>
	<dates>
	<discovery>2011-03-01</discovery>
	<entry>2011-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="be3dfe33-410b-11e0-9e02-00215c6a37bb">
	<topic>openldap -- two security bypass vulnerabilities</topic>
	<affects>
	<package>
	<name>openldap-server</name>
	<range><gt>2.4.0</gt><lt>2.4.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/43331/">
	<p>Two vulnerabilities have been reported in
	OpenLDAP, which can be exploited by malicious
	people to bypass certain security restrictions.</p>
	<p>The vulnerabilities are reported in versions
	prior to 2.4.24.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/43331/</url>
	</references>
	<dates>
	<discovery>2011-02-14</discovery>
	<entry>2011-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="65d16342-3ec8-11e0-9df7-001c42d23634">
	<topic>asterisk -- Exploitable Stack and Heap Array Overflows</topic>
	<affects>
	<package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.39.2</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.16.2</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk Development Team reports:</p>
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-February/000302.html">
	<p>The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and
	1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple
	heap based arrays can be made to overflow by specially
	crafted packets. Systems configured for T.38 pass through or
	termination are vulnerable. The issue and resolution are described
	in the AST-2011-002 security advisory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-002.html</url>
	<url>http://secunia.com/advisories/43429/</url>
	</references>
	<dates>
	<discovery>2011-02-21</discovery>
	<entry>2011-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="ae0e5835-3cad-11e0-b654-00215c6a37bb">
	<topic>PivotX -- administrator password reset vulnerability</topic>
	<affects>
	<package>
	<name>pivotx</name>
	<range><lt>2.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/175068">
	<p>PivotX contains a vulnerability that allows an
	attacker to change the password of any account
	just by guessing the username. Version 2.2.4 has
	been reported to not be affected.
	This vulnerability is being exploited in the wild
	and users should immediately upgrade to 2.2.5 or
	later. Mitigation steps for users that have been
	compromised have been posted to the <a href="http://forum.pivotx.net/viewtopic.php?f=2&t=1967">PivotX
	Support Community</a>.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-1035</cvename>
	</references>
	<dates>
	<discovery>2011-02-18</discovery>
	<entry>2011-02-20</entry>
	</dates>
	</vuln>

	<vuln vid="553ec4ed-38d6-11e0-94b1-000c29ba66d2">
	<topic>tomcat -- Cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.32</lt></range>
	</package>
	<package>
	<name>tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.30</lt></range>
	</package>
	<package>
	<name>tomcat</name>
	<range><gt>7.0.0</gt><lt>7.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tomcat security team reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32">
	<p>The HTML Manager interface displayed web applciation
	provided data, such as display names, without filtering.
	A malicious web application could trigger script execution
	by an administartive user when viewing the manager pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0013</cvename>
	<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32</url>
	<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30</url>
	<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6</url>
	</references>
	<dates>
	<discovery>2010-11-12</discovery>
	<entry>2011-02-15</entry>
	<modified>2011-09-30</modified>
	</dates>
	</vuln>

	<vuln vid="cd68ff50-362b-11e0-ad36-00215c6a37bb">
	<topic>phpMyAdmin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.3.9.2</lt></range>
	</package>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.11.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php">
	<p>It was possible to create a bookmark which would be executed
	unintentionally by other users.</p>
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php">
	<p>When the files README, ChangeLog or LICENSE have been removed
	from their original place (possibly by the distributor), the
	scripts used to display these files can show their full path,
	leading to possible further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php</url>
	</references>
	<dates>
	<discovery>2011-02-08</discovery>
	<entry>2011-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="4a3482da-3624-11e0-b995-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.2r152</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-02.html">
	<p>Critical vulnerabilities have been identified in
	Adobe Flash Player 10.1.102.64 and earlier versions for
	Windows, Macintosh, Linux, and Solaris. These vulnerabilities
	could cause the application to crash and could potentially
	allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0558</cvename>
	<cvename>CVE-2011-0559</cvename>
	<cvename>CVE-2011-0560</cvename>
	<cvename>CVE-2011-0561</cvename>
	<cvename>CVE-2011-0571</cvename>
	<cvename>CVE-2011-0572</cvename>
	<cvename>CVE-2011-0573</cvename>
	<cvename>CVE-2011-0574</cvename>
	<cvename>CVE-2011-0575</cvename>
	<cvename>CVE-2011-0577</cvename>
	<cvename>CVE-2011-0578</cvename>
	<cvename>CVE-2011-0607</cvename>
	<cvename>CVE-2011-0608</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb11-02.html</url>
	</references>
	<dates>
	<discovery>2011-02-08</discovery>
	<entry>2011-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="53bde960-356b-11e0-8e81-0022190034c0">
	<topic>mupdf -- Remote System Access</topic>
	<affects>
	<package>
	<name>mupdf</name>
	<range><lt>0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/43020/">
	<p>The vulnerability is caused due to an error within the
	"closedctd()" function in fitz/filt_dctd.c when processing PDF
	files containing certain malformed JPEG images. This can be
	exploited to cause a stack corruption by e.g. tricking a user
	into opening a specially crafted PDF file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>46027</bid>
	<url>http://secunia.com/advisories/43020/</url>
	</references>
	<dates>
	<discovery>2011-01-26</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="1cae628c-3569-11e0-8e81-0022190034c0">
	<topic>rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-mail</name>
	<range><lt>2.2.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/43077/">
	<p>Input passed via an email from address is not properly sanitised
	in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb)
	before being used as a command line argument. This can be exploited
	to inject arbitrary shell commands.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>46021</bid>
	<cvename>CVE-2011-0739</cvename>
	<url>http://secunia.com/advisories/43077/</url>
	<url>http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1</url>
	</references>
	<dates>
	<discovery>2011-01-25</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="7c492ea2-3566-11e0-8e81-0022190034c0">
	<topic>plone -- Remote Security Bypass</topic>
	<affects>
	<package>
	<name>plone</name>
	<range><ge>2.5</ge><lt>3</lt></range>
	</package>
	<package>
	<name>plone3</name>
	<range><ge>3</ge><le>3.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Plone developer reports:</p>
	<blockquote cite="http://plone.org/products/plone/security/advisories/cve-2011-0720">
	<p>This is an escalation of privileges attack that can be used by
	anonymous users to gain access to a Plone site's administration
	controls, view unpublished content, create new content and modify a
	site's skin. The sandbox protecting access to the underlying
	system is still in place, and it does not grant access to other
	applications running on the same Zope instance.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>46102</bid>
	<cvename>CVE-2011-0720</cvename>
	<url>http://plone.org/products/plone/security/advisories/cve-2011-0720</url>
	</references>
	<dates>
	<discovery>2011-02-02</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="44ccfab0-3564-11e0-8e81-0022190034c0">
	<topic>exim -- local privilege escalation</topic>
	<affects>
	<package>
	<name>exim</name>
	<name>exim-ldap</name>
	<name>exim-ldap2</name>
	<name>exim-mysql</name>
	<name>exim-postgresql</name>
	<name>exim-sa-exim</name>
	<range><lt>4.74</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>exim.org reports:</p>
	<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74">
	<p>CVE-2011-0017 - check return value of setuid/setgid. This is a
	privilege escalation vulnerability whereby the Exim run-time user
	can cause root to append content of the attacker's choosing to
	arbitrary files.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0017</cvename>
	<url>ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74</url>
	</references>
	<dates>
	<discovery>2011-01-31</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="f2b43905-3545-11e0-8e81-0022190034c0">
	<topic>openoffice.org -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openoffice.org</name>
	<range><lt>3.3.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenOffice.org Security Team reports:</p>
	<blockquote cite="http://www.openoffice.org/security/bulletin.html">
	<p>Fixed in OpenOffice.org 3.3</p>
	<ul>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html">
	CVE-2010-2935 / CVE-2010-2936</a>: Security Vulnerability in OpenOffice.org related to PowerPoint document processing</li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3450.html">
	CVE-2010-3450</a>: Security Vulnerability in OpenOffice.org related to Extensions and filter package files</li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html">
	CVE-2010-3451 / CVE-2010-3452</a>: Security Vulnerability in OpenOffice.org related to RTF document processing </li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html">
	CVE-2010-3453 / CVE-2010-3454</a>: Security Vulnerability in OpenOffice.org related to Word document processing </li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3689.html">
	CVE-2010-3689</a>: Insecure LD_LIBRARY_PATH usage in OpenOffice.org shell scripts </li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3702_CVE-2010-3704.html">
	CVE-2010-3702 / CVE-2010-3704</a>: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF</li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html">
	CVE-2010-4008 / CVE-2010-4494</a>: Possible Security Vulnerability in OpenOffice.org resulting from 3rd party library LIBXML2 </li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4253.html">
	CVE-2010-4253</a>: Security Vulnerability in OpenOffice.org related to PNG file processing </li>
	<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4643.html">
	CVE-2010-4643</a>: Security Vulnerability in OpenOffice.org related to TGA file processing </li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openoffice.org/security/bulletin.html</url>
	<url>http://secunia.com/advisories/40775/</url>
	</references>
	<dates>
	<discovery>2010-08-04</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="35ecdcbe-3501-11e0-afcd-0015f2db7bde">
	<topic>webkit-gtk2 -- Multiple vurnabilities.</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Noronha Silva reports:</p>
	<blockquote cite="http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405">
	<p>This release has essentially security fixes. Refer to the
	WebKit/gtk/NEWS file inside the tarball for details. We would like
	to thank the Red Hat security team (Huzaifa Sidhpurwala in
	particular) and Michael Gilbert from Debian for their help in
	checking (and pushing!) security issues affecting the WebKitGTK+
	stable branch for this release.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2901</cvename>
	<cvename>CVE-2010-4040</cvename>
	<cvename>CVE-2010-4042</cvename>
	<cvename>CVE-2010-4199</cvename>
	<cvename>CVE-2010-4492</cvename>
	<cvename>CVE-2010-4493</cvename>
	<cvename>CVE-2010-4578</cvename>
	<cvename>CVE-2011-0482</cvename>
	<cvename>CVE-2011-0778</cvename>
	<url>https://bugs.webkit.org/show_bug.cgi?id=48328</url>
	<url>https://bugs.webkit.org/show_bug.cgi?id=50710</url>
	<url>https://bugs.webkit.org/show_bug.cgi?id=50840</url>
	<url>https://bugs.webkit.org/show_bug.cgi?id=50932</url>
	<url>https://bugs.webkit.org/show_bug.cgi?id=51993</url>
	<url>https://bugs.webkit.org/show_bug.cgi?id=53265</url>
	<url>https://bugs.webkit.org/show_bug.cgi?id=53276</url>
	<url>http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405</url>
	</references>
	<dates>
	<discovery>2011-02-08</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="ce6ce2f8-34ac-11e0-8103-00215c6a37bb">
	<topic>awstats -- arbitrary commands execution vulnerability</topic>
	<affects>
	<package>
	<name>awstats</name>
	<range><lt>7.0,1</lt></range>
	</package>
	<package>
	<name>awstats-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Awstats change log reports:</p>
	<blockquote cite="http://awstats.sourceforge.net/docs/awstats_changelog.txt">
	<ul>
	<li>Security fix (Traverse directory of LoadPlugin)</li>
	<li>Security fix (Limit config to defined directory
	to avoid access to external config file via a nfs
	or webdav link).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4367</cvename>
	<url>http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html</url>
	<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
	</references>
	<dates>
	<discovery>2010-05-01</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="2eda0c54-34ab-11e0-8103-00215c6a37bb">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>11.01</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1101/">
	<p>Opera 11.01 is a recommended upgrade offering security and
	stability enhancements.</p>
	<p>The following security vulnerabilities have been fixed:</p>
	<ul>
	<li>Removed support for "<code>javascript:</code>" URLs in
	CSS -o-link values, to make it easier for sites to filter
	untrusted CSS.</li>
	<li>Fixed an issue where large form inputs could allow
	execution of arbitrary code, as reported by Jordi Chancel;
	see our <a href="http://www.opera.com/support/kb/view/982/">advisory</a>.</li>
	<li>Fixed an issue which made it possible to carry out
	clickjacking attacks against internal opera: URLs;
	see our <a href="http://www.opera.com/support/kb/view/983/">advisory</a>.</li>
	<li>Fixed issues which allowed web pages to gain limited
	access to files on the user's computer; see our
	<a href="http://www.opera.com/support/kb/view/984/">advisory</a>.</li>
	<li>Fixed an issue where email passwords were not immediately
	deleted when deleting private data; see our
	<a href="http://www.opera.com/support/kb/view/986/">advisory</a>.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0450</cvename>
	<cvename>CVE-2011-0681</cvename>
	<cvename>CVE-2011-0682</cvename>
	<cvename>CVE-2011-0683</cvename>
	<cvename>CVE-2011-0684</cvename>
	<cvename>CVE-2011-0685</cvename>
	<cvename>CVE-2011-0686</cvename>
	<cvename>CVE-2011-0687</cvename>
	<url>http://www.opera.com/support/kb/view/982/</url>
	<url>http://www.opera.com/support/kb/view/983/</url>
	<url>http://www.opera.com/support/kb/view/984/</url>
	<url>http://secunia.com/advisories/43023</url>
	</references>
	<dates>
	<discovery>2011-01-26</discovery>
	<entry>2011-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="bd760627-3493-11e0-8103-00215c6a37bb">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py27-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><gt>1.2</gt><lt>1.2.5</lt></range>
	<range><gt>1.1</gt><lt>1.1.4</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py27-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>15470,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django project reports:</p>
	<blockquote cite="http://www.djangoproject.com/weblog/2011/feb/08/security/">
	<p>Today the Django team is issuing multiple releases --
	Django 1.2.5 and Django 1.1.4 -- to remedy three security
	issues reported to us. All users of affected versions of
	Django are urged to upgrade immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.djangoproject.com/weblog/2011/feb/08/security/</url>
	</references>
	<dates>
	<discovery>2011-02-08</discovery>
	<entry>2011-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="8d04cfbd-344d-11e0-8669-0025222482c5">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><lt>1.16.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Medawiki reports:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html">
	<p>An arbitrary script inclusion vulnerability was discovered. The
	vulnerability only allows execution of files with names ending in
	".php" which are already present in the local filesystem. Only servers
	running Microsoft Windows and possibly Novell Netware are affected.
	Despite these mitigating factors, all users are advised to upgrade,
	since there is a risk of complete server compromise. MediaWiki 1.8.0
	and later is affected.</p>
	<p>Security researcher mghack discovered a CSS injection
	vulnerability. For Internet Explorer and similar browsers, this is
	equivalent to an XSS vulnerability, that is to say, it allows the
	compromise of wiki user accounts. For other browsers, it allows private
	data such as IP addresses and browsing patterns to be sent to a malicious
	external web server. It affects all versions of MediaWiki. All users are
	advised to upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0047</cvename>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27094</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27093</url>
	<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES</url>
	<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html</url>
	</references>
	<dates>
	<discovery>2011-02-01</discovery>
	<entry>2011-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="8c93e997-30e0-11e0-b300-485d605f4717">
	<topic>wordpress -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>3.0.2,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vendor reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257">
	<p>SQL injection vulnerability in the do_trackbacks function in
	wp-includes/comment.php in WordPress before 3.0.2 allows remote
	authenticated users to execute arbitrary SQL commands via the Send
	Trackbacks field.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4257</cvename>
	<url>http://www.cvedetails.com/cve/CVE-2010-4257/</url>
	</references>
	<dates>
	<discovery>2010-11-16</discovery>
	<entry>2011-02-05</entry>
	<modified>2011-02-09</modified>
	</dates>
	</vuln>

	<vuln vid="f9258873-2ee2-11e0-afcd-0015f2db7bde">
	<topic>vlc -- Insufficient input validation in MKV demuxer</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>1.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>VLC team reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa1102.html">
	<p>When parsing an invalid MKV (Matroska or WebM) file, input
	validation are insufficient.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.videolan.org/security/sa1102.html</url>
	</references>
	<dates>
	<discovery>2011-01-26</discovery>
	<entry>2011-02-02</entry>
	</dates>
	</vuln>

	<vuln vid="8015600f-2c80-11e0-9cc1-00163e5bf4f9">
	<topic>maradns -- denial of service when resolving a long DNS hostname</topic>
	<affects>
	<package>
	<name>maradns</name>
	<range><lt>1.4.06</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MaraDNS developer Sam Trenholme reports:</p>
	<blockquote cite="http://samiam.org/blog/20110129.html">
	<p>... a mistake in allocating an array of integers, allocating it
	in bytes instead of sizeof(int) units. This resulted in a buffer
	being too small, allowing it to be overwritten. The impact of this
	programming error is that MaraDNS can be crashed by sending
	MaraDNS a single "packet of death". Since the data placed in the
	overwritten array cannot be remotely controlled (it is a list of
	increasing integers), there is no way to increase privileges
	exploiting this bug.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45966</bid>
	<cvename>CVE-2011-0520</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834</url>
	</references>
	<dates>
	<discovery>2011-01-23</discovery>
	<entry>2011-01-31</entry>
	</dates>
	</vuln>

	<vuln vid="dc9f8335-2b3b-11e0-a91b-00e0815b8da8">
	<topic>isc-dhcp-server -- DHCPv6 crash</topic>
	<affects>
	<package>
	<name>isc-dhcp41-server</name>
	<range><le>4.1.2,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0413">
	<p>When the DHCPv6 server code processes a message for an address
	that was previously declined and internally tagged as abandoned
	it can trigger an assert failure resulting in the server crashing.
	This could be used to crash DHCPv6 servers remotely. This issue
	only affects DHCPv6 servers. DHCPv4 servers are unaffected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0413</cvename>
	<url>http://www.isc.org/software/dhcp/advisories/cve-2011-0413</url>
	<url>http://www.kb.cert.org/vuls/id/686084</url>
	</references>
	<dates>
	<discovery>2011-01-26</discovery>
	<entry>2011-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="c8c927e5-2891-11e0-8f26-00151735203a">
	<topic>bugzilla -- multiple serious vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>2.14.*</ge><lt>3.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.2.9/">
	<p>This advisory covers three security issues that have recently been
	fixed in the Bugzilla code:</p>
	<ul>
	<li>A weakness in Bugzilla could allow a user to gain unauthorized
	access to another Bugzilla account.</li>
	<li>A weakness in the Perl CGI.pm module allows injecting HTTP
	headers and content to users via several pages in Bugzilla.</li>
	<li>If you put a harmful "javascript:" or "data:" URL into
	Bugzilla's "URL" field, then there are multiple situations in
	which Bugzilla will unintentionally make that link clickable.</li>
	<li>Various pages lack protection against cross-site request
	forgeries.</li>
	</ul>
	<p>All affected installations are encouraged to upgrade as soon as
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25425</bid>
	<cvename>CVE-2010-4568</cvename>
	<cvename>CVE-2010-2761</cvename>
	<cvename>CVE-2010-4411</cvename>
	<cvename>CVE-2010-4572</cvename>
	<cvename>CVE-2010-4567</cvename>
	<cvename>CVE-2010-0048</cvename>
	<cvename>CVE-2011-0046</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621591</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619594</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=591165</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621572</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619588</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=628034</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621090</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621105</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621107</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621108</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621109</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621110</url>
	</references>
	<dates>
	<discovery>2011-01-24</discovery>
	<entry>2011-01-25</entry>
	</dates>
	</vuln>

	<vuln vid="7580f00e-280c-11e0-b7c8-00215c6a37bb">
	<topic>dokuwiki -- multiple privilege escalation vulnerabilities</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20101107a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dokuwiki reports:</p>
	<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&task_id=2136">
	<p>This security update fixes problems in the XMLRPC
	interface where ACLs where not checked correctly
	sometimes, making it possible to access and write
	information that should not have been accessible/writable.
	This only affects users who have enabled the XMLRPC
	interface (default is off) and have enabled XMLRPC
	access for users who can't access/write all content
	anyway (default is nobody, see <a href="http://www.dokuwiki.org/config:xmlrpcuser">http://www.dokuwiki.org/config:xmlrpcuser</a>
	for details).</p>
	<p>This update also includes a fix for a problem in
	the general ACL checking function that could be exploited
	to gain access to restricted pages and media files in rare
	conditions (when you had rights for an id you could get
	the same rights on ids where one character has been
	replaced by a ".").</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bugs.dokuwiki.org/index.php?do=details&task_id=2136</url>
	</references>
	<dates>
	<discovery>2011-01-16</discovery>
	<entry>2011-01-24</entry>
	</dates>
	</vuln>

	<vuln vid="5ab9fb2a-23a5-11e0-a835-0003ba02bf30">
	<topic>asterisk -- Exploitable Stack Buffer Overflow</topic>
	<affects>
	<package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.39.1</lt></range>
	</package>
	<package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.16.1</lt></range>
	</package>
	<package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Asterisk Development Team reports:</p>
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-January/000297.html">
	<p>The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1,
	1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an
	outgoing SIP request while in pedantic mode, which can cause a stack
	buffer to be made to overflow if supplied with carefully crafted
	caller ID information. The issue and resolution are described in the
	AST-2011-001 security advisory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-001.pdf</url>
	</references>
	<dates>
	<discovery>2011-01-18</discovery>
	<entry>2011-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="2c2d4e83-2370-11e0-a91b-00e0815b8da8">
	<topic>tarsnap -- cryptographic nonce reuse</topic>
	<affects>
	<package>
	<name>tarsnap</name>
	<range><ge>1.0.22</ge><le>1.0.27</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Colin Percival reports:</p>
	<blockquote cite="http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html">
	<p>In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value
	is not incremented after each chunk is encrypted. (The CTR counter
	is correctly incremented after each 16 bytes of data was processed,
	but this counter is reset to zero for each new chunk.)</p>
	<p>Note that since the Tarsnap client-server protocol is encrypted,
	being able to intercept Tarsnap client-server traffic does not
	provide an attacker with access to the data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html</url>
	</references>
	<dates>
	<discovery>2011-01-18</discovery>
	<entry>2011-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="4c017345-1d89-11e0-bbee-0014a5e3cda6">
	<topic>MoinMoin -- cross-site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MoinMoin developers reports:</p>
	<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES">
	<p>Fix XSS in Despam action (CVE-2010-0828)</p>
	</blockquote>
	<blockquote cite="http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg">
	<p>Fix XSS issues</p>
	<ul>
	<li>by escaping template name in messages</li>
	<li>by fixing other places that had similar issues</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>39110</bid>
	<cvename>CVE-2010-0828</cvename>
	<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES</url>
	<url>http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg</url>
	</references>
	<dates>
	<discovery>2010-04-05</discovery>
	<entry>2011-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="38bdf10e-2293-11e0-bfa4-001676740879">
	<topic>tor -- remote code execution and crash</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.2.1.29</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.2.21.a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Project reports:</p>
	<blockquote cite="http://archives.seul.org/or/announce/Jan-2011/msg00000.html">
	<p>A remote heap overflow vulnerability that can allow remote
	code execution. Other fixes address a variety of assert and crash
	bugs, most of which we think are hard to exploit remotely.
	All Tor users should upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45832</bid>
	<cvename>CVE-2011-0427</cvename>
	<freebsdpr>ports/154099</freebsdpr>
	<mlist msgid="20110117155813.GG3300@moria.seul.org">http://archives.seul.org/or/announce/Jan-2011/msg00000.html</mlist>
	<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
	<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
	</references>
	<dates>
	<discovery>2011-01-15</discovery>
	<entry>2011-01-17</entry>
	</dates>
	</vuln>

	<vuln vid="908f4cf2-1e8b-11e0-a587-001b77d09812">
	<topic>sudo -- local privilege escalation</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><ge>1.7.0</ge><lt>1.7.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group_pw.html">
	<p>Beginning with sudo version 1.7.0 it has been possible
	to grant permission to run a command using a specified
	group via sudo's -g option (run as group), if allowed by
	the sudoers file. A flaw exists in sudo's password
	checking logic that allows a user to run a command
	with only the group changed without being prompted
	for a password.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2011-0010</cvename>
	<url>http://www.sudo.ws/sudo/alerts/runas_group_pw.html</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641</url>
	</references>
	<dates>
	<discovery>2011-01-11</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="71612099-1e93-11e0-a587-001b77d09812">
	<topic>subversion -- multiple DoS</topic>
	<affects>
	<package>
	<name>subversion</name>
	<range><lt>1.6.15</lt></range>
	</package>
	<package>
	<name>subversion-freebsd</name>
	<range><lt>1.6.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Entry for CVE-2010-4539 says:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4539">
	<p>The walk function in repos.c in the mod_dav_svn module
	for the Apache HTTP Server, as distributed in Apache
	Subversion before 1.6.15, allows remote authenticated
	users to cause a denial of service (NULL pointer
	dereference and daemon crash) via vectors that trigger
	the walking of SVNParentPath collections.</p>
	</blockquote>
	<p>Entry for CVE-2010-4644 says:</p>
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4644">
	<p>Multiple memory leaks in rev_hunt.c in Apache Subversion
	before 1.6.15 allow remote authenticated users to cause
	a denial of service (memory consumption and daemon crash)
	via the -g option to the blame command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45655</bid>
	<cvename>CVE-2010-4539</cvename>
	<cvename>CVE-2010-4644</cvename>
	</references>
	<dates>
	<discovery>2011-01-02</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="2b6ed5c7-1a7f-11e0-b61d-000c29d1636d">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.3.5</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP developers reports:</p>
	<blockquote cite="http://www.php.net/releases/5_3_5.php">
	<p>Security Enhancements and Fixes in PHP 5.3.5:</p>
	<ul>
	<li>Fixed bug #53632 (PHP hangs on numeric value
	2.2250738585072011e-308). (CVE-2010-4645)</li>
	</ul>
	</blockquote>
	<blockquote cite="http://www.php.net/releases/5_2_17.php">
	<p>Security Enhancements and Fixes in PHP 5.2.17:</p>
	<ul>
	<li>Fixed bug #53632 (PHP hangs on numeric value
	2.2250738585072011e-308). (CVE-2010-4645)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4645</cvename>
	</references>
	<dates>
	<discovery>2011-01-06</discovery>
	<entry>2011-01-09</entry>
	<modified>2011-01-09</modified>
	</dates>
	</vuln>

	<vuln vid="e4fcf020-0447-11e0-becc-0022156e8794">
	<topic>exim -- local privilege escalation</topic>
	<affects>
	<package>
	<name>exim</name>
	<range><lt>4.73</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>David Woodhouse reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3">
	<p>Secondly a privilege escalation where the trusted 'exim'
	user is able to tell Exim to use arbitrary config files,
	in which further ${run ...} commands will be invoked as
	root.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4345</cvename>
	<url>http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3</url>
	</references>
	<dates>
	<discovery>2010-12-10</discovery>
	<entry>2011-01-08</entry>
	</dates>
	</vuln>

	<vuln vid="e177c410-1943-11e0-9d1c-000c29ba66d2">
	<topic>mediawiki -- Clickjacking vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><gt>1.16</gt><lt>1.16.1</lt></range>
	<range><gt>1.15</gt><lt>1.15.5_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Clickjacking vulnerabilities:</p>
	<blockquote cite="https://bugzilla.wikimedia.org/show_bug.cgi?id=26561">
	<p>Clickjacking is a type of vulnerability discovered in 2008, which
	is similar to CSRF. The attack involves displaying the target webpage
	in a iframe embedded in a malicious website. Using CSS, the submit button
	of the form on the targeit webpage is made invisible, and then overlaid
	with some button or link on the malicious website that encourages
	the user to click on it.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=26561</url>
	</references>
	<dates>
	<discovery>2011-01-04</discovery>
	<entry>2011-01-06</entry>
	</dates>
	</vuln>

	<vuln vid="06a12e26-142e-11e0-bea2-0015f2db7bde">
	<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Noronha Silva reports:</p>
	<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
	<p>The patches to fix the following CVEs are included with help
	from Huzaifa Sidhpurwala from the Red Hat security team.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1791</cvename>
	<cvename>CVE-2010-3812</cvename>
	<cvename>CVE-2010-3813</cvename>
	<cvename>CVE-2010-4197</cvename>
	<cvename>CVE-2010-4198</cvename>
	<cvename>CVE-2010-4204</cvename>
	<cvename>CVE-2010-4206</cvename>
	<cvename>CVE-2010-4577</cvename>
	<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
	</references>
	<dates>
	<discovery>2010-12-28</discovery>
	<entry>2010-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="14a37474-1383-11e0-8a58-00215c6a37bb">
	<topic>django -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py27-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><gt>1.2</gt><lt>1.2.4</lt></range>
	<range><gt>1.1</gt><lt>1.1.3</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py27-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>15032,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django project reports:</p>
	<blockquote cite="http://www.djangoproject.com/weblog/2010/dec/22/security/">
	<p>Today the Django team is issuing multiple releases
	-- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 --
	to remedy two security issues reported to us. All users
	of affected versions of Django are urged to upgrade
	immediately.</p>
	<h3>Information leakage in Django administrative interface</h3>
	<p>The Django administrative interface, django.contrib.admin
	supports filtering of displayed lists of objects by fields
	on the corresponding models, including across database-level
	relationships. This is implemented by passing lookup arguments
	in the querystring portion of the URL, and options on the
	ModelAdmin class allow developers to specify particular
	fields or relationships which will generate automatic links
	for filtering.</p>
	<h3>Denial-of-service attack in password-reset mechanism</h3>
	<p>Django's bundled authentication framework,
	django.contrib.auth, offers views which allow users to
	reset a forgotten password. The reset mechanism involves
	generating a one-time token composed from the user's ID,
	the timestamp of the reset request converted to a base36
	integer, and a hash derived from the user's current password
	hash (which will change once the reset is complete, thus
	invalidating the token).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45562</bid>
	<bid>45563</bid>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=665373</url>
	<url>http://secunia.com/advisories/42715/</url>
	</references>
	<dates>
	<discovery>2010-12-22</discovery>
	<entry>2010-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="ff8b419a-0ffa-11e0-becc-0022156e8794">
	<topic>Drupal Views plugin -- cross-site scripting</topic>
	<affects>
	<package>
	<name>drupal6-views</name>
	<range><lt>2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal security team reports:</p>
	<blockquote cite="http://drupal.org/node/999380">
	<p>The Views module provides a flexible method for Drupal site
	designers to control how lists and tables of content are
	presented. Under certain circumstances, Views could display
	parts of the page path without escaping, resulting in a
	relected Cross Site Scripting (XSS) vulnerability. An attacker
	could exploit this to gain full administrative access.</p>
	<p>Mitigating factors: This vulnerability only occurs with a
	specific combination of configuration options for a specific
	View, but this combination is used in the default Views
	provided by some additional modules. A malicious user would
	need to get an authenticated administrative user to visit a
	specially crafted URL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4521</cvename>
	<url>http://drupal.org/node/999380</url>
	</references>
	<dates>
	<discovery>2010-12-15</discovery>
	<entry>2010-12-28</entry>
	</dates>
	</vuln>

	<vuln vid="584c506d-0e98-11e0-b59b-0050569b2d21">
	<topic>redmine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>1.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jean-Philippe Lang reports:</p>
	<blockquote cite="http://www.redmine.org/news/49">
	<p>This release also fixes 3 security issues reported by
	joernchen of Phenoelit:</p>
	<ul>
	<li>logged in users may be able to access private data
	(affected versions: 1.0.x)</li>
	<li>persistent XSS vulnerability in textile formatter
	(affected versions: all previous releases)</li>
	<li>remote command execution in bazaar repository adapter
	(affected versions: 0.9.x, 1.0.x)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/news/49</url>
	</references>
	<dates>
	<discovery>2010-12-23</discovery>
	<entry>2010-12-23</entry>
	</dates>
	</vuln>

	<vuln vid="4bd33bc5-0cd6-11e0-bfa4-001676740879">
	<topic>tor -- remote crash and potential remote code execution</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.2.1.28</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.2.20-alpha</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Project reports:</p>
	<blockquote cite="http://archives.seul.org/or/announce/Dec-2010/msg00000.html">
	<p>Remotely exploitable bug that could be used to crash instances
	of Tor remotely by overflowing on the heap. Remote-code execution
	hasn't been confirmed, but can't be ruled out. Everyone should
	upgrade.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45500</bid>
	<cvename>CVE-2010-1676</cvename>
	<freebsdpr>ports/153326</freebsdpr>
	<mlist msgid="20101220135830.GU3300@moria.seul.org">http://archives.seul.org/or/announce/Dec-2010/msg00000.html</mlist>
	<mlist msgid="20101220141526.GS3255@moria.seul.org">http://archives.seul.org/or/talk/Dec-2010/msg00167.html</mlist>
	<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
	<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
	</references>
	<dates>
	<discovery>2010-12-17</discovery>
	<entry>2010-12-22</entry>
	</dates>
	</vuln>

	<vuln vid="d560b346-08a2-11e0-bcca-0050568452ac">
	<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
	<affects>
	<package>
	<name>yahoo-ui</name>
	<range><lt>2.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The YUI team reports:</p>
	<blockquote cite="http://yuilibrary.com/support/2.8.2/">
	<p>A security-related defect was introduced in the YUI 2 Flash
	component infrastructure beginning with the YUI 2.4.0 release.
	This defect allows JavaScript injection exploits to be created
	against domains that host affected YUI .swf files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4207</cvename>
	<cvename>CVE-2010-4208</cvename>
	<cvename>CVE-2010-4209</cvename>
	<url>http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/</url>
	<url>http://secunia.com/advisories/41955</url>
	<url>http://www.openwall.com/lists/oss-security/2010/11/07/1</url>
	<url>http://yuilibrary.com/support/2.8.2/</url>
	</references>
	<dates>
	<discovery>2010-10-25</discovery>
	<entry>2010-12-15</entry>
	</dates>
	</vuln>

	<vuln vid="2a41233d-10e7-11e0-becc-0022156e8794">
	<topic>php-zip -- multiple Denial of Service vulnerabilities</topic>
	<affects>
	<package>
	<name>php5-zip</name>
	<range><lt>5.3.4</lt></range>
	</package>
	<package>
	<name>php52-zip</name>
	<range><lt>5.2.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The following DoS conditions in Zip extension
	were fixed in PHP 5.3.4 and PHP 5.2.15:</p>
	<ul>
	<li>
	<blockquote cite="http://www.php.net/releases/5_3_4.php">
	<p>Fixed crash in zip extract method (possible
	CWE-170).</p>
	</blockquote>
	</li>
	<li>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3709">
	<p>The ZipArchive::getArchiveComment function
	in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3
	allows context-dependent attackers to cause a denial
	of service (NULL pointer dereference and application
	crash) via a crafted ZIP archive.</p>
	</blockquote>
	</li>
	</ul>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3709</cvename>
	<url>http://www.php.net/releases/5_3_4.php</url>
	<url>http://www.php.net/releases/5_2_15.php</url>
	<url>http://securityreason.com/achievement_securityalert/90</url>
	</references>
	<dates>
	<discovery>2010-12-13</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="c623f058-10e7-11e0-becc-0022156e8794">
	<topic>php-filter -- Denial of Service</topic>
	<affects>
	<package>
	<name>php5-filter</name>
	<range><lt>5.3.4</lt></range>
	</package>
	<package>
	<name>php52-filter</name>
	<range><lt>5.2.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The following DoS condition in filter extension
	was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3710">
	<p>Stack consumption vulnerability in the filter_var
	function in PHP 5.2.x through 5.2.14 and 5.3.x through
	5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows
	remote attackers to cause a denial of service (memory
	consumption and application crash) via a long e-mail
	address string.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3710</cvename>
	<url>http://www.php.net/releases/5_3_4.php</url>
	<url>http://www.php.net/releases/5_2_15.php</url>
	</references>
	<dates>
	<discovery>2010-12-13</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="1a0704e7-0edf-11e0-becc-0022156e8794">
	<topic>php-imap -- Denial of Service</topic>
	<affects>
	<package>
	<name>php5-imap</name>
	<range><lt>5.3.4</lt></range>
	</package>
	<package>
	<name>php52-imap</name>
	<range><lt>5.2.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The following DoS condition in IMAP extension
	was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
	<blockquote cite="http://securitytracker.com/alerts/2010/Nov/1024761.html">
	<p>A remote user can send specially crafted IMAP user name
	or password data to trigger a double free memory error
	in 'ext/imap/php_imap.c' and cause the target service
	to crash.</p>
	<p>It may be possible to execute arbitrary code.
	However, code execution was not confirmed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4150</cvename>
	<url>http://www.php.net/releases/5_3_4.php</url>
	<url>http://www.php.net/releases/5_2_15.php</url>
	</references>
	<dates>
	<discovery>2010-12-13</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="da3d381b-0ee6-11e0-becc-0022156e8794">
	<topic>pecl-phar -- format string vulnerability</topic>
	<affects>
	<package>
	<name>pecl-phar</name>
	<range><ge>0</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Entry for CVE-2010-2094 says:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2094">
	<p>Multiple format string vulnerabilities in the phar
	extension in PHP 5.3 before 5.3.2 allow context-dependent
	attackers to obtain sensitive information (memory
	contents) and possibly execute arbitrary code via a
	crafted phar:// URI that is not properly handled by the
	(1) phar_stream_flush, (2) phar_wrapper_unlink,
	(3) phar_parse_url, or (4) phar_wrapper_open_url functions
	in ext/phar/stream.c; and the (5) phar_wrapper_open_dir
	function in ext/phar/dirstream.c, which triggers errors
	in the php_stream_wrapper_log_error function.</p>
	</blockquote>
	<p>PECL source code for PHAR extension shares the same code,
	so it is vulnerable too.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2094</cvename>
	<url>http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html</url>
	<url>http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm</url>
	<url>http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm</url>
	<url>http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm</url>
	<url>http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html</url>
	</references>
	<dates>
	<discovery>2010-12-13</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="3761df02-0f9c-11e0-becc-0022156e8794">
	<topic>php -- NULL byte poisoning</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.3.4</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.17_12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP-specific version of NULL-byte poisoning was briefly
	described by ShAnKaR:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded">
	<p>Poison NULL byte vulnerability for perl CGI applications
	was described in
	<a href="http://artofhacking.com/files/phrack/phrack55/P55-07.TXT">[1]</a>.
	ShAnKaR noted, that same vulnerability also affects
	different PHP applications.</p>
	</blockquote>
	<p>PHP developers report that branch 5.3 received a fix:</p>
	<blockquote cite="http://www.php.net/releases/5_3_4.php">
	<p>Paths with NULL in them (foo\0bar.txt) are now considered
	as invalid (CVE-2006-7243).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2006-7243</cvename>
	<url>http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded</url>
	<url>http://artofhacking.com/files/phrack/phrack55/P55-07.TXT</url>
	</references>
	<dates>
	<discovery>2010-12-10</discovery>
	<entry>2011-01-13</entry>
	<modified>2012-11-25</modified>
	</dates>
	</vuln>

	<vuln vid="73634294-0fa7-11e0-becc-0022156e8794">
	<topic>php -- open_basedir bypass</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.3.4</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MITRE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3436">
	<p>fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow
	remote attackers to bypass open_basedir restrictions via
	vectors related to the length of a filename.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>44723</bid>
	<cvename>CVE-2010-3436</cvename>
	</references>
	<dates>
	<discovery>2010-12-10</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="f3148a05-0fa7-11e0-becc-0022156e8794">
	<topic>php -- corruption of $GLOBALS and $this variables via extract() method</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.3.4</lt></range>
	</package>
	<package>
	<name>php52</name>
	<range><lt>5.2.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Off-by-one error in the sanity validator for the extract()
	method allowed attackers to replace the values of $GLOBALS
	and $this when mode EXTR_OVERWRITE was used.</p>
	</body>
	</description>
	<references>
	<url>http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html</url>
	<url>http://www.php.net/releases/5_2_15.php</url>
	</references>
	<dates>
	<discovery>2010-12-10</discovery>
	<entry>2011-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="6887828f-0229-11e0-b84d-00262d5ed8ee">
	<cancelled/>
	</vuln>

	<vuln vid="b2a6fc0e-070f-11e0-a6e9-00215c6a37bb">
	<cancelled/>
	</vuln>

	<vuln vid="1d8ff4a2-0445-11e0-8e32-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.13,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.16,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.13</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.13,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.16</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><ge>3.1</ge><lt>3.1.7</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.11</lt></range>
	<range><ge>3.1</ge><lt>3.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)</p>
	<p>MFSA 2010-75 Buffer overflow while line breaking after document.write with long string</p>
	<p>MFSA 2010-76 Chrome privilege escalation with window.open and isindex element</p>
	<p>MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree</p>
	<p>MFSA 2010-78 Add support for OTS font sanitizer</p>
	<p>MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh</p>
	<p>MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver</p>
	<p>MFSA 2010-81 Integer overflow vulnerability in NewIdArray</p>
	<p>MFSA 2010-82 Incomplete fix for CVE-2010-0179</p>
	<p>MFSA 2010-83 Location bar SSL spoofing using network error page</p>
	<p>MFSA 2010-84 XSS hazard in multiple character encodings</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3766</cvename>
	<cvename>CVE-2010-3767</cvename>
	<cvename>CVE-2010-3768</cvename>
	<cvename>CVE-2010-3769</cvename>
	<cvename>CVE-2010-3770</cvename>
	<cvename>CVE-2010-3771</cvename>
	<cvename>CVE-2010-3772</cvename>
	<cvename>CVE-2010-3773</cvename>
	<cvename>CVE-2010-3774</cvename>
	<cvename>CVE-2010-3775</cvename>
	<cvename>CVE-2010-3776</cvename>
	<cvename>CVE-2010-3777</cvename>
	<cvename>CVE-2010-3778</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-74.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-75.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-76.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-77.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-78.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-79.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-80.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-81.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-82.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-83.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-84.html</url>
	</references>
	<dates>
	<discovery>2010-12-09</discovery>
	<entry>2010-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="4ccbd40d-03f7-11e0-bf50-001a926c7637">
	<topic>krb5 -- client impersonation vulnerability</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	<p>MIT krb5 KDC may issue tickets not requested
	by a client, based on an attacker-chosen KrbFastArmoredReq.</p>
	<p>An authenticated remote attacker that controls a legitimate service
	principal could obtain a valid service ticket to itself containing
	valid KDC-generated authorization data for a client whose TGS-REQ it
	has intercepted. The attacker could then use this ticket for
	S4U2Proxy to impersonate the targeted client even if the client
	never authenticated to the subverted service. The vulnerable
	configuration is believed to be rare.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45122</bid>
	<cvename>CVE-2010-4021</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
	<url>http://osvdb.org/69607</url>
	</references>
	<dates>
	<discovery>2010-11-30</discovery>
	<entry>2010-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="1d193bba-03f6-11e0-bf50-001a926c7637">
	<topic>krb5 -- RFC 3961 key-derivation checksum handling vulnerability</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.8.0</ge><le>1.8.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	<p>MIT krb5 (releases incorrectly accepts RFC 3961
	key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH
	and AD-KDC-ISSUED authorization data.</p>
	<p>An authenticated remote attacker that controls a legitimate service
	principal has a 1/256 chance of forging the AD-SIGNEDPATH signature
	if the TGT key is RC4, allowing it to use self-generated "evidence"
	tickets for S4U2Proxy, instead of tickets obtained from the user or
	with S4U2Self. Configurations using RC4 for the TGT key are
	believed to be rare.</p>
	<p>An authenticated remote attacker has a 1/256 chance of forging
	AD-KDC-ISSUED signatures on authdata elements in tickets having
	an RC4 service key, resulting in privilege escalation against
	a service that relies on these signatures. There are no known
	uses of the KDC-ISSUED authdata container at this time.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45117</bid>
	<cvename>CVE-2010-4020</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
	<url>http://osvdb.org/69608</url>
	</references>
	<dates>
	<discovery>2010-11-30</discovery>
	<entry>2010-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="9f971cea-03f5-11e0-bf50-001a926c7637">
	<topic>krb5 -- unkeyed PAC checksum handling vulnerability</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	<p>MIT krb5 incorrectly accepts an unkeyed checksum for PAC
	signatures.</p>
	<p>An authenticated remote attacker can forge PACs if using a KDC that
	does not filter client-provided PAC data. This can result in
	privilege escalation against a service that relies on PAC contents
	to make authorization decisions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45116</bid>
	<cvename>CVE-2010-1324</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
	<url>http://osvdb.org/69609</url>
	</references>
	<dates>
	<discovery>2010-11-30</discovery>
	<entry>2010-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="0d57c1d9-03f4-11e0-bf50-001a926c7637">
	<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
	<range><ge>1.8.0</ge><le>1.8.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	<p>MIT krb incorrectly accepts an unkeyed
	checksum with DES session keys for version 2 (RFC 4121)
	of the GSS-API krb5 mechanism.</p>
	<p>An unauthenticated remote attacker can forge GSS tokens that are
	intended to be integrity-protected but unencrypted, if the targeted
	pre-existing application session uses a DES session key.</p>
	<p>MIT krb5 KDC incorrectly accepts RFC
	3961 key-derivation checksums using RC4 keys when verifying the
	req-checksum in a KrbFastArmoredReq.</p>
	<p>An unauthenticated remote attacker has a 1/256 chance of swapping a
	client-issued KrbFastReq into a different KDC-REQ, if the armor
	key is RC4. The consequences are believed to be minor.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45116</bid>
	<cvename>CVE-2010-1324</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
	<url>http://osvdb.org/69609</url>
	</references>
	<dates>
	<discovery>2010-11-30</discovery>
	<entry>2010-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="11bbccbc-03ee-11e0-bcdb-001fc61c2a55">
	<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.3.0</ge><lt>1.7.2</lt></range>
	<range><ge>1.8.0</ge><le>1.8.3</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	<p>MIT krb5 clients incorrectly accept an unkeyed checksums
	in the SAM-2 preauthentication challenge.</p>
	<p>An unauthenticated remote attacker could alter a SAM-2 challenge,
	affecting the prompt text seen by the user or the kind of response
	sent to the KDC. Under some circumstances, this can negate the
	incremental security benefit of using a single-use authentication
	mechanism token.</p>
	<p>MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums
	using RC4 keys when verifying KRB-SAFE messages.</p>
	<p>An unauthenticated remote attacker has a 1/256 chance of forging
	KRB-SAFE messages in an application protocol if the targeted
	pre-existing session uses an RC4 session key. Few application
	protocols use KRB-SAFE messages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>45118</bid>
	<cvename>CVE-2010-1323</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
	<url>http://osvdb.org/69610</url>
	</references>
	<dates>
	<discovery>2010-11-30</discovery>
	<entry>2010-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="ed7fa1b4-ff59-11df-9759-080027284eaa">
	<topic>proftpd -- Compromised source packages backdoor</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<range><eq>1.3.3c_2</eq></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ProFTPD Project team reports:</p>
	<blockquote cite="http://proftpd.org/">
	<p>The security issue is caused due to the distribution of compromised
	ProFTPD 1.3.3c source code packages via the project's main FTP server
	and all of the mirror servers, which contain a backdoor allowing
	remote root access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org</url>
	<url>http://secunia.com/advisories/42449</url>
	</references>
	<dates>
	<discovery>2010-11-28</discovery>
	<entry>2010-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="753f8185-5ba9-42a4-be02-3f55ee580093">
	<topic>phpMyAdmin -- XSS attack in database search</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.3.8.1</lt></range>
	</package>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php">
	<p>It was possible to conduct a XSS attack using spoofed request on the
	db search script.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/152685</freebsdpr>
	<freebsdpr>ports/152686</freebsdpr>
	<cvename>CVE-2010-4329</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php</url>
	</references>
	<dates>
	<discovery>2010-11-29</discovery>
	<entry>2010-11-30</entry>
	</dates>
	</vuln>

	<vuln vid="f154a3c7-f7f4-11df-b617-00e0815b8da8">
	<topic>isc-dhcp-server -- Empty link-address denial of service</topic>
	<affects>
	<package>
	<name>isc-dhcp41-server</name>
	<range><ge>4.1.0</ge><lt>4.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISC reports:</p>
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2010-3611">
	<p>If the server receives a DHCPv6 packet containing one or more
	Relay-Forward messages, and none of them supply an address in the
	Relay-Forward link-address field, then the server will crash. This
	can be used as a single packet crash attack vector.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3611</cvename>
	<url>http://www.isc.org/software/dhcp/advisories/cve-2010-3611</url>
	<url>http://www.kb.cert.org/vuls/id/102047</url>
	</references>
	<dates>
	<discovery>2010-11-02</discovery>
	<entry>2010-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="373e412e-f748-11df-96cd-0015f2db7bde">
	<topic>OpenTTD -- Denial of service (server/client) via invalid read</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>1.0.0</ge><lt>1.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://security.openttd.org/en/CVE-2010-4168">
	<p>When a client disconnects, without sending the "quit" or
	"client error" message, the server has a chance of reading and
	writing a just freed piece of memory. The writing can only
	happen while the server is sending the map. Depending on what
	happens directly after freeing the memory there is a chance of
	segmentation fault, and thus a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-4168</cvename>
	<url>http://security.openttd.org/en/CVE-2010-4168</url>
	</references>
	<dates>
	<discovery>2010-11-20</discovery>
	<entry>2010-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="a3314314-f731-11df-a757-0011098ad87f">
	<topic>horde-base -- XSS: VCARD attachments vulnerability</topic>
	<affects>
	<package>
	<name>horde-base</name>
	<range><lt>3.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde team reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/532">
	<p>The major changes compared to Horde version 3.3.10 are:</p>
	<p>* Fixed XSS vulnerability when viewing details of a vCard.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://article.gmane.org/gmane.comp.horde.announce/532</url>
	<url>http://bugs.horde.org/ticket/9357</url>
	</references>
	<dates>
	<discovery>2010-11-02</discovery>
	<entry>2010-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="533d20e7-f71f-11df-9ae1-000bcdf0a03b">
	<topic>proftpd -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<range><lt>1.3.3c</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tippingpoint reports:</p>
	<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-10-229/">
	<p>This vulnerability allows remote attackers to execute arbitrary
	code on vulnerable installations of ProFTPD. Authentication is not
	required to exploit this vulnerability.</p>
	<p>The flaw exists within the proftpd server component which
	listens by default on TCP port 21. When reading user input if a
	TELNET_IAC escape sequence is encountered the process
	miscalculates a buffer length counter value allowing a user
	controlled copy of data to a stack buffer. A remote attacker can
	exploit this vulnerability to execute arbitrary code under the
	context of the proftpd process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>44562</bid>
	<cvename>CVE-2010-4221</cvename>
	<url>http://www.zerodayinitiative.com/advisories/ZDI-10-229/</url>
	</references>
	<dates>
	<discovery>2010-11-02</discovery>
	<entry>2010-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="3042c33a-f237-11df-9d02-0018fe623f2b">
	<topic>openssl -- TLS extension parsing race condition</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><lt>1.0.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenSSL Team reports:</p>
	<blockquote cite="http://openssl.org/news/secadv_20101116.txt">
	<p>Rob Hulswit has found a flaw in the OpenSSL TLS server extension
	code parsing which on affected servers can be exploited in a buffer
	overrun attack.</p>
	<p>Any OpenSSL based TLS server is vulnerable if it is multi-threaded
	and uses OpenSSL's internal caching mechanism. Servers that are
	multi-process and/or disable internal session caching are NOT
	affected.</p>
	<p>In particular the Apache HTTP server (which never uses OpenSSL
	internal caching) and Stunnel (which includes its own workaround)
	are NOT affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3864</cvename>
	<url>http://openssl.org/news/secadv_20101116.txt</url>
	</references>
	<dates>
	<discovery>2010-10-08</discovery>
	<entry>2010-11-17</entry>
	</dates>
	</vuln>

	<vuln vid="76b597e4-e9c6-11df-9e10-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r289</lt></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r102</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-26.html">
	<p>Critical vulnerabilities have been identified in
	Adobe Flash Player 10.1.85.3 and earlier versions for
	Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player
	10.1.95.1 for Android. These vulnerabilities, including
	CVE-2010-3654 referenced in Security Advisory APSA10-05,
	could cause the application to crash and could potentially
	allow an attacker to take control of the affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3636</cvename>
	<cvename>CVE-2010-3637</cvename>
	<cvename>CVE-2010-3638</cvename>
	<cvename>CVE-2010-3639</cvename>
	<cvename>CVE-2010-3640</cvename>
	<cvename>CVE-2010-3641</cvename>
	<cvename>CVE-2010-3642</cvename>
	<cvename>CVE-2010-3643</cvename>
	<cvename>CVE-2010-3644</cvename>
	<cvename>CVE-2010-3645</cvename>
	<cvename>CVE-2010-3646</cvename>
	<cvename>CVE-2010-3647</cvename>
	<cvename>CVE-2010-3648</cvename>
	<cvename>CVE-2010-3649</cvename>
	<cvename>CVE-2010-3650</cvename>
	<cvename>CVE-2010-3652</cvename>
	<cvename>CVE-2010-3654</cvename>
	<cvename>CVE-2010-3676</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb10-26.html</url>
	<url>http://www.adobe.com/support/security/advisories/apsa10-05.html</url>
	</references>
	<dates>
	<discovery>2010-09-28</discovery>
	<entry>2010-11-06</entry>
	</dates>
	</vuln>

	<vuln vid="b2eaa7c2-e64a-11df-bc65-0022156e8794">
	<topic>Wireshark -- DoS in the BER-based dissectors</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
	</package>
	<package>
	<name>wireshark-lite</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
	</package>
	<package>
	<name>tshark</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
	</package>
	<package>
	<name>tshark-lite</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/41535">
	<p>A vulnerability has been discovered in Wireshark, which can
	be exploited by malicious people to cause a DoS (Denial of
	Service).</p>
	<p>The vulnerability is caused due to an infinite recursion
	error in the "dissect_unknown_ber()" function in
	epan/dissectors/packet-ber.c and can be exploited to cause a
	stack overflow e.g. via a specially crafted SNMP packet.</p>
	<p>The vulnerability is confirmed in version 1.4.0 and
	reported in version 1.2.11 and prior and version 1.4.0 and
	prior.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3445</cvename>
	<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html</url>
	<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html</url>
	</references>
	<dates>
	<discovery>2010-09-16</discovery>
	<entry>2010-11-05</entry>
	</dates>
	</vuln>

	<vuln vid="4ab29e12-e787-11df-adfa-00e0815b8da8">
	<topic>Mailman -- cross-site scripting in web interface</topic>
	<affects>
	<package>
	<name>mailman</name>
	<range><lt>2.1.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/41265">
	<p>Two vulnerabilities have been reported in Mailman, which
	can be exploited by malicious users to conduct script
	insertion attacks.</p>
	<p>Certain input passed via the list descriptions is not
	properly sanitised before being displayed to the user. This
	can be exploited to insert arbitrary HTML and script code,
	which will be executed in a user's browser session in context
	of an affected site when the malicious data is being
	viewed.</p>
	<p>Successful exploitation requires "list owner" permissions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>43187</bid>
	<cvename>CVE-2010-3089</cvename>
	<url>http://secunia.com/advisories/41265</url>
	</references>
	<dates>
	<discovery>2010-09-14</discovery>
	<entry>2010-11-03</entry>
	</dates>
	</vuln>

	<vuln vid="96e776c7-e75c-11df-8f26-00151735203a">
	<topic>OTRS -- Multiple XSS and denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><gt>2.3.*</gt><lt>2.4.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://otrs.org/advisory/OSA-2010-02-en/">
	<ul>
	<li>Multiple Cross Site Scripting issues:
	Missing HTML quoting allows authenticated agents or
	customers to inject HTML tags. This vulnerability
	allows an attacker to inject script code into the OTRS
	web-interface which will be loaded and executed
	in the browsers of system users.</li>
	<li>Possible Denial of Service Attack:
	Perl's regular expressions consume 100% CPU time
	on the server if an agent or customer views an affected
	article. To exploit this vulnerability the malicious user
	needs to send extremely large HTML emails to your
	system address.</li>
	</ul>
	</blockquote>
	<blockquote cite="http://otrs.org/advisory/OSA-2010-03-en/">
	<p>AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:</p>
	<p>Whenever a customer sends an HTML e-mail and RichText is enabled
	in OTRS, javascript contained in the email can do everything
	in the OTRS agent interface that the agent himself could do.</p>
	<p>Most relevant is that this type of exploit can be used in such
	a way that the agent won't even detect he is being exploited.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2080</cvename>
	<cvename>CVE-2010-4071</cvename>
	<url>http://otrs.org/advisory/OSA-2010-02-en/</url>
	<url>http://otrs.org/advisory/OSA-2010-03-en/</url>
	</references>
	<dates>
	<discovery>2010-09-15</discovery>
	<entry>2010-11-03</entry>
	</dates>
	</vuln>

	<vuln vid="c223b00d-e272-11df-8e32-000f20797ede">
	<topic>mozilla -- Heap buffer overflow mixing document.write and DOM insertion</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.12,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.15,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.12</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.12,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.15</lt></range>
	</package>
	<package>
	<name>linux-seamonkey</name>
	<range><lt>2.0.10</lt></range>
	</package>
	<package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.6</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.10</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.10</lt></range>
	<range><ge>3.1</ge><lt>3.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3765</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-73.html</url>
	</references>
	<dates>
	<discovery>2010-10-27</discovery>
	<entry>2010-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="aab187d4-e0f3-11df-b1ea-001999392805">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>10.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Opera Desktop Team reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1063/">
	<ul>
	<li>Fixed an issue that allowed cross-domain checks to be bypassed,
	allowing limited data theft using CSS, as reported by Isaac
	Dawson.</li>
	<li>Fixed an issue where manipulating the window could be used to
	spoof the page address.</li>
	<li>Fixed an issue with reloads and redirects that could allow
	spoofing and cross-site scripting.</li>
	<li>Fixed an issue that allowed private video streams to be
	intercepted, as reported by Nirankush Panchbhai of Microsoft
	Vulnerability Research.</li>
	<li>Fixed an issue that caused JavaScript to run in the wrong
	security context after manual interaction.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/kb/view/971/</url>
	<url>http://www.opera.com/support/kb/view/972/</url>
	<url>http://www.opera.com/support/kb/view/973/</url>
	<url>http://www.opera.com/support/kb/view/974/</url>
	<url>http://www.opera.com/support/kb/view/976/</url>
	</references>
	<dates>
	<discovery>2010-10-12</discovery>
	<entry>2010-10-26</entry>
	</dates>
	</vuln>

	<vuln vid="0ddb57a9-da20-4e99-b048-4366092f3d31">
	<topic>bzip2 -- integer overflow vulnerability</topic>
	<affects>
	<package>
	<name>bzip2</name>
	<range><lt>1.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/41452">
	<p>A vulnerability has been reported in bzip2, which can be exploited by
	malicious people to cause a DoS (Denial of Service) or potentially
	compromise a vulnerable system.</p>
	<p>The vulnerability is caused due to an integer overflow in the
	"BZ2_decompress()" function in decompress.c and can be exploited to
	cause a crash or potentially execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:08.bzip2</freebsdsa>
	<freebsdpr>ports/151364</freebsdpr>
	<cvename>CVE-2010-0405</cvename>
	<bid>43331</bid>
	<mlist>http://www.openwall.com/lists/oss-security/2010/09/21/4</mlist>
	<url>http://secunia.com/advisories/41452</url>
	</references>
	<dates>
	<discovery>2010-09-21</discovery>
	<entry>2010-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="18dc48fe-ca42-11df-aade-0050568f000c">
	<topic>FreeBSD -- Integer overflow in bzip2 decompression</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.4</ge><lt>6.4_11</lt></range>
	<range><ge>7.1</ge><lt>7.1_14</lt></range>
	<range><ge>7.3</ge><lt>7.3_3</lt></range>
	<range><ge>8.0</ge><lt>8.0_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When decompressing data, the run-length encoded values are not
	adequately sanity-checked, allowing for an integer overflow.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:08.bzip2</freebsdsa>
	</references>
	<dates>
	<discovery>2010-09-20</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="7a09a8df-ca41-11df-aade-0050568f000c">
	<topic>FreeBSD -- Lost mbuf flag resulting in data corruption</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.1</ge><lt>7.1_13</lt></range>
	<range><ge>7.3</ge><lt>7.3_2</lt></range>
	<range><ge>8.0</ge><lt>8.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The read-only flag is not correctly copied when a mbuf buffer
	reference is duplicated. When the sendfile(2) system call is used to
	transmit data over the loopback interface, this can result in the
	backing pages for the transmitted file being modified, causing data
	corruption.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:07.mbuf</freebsdsa>
	</references>
	<dates>
	<discovery>2010-07-13</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="0dc91089-ca41-11df-aade-0050568f000c">
	<topic>FreeBSD -- Unvalidated input in nfsclient</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.2</ge><lt>7.2_8</lt></range>
	<range><ge>7.3</ge><lt>7.3_1</lt></range>
	<range><ge>8.0</ge><lt>8.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The NFS client subsystem fails to correctly validate the length of a
	parameter provided by the user when a filesystem is mounted.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:06.nfsclient</freebsdsa>
	</references>
	<dates>
	<discovery>2010-05-27</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="768cfe70-ca40-11df-aade-0050568f000c">
	<topic>FreeBSD -- OPIE off-by-one stack overflow</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.4</ge><lt>6.4_10</lt></range>
	<range><ge>7.1</ge><lt>7.1_12</lt></range>
	<range><ge>7.2</ge><lt>7.2_8</lt></range>
	<range><ge>7.3</ge><lt>7.3_1</lt></range>
	<range><ge>8.0</ge><lt>8.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>A programming error in the OPIE library could allow an off-by-one
	buffer overflow to write a single zero byte beyond the end of an
	on-stack buffer.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:05.opie</freebsdsa>
	</references>
	<dates>
	<discovery>2010-05-27</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="f6eb2279-ca3f-11df-aade-0050568f000c">
	<topic>FreeBSD -- Insufficient environment sanitization in jail(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.0</ge><lt>8.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The jail(8) utility does not change the current working directory
	while imprisoning. The current working directory can be accessed by
	its descendants.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:04.jail</freebsdsa>
	</references>
	<dates>
	<discovery>2010-05-27</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="97f09f2f-ca3f-11df-aade-0050568f000c">
	<topic>FreeBSD -- ZFS ZIL playback with insecure permissions</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.1</ge><lt>7.1_10</lt></range>
	<range><ge>7.2</ge><lt>7.2_6</lt></range>
	<range><ge>8.0</ge><lt>8.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When replaying setattr transaction, the replay code would set the
	attributes with certain insecure defaults, when the logged
	transaction did not touch these attributes.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:03.zfs</freebsdsa>
	</references>
	<dates>
	<discovery>2010-01-06</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="48103b0a-ca3f-11df-aade-0050568f000c">
	<topic>FreeBSD -- ntpd mode 7 denial of service</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_15</lt></range>
	<range><ge>6.4</ge><lt>6.4_9</lt></range>
	<range><ge>7.1</ge><lt>7.1_10</lt></range>
	<range><ge>7.2</ge><lt>7.2_6</lt></range>
	<range><ge>8.0</ge><lt>8.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>If ntpd receives a mode 7 (MODE_PRIVATE) request or error response
	from a source address not listed in either a 'restrict ... noquery'
	or a 'restrict ... ignore' section it will log the even and send a
	mode 7 error response.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:02.ntpd</freebsdsa>
	</references>
	<dates>
	<discovery>2010-01-06</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="e500b9bf-ca3e-11df-aade-0050568f000c">
	<topic>FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_15</lt></range>
	<range><ge>6.4</ge><lt>6.4_9</lt></range>
	<range><ge>7.1</ge><lt>7.1_10</lt></range>
	<range><ge>7.2</ge><lt>7.2_6</lt></range>
	<range><ge>8.0</ge><lt>8.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>If a client requests DNSSEC records with the Checking Disabled (CD)
	flag set, BIND may cache the unvalidated responses. These responses
	may later be returned to another client that has not set the CD
	flag.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-10:01.bind</freebsdsa>
	</references>
	<dates>
	<discovery>2010-01-06</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="6e87b696-ca3e-11df-aade-0050568f000c">
	<topic>FreeBSD -- Inappropriate directory permissions in freebsd-update(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_14</lt></range>
	<range><ge>6.4</ge><lt>6.4_8</lt></range>
	<range><ge>7.1</ge><lt>7.1_9</lt></range>
	<range><ge>7.2</ge><lt>7.2_5</lt></range>
	<range><ge>8.0</ge><lt>8.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When downloading updates to FreeBSD via 'freebsd-update fetch' or
	'freebsd-update upgrade', the freebsd-update(8) utility copies
	currently installed files into its working directory
	(/var/db/freebsd-update by default) both for the purpose of merging
	changes to configuration files and in order to be able to roll back
	installed updates.</p>
	<p>The default working directory used by freebsd-update(8) is normally
	created during the installation of FreeBSD with permissions which
	allow all local users to see its contents, and freebsd-update(8) does
	not take any steps to restrict access to files stored in said
	directory.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-09:17.freebsd-update</freebsdsa>
	</references>
	<dates>
	<discovery>2009-12-03</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="ad08d14b-ca3d-11df-aade-0050568f000c">
	<topic>FreeBSD -- Improper environment sanitization in rtld(1)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.1</ge><lt>7.1_9</lt></range>
	<range><ge>7.2</ge><lt>7.2_5</lt></range>
	<range><ge>8.0</ge><lt>8.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When running setuid programs rtld will normally remove potentially
	dangerous environment variables. Due to recent changes in FreeBSD
	environment variable handling code, a corrupt environment may
	result in attempts to unset environment variables failing.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-09:16.rtld</freebsdsa>
	</references>
	<dates>
	<discovery>2009-12-03</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="406779fd-ca3b-11df-aade-0050568f000c">
	<topic>FreeBSD -- SSL protocol flaw</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_14</lt></range>
	<range><ge>6.4</ge><lt>6.4_8</lt></range>
	<range><ge>7.1</ge><lt>7.1_9</lt></range>
	<range><ge>7.2</ge><lt>7.2_5</lt></range>
	<range><ge>8.0</ge><lt>8.0_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The SSL version 3 and TLS protocols support session
	renegotiation without cryptographically tying the new
	session parameters to the old parameters.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-09:15.ssl</freebsdsa>
	</references>
	<dates>
	<discovery>2009-12-03</discovery>
	<entry>2010-10-24</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="c9a6ae4a-df8b-11df-9573-00262d5ed8ee">
	<topic>monotone -- remote denial of service in default setup</topic>
	<affects>
	<package>
	<name>monotone</name>
	<range><lt>0.48.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The monotone developers report:</p>
	<blockquote cite="http://www.monotone.ca/NEWS">
	<p>Running "mtn ''" or "mtn ls ''" doesn't cause an internal
	error anymore. In monotone 0.48 and earlier this behavior
	could be used to crash a server remotely (but only if it was
	configured to allow execution of remote commands).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/151665</freebsdpr>
	<url>http://www.monotone.ca/NEWS</url>
	<url>http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/</url>
	</references>
	<dates>
	<discovery>2010-10-21</discovery>
	<entry>2010-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="c4f067b9-dc4a-11df-8e32-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.11,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.14,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.11</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.11,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.14</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.9</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.9</lt></range>
	<range><ge>3.1</ge><lt>3.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)</p>
	<p>MFSA 2010-65 Buffer overflow and memory corruption using document.write</p>
	<p>MFSA 2010-66 Use-after-free error in nsBarProp</p>
	<p>MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter</p>
	<p>MFSA 2010-68 XSS in gopher parser when parsing hrefs</p>
	<p>MFSA 2010-69 Cross-site information disclosure via modal calls</p>
	<p>MFSA 2010-70 SSL wildcard certificate matching IP addresses</p>
	<p>MFSA 2010-71 Unsafe library loading vulnerabilities</p>
	<p>MFSA 2010-72 Insecure Diffie-Hellman key exchange</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3170</cvename>
	<cvename>CVE-2010-3173</cvename>
	<cvename>CVE-2010-3174</cvename>
	<cvename>CVE-2010-3175</cvename>
	<cvename>CVE-2010-3176</cvename>
	<cvename>CVE-2010-3177</cvename>
	<cvename>CVE-2010-3178</cvename>
	<cvename>CVE-2010-3179</cvename>
	<cvename>CVE-2010-3180</cvename>
	<cvename>CVE-2010-3181</cvename>
	<cvename>CVE-2010-3182</cvename>
	<cvename>CVE-2010-3183</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-64.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-65.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-66.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-67.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-68.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-69.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-70.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-71.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-72.html</url>
	</references>
	<dates>
	<discovery>2010-10-19</discovery>
	<entry>2010-10-20</entry>
	</dates>
	</vuln>

	<vuln vid="e5090d2a-dbbe-11df-82f8-0015f2db7bde">
	<topic>Webkit-gtk2 -- Multiple Vulnabilities</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Noronha Silva reports:</p>
	<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
	<p>The patches to fix the following CVEs are included with help from
	Vincent Danen and other members of the Red Hat security team:</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1780</cvename>
	<cvename>CVE-2010-1807</cvename>
	<cvename>CVE-2010-1812</cvename>
	<cvename>CVE-2010-1814</cvename>
	<cvename>CVE-2010-1815</cvename>
	<cvename>CVE-2010-3113</cvename>
	<cvename>CVE-2010-3114</cvename>
	<cvename>CVE-2010-3115</cvename>
	<cvename>CVE-2010-3116</cvename>
	<cvename>CVE-2010-3255</cvename>
	<cvename>CVE-2010-3257</cvename>
	<cvename>CVE-2010-3259</cvename>
	<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
	</references>
	<dates>
	<discovery>2010-10-01</discovery>
	<entry>2010-10-19</entry>
	</dates>
	</vuln>

	<vuln vid="dd943fbb-d0fe-11df-95a8-00219b0fc4d8">
	<topic>apr -- multiple vunerabilities</topic>
	<affects>
	<package>
	<name>apr1</name>
	<range><lt>1.4.2.1.3.10</lt></range>
	</package>
	<package>
	<name>apr0</name>
	<range><lt>0.9.19.0.9.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/41701">
	<p>Multiple vulnerabilities have been reported in APR-util, which can
	be exploited by malicious people to cause a DoS (Denial of
	Service).</p>
	<p>Two XML parsing vulnerabilities exist in the bundled version of
	expat.</p>
	<p>An error within the "apr_brigade_split_line()" function in
	buckets/apr_brigade.c can be exploited to cause high memory
	consumption.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>43673</bid>
	<cvename>CVE-2009-3560</cvename>
	<cvename>CVE-2009-3720</cvename>
	<cvename>CVE-2010-1623</cvename>
	<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
	<url>http://secunia.com/advisories/41701</url>
	</references>
	<dates>
	<discovery>2010-10-02</discovery>
	<entry>2010-10-06</entry>
	<modified>2010-10-20</modified>
	</dates>
	</vuln>

	<vuln vid="99021f88-ca3c-11df-be21-00e018aa7788">
	<topic>phpmyfaq -- cross site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>phpmyfaq</name>
	<range><lt>2.6.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyFAQ project reports:</p>
	<blockquote cite="http://www.phpmyfaq.de/advisory_2010-09-28.php">
	<p>The phpMyFAQ Team has learned of a security issue that has been
	discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize
	some variables in different pages correctly. With a
	properly crafted URL it is e.g. possible to inject
	JavaScript code into the output of a page, which could
	result in the leakage of domain cookies (f.e. session
	identifiers)..</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/151055</freebsdpr>
	<url>http://www.phpmyfaq.de/advisory_2010-09-28.php</url>
	</references>
	<dates>
	<discovery>2010-09-28</discovery>
	<entry>2010-10-02</entry>
	</dates>
	</vuln>

	<vuln vid="e08c596e-cb28-11df-9c1b-0011098ad87f">
	<topic>horde-gollem -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>horde-gollem</name>
	<range><lt>1.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde team reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/523">
	<p>The major changes compared to Gollem version H3 (1.1.1) are:</p>
	<p>* Fixed an XSS vulnerability in the file viewer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://article.gmane.org/gmane.comp.horde.announce/523</url>
	<url>http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&r1=1.114.2.55&r2=1.114.2.59&ty=h</url>
	<url>http://bugs.horde.org/ticket/9191</url>
	</references>
	<dates>
	<discovery>2010-08-21</discovery>
	<entry>2010-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="6c4db192-cb23-11df-9c1b-0011098ad87f">
	<topic>horde-imp -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>horde-imp</name>
	<range><gt>4.2,1</gt><lt>4.3.8,1</lt></range>
	<range><lt>4.3.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde team reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/516">
	<p>Thanks to Naumann IT Security Consulting for reporting the XSS
	vulnerability.</p>
	<p>The major changes compared to IMP version H3 (4.3.7) are:</p>
	<p>* Fixed an XSS vulnerability in the Fetchmail configuration.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://article.gmane.org/gmane.comp.horde.announce/516</url>
	<url>http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h</url>
	</references>
	<dates>
	<discovery>2010-09-28</discovery>
	<entry>2010-09-28</entry>
	<modified>2011-09-23</modified>
	</dates>
	</vuln>

	<vuln vid="8fc55043-cb1e-11df-9c1b-0011098ad87f">
	<topic>horde-base -- XSS and CSRF vulnerabilities</topic>
	<affects>
	<package>
	<name>horde-base</name>
	<range><lt>3.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde team reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/515">
	<p>Thanks to Naumann IT Security Consulting for reporting the XSS
	vulnerability.</p>
	<p>Thanks to Secunia for releasing an advisory for the new CSRF
	protection in the preference interface</p>
	<p>The major changes compared to Horde version 3.3.8 are:</p>
	<p>* Fixed XSS vulnerability in util/icon_browser.php.</p>
	<p>* Protected preference forms against CSRF attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://article.gmane.org/gmane.comp.horde.announce/515</url>
	<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.607&r2=1.515.2.620&ty=h</url>
	<url>http://secunia.com/advisories/39860/</url>
	<url>http://holisticinfosec.org/content/view/145/45/</url>
	</references>
	<dates>
	<discovery>2010-06-03</discovery>
	<entry>2010-09-28</entry>
	</dates>
	</vuln>

	<vuln vid="80b6d6cc-c970-11df-bb18-0015587e2cc1">
	<topic>openx -- remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>openx</name>
	<range><lt>2.8.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenX project reported:</p>
	<blockquote cite="http://blog.openx.org/09/security-update/">
	<p>It has been brought to our attention that there is a vulnerability
	in the 2.8 downloadable version of OpenX that can result in a server
	running the downloaded version of OpenX being compromised.</p>
	</blockquote>
	<p>This vulnerability exists in the file upload functionality
	and allows attackers to upload and execute PHP code of
	their choice.</p>
	</body>
	</description>
	<references>
	<url>http://blog.openx.org/09/security-update/</url>
	<url>http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html</url>
	</references>
	<dates>
	<discovery>2010-09-14</discovery>
	<entry>2010-09-26</entry>
	</dates>
	</vuln>

	<vuln vid="e4dac715-c818-11df-a92c-0015587e2cc1">
	<topic>squid -- Denial of service vulnerability in request handling</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.0.1</ge><lt>3.0.25_3</lt></range>
	<range><ge>3.1.0.1</ge><lt>3.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2010:3 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_3.txt">
	<p>Due to an internal error in string handling Squid is
	vulnerable to a denial of service attack when processing
	specially crafted requests.</p>
	<p>This problem allows any trusted client to perform a
	denial of service attack on the Squid service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3072</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2010_3.txt</url>
	</references>
	<dates>
	<discovery>2010-08-30</discovery>
	<entry>2010-09-24</entry>
	</dates>
	</vuln>

	<vuln vid="8a34d9e6-c662-11df-b2e1-001b2134ef46">
	<topic>linux-flashplugin -- remote code execution</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r283</lt></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r85</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa10-03.html">
	<p>A critical vulnerability exists in Adobe Flash Player
	10.1.82.76 and earlier versions for Windows, Macintosh,
	Linux, Solaris, and Adobe Flash Player 10.1.92.10 for
	Android. This vulnerability also affects Adobe Reader
	9.3.4 and earlier versions for Windows, Macintosh and
	UNIX, and Adobe Acrobat 9.3.4 and earlier versions for
	Windows and Macintosh. This vulnerability (CVE-2010-2884)
	could cause a crash and potentially allow an attacker
	to take control of the affected system. There are
	reports that this vulnerability is being actively
	exploited in the wild against Adobe Flash Player on
	Windows. Adobe is not aware of any attacks exploiting
	this vulnerability against Adobe Reader or Acrobat to
	date.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2884</cvename>
	<url>http://www.adobe.com/support/security/advisories/apsa10-03.html</url>
	</references>
	<dates>
	<discovery>2010-09-14</discovery>
	<entry>2010-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="3ff95dd3-c291-11df-b0dc-00215c6a37bb">
	<topic>django -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><gt>1.2</gt><lt>1.2.2</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>13698,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django project reports:</p>
	<blockquote cite="http://www.djangoproject.com/weblog/2010/sep/08/security-release/">
	<p>The provided template tag for inserting the CSRF
	token into forms -- {% csrf_token %} -- explicitly
	trusts the cookie value, and displays it as-is.
	Thus, an attacker who is able to tamper with the
	value of the CSRF cookie can cause arbitrary content
	to be inserted, unescaped, into the outgoing HTML of
	the form, enabling cross-site scripting (XSS) attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>43116</bid>
	<cvename>CVE-2010-3082</cvename>
	<url>http://xforce.iss.net/xforce/xfdb/61729</url>
	</references>
	<dates>
	<discovery>2010-09-13</discovery>
	<entry>2010-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="9bcfd7b6-bcda-11df-9a6a-0015f2db7bde">
	<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Noronha Silva reports:</p>
	<blockquote cite="http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8">
	<p>With help from Vincent Danen and other members of the Red Hat
	security team, the following CVE's where fixed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1781</cvename>
	<cvename>CVE-2010-1782</cvename>
	<cvename>CVE-2010-1784</cvename>
	<cvename>CVE-2010-1785</cvename>
	<cvename>CVE-2010-1786</cvename>
	<cvename>CVE-2010-1787</cvename>
	<cvename>CVE-2010-1788</cvename>
	<cvename>CVE-2010-1790</cvename>
	<cvename>CVE-2010-1792</cvename>
	<cvename>CVE-2010-1793</cvename>
	<cvename>CVE-2010-2647</cvename>
	<cvename>CVE-2010-2648</cvename>
	<cvename>CVE-2010-3119</cvename>
	<url>http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8</url>
	</references>
	<dates>
	<discovery>2010-09-07</discovery>
	<entry>2010-09-10</entry>
	</dates>
	</vuln>

	<vuln vid="f866d2af-bbba-11df-8a8d-0008743bf21a">
	<topic>vim6 -- heap-based overflow while parsing shell metacharacters</topic>
	<affects>
	<package>
	<name>vim6</name>
	<name>vim6+ruby</name>
	<range><ge>6.2.429</ge><lt>6.3.62</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Description for CVE-2008-3432 says:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3432">
	<p>Heap-based buffer overflow in the mch_expand_wildcards
	function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted
	attackers to execute arbitrary code via shell metacharacters
	in filenames, as demonstrated by the netrw.v3 test case.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3432</cvename>
	<url>http://www.openwall.com/lists/oss-security/2008/07/15/4</url>
	</references>
	<dates>
	<discovery>2008-07-31</discovery>
	<entry>2010-09-09</entry>
	</dates>
	</vuln>

	<vuln vid="4a21ce2c-bb13-11df-8e32-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.9,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.12,1</lt></range>
	</package>
	<package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.9</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.9,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.12</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.7</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.7</lt></range>
	<range><ge>3.1</ge><lt>3.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)</p>
	<p>MFSA 2010-50 Frameset integer overflow vulnerability</p>
	<p>MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array</p>
	<p>MFSA 2010-52 Windows XP DLL loading vulnerability</p>
	<p>MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText</p>
	<p>MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection</p>
	<p>MFSA 2010-55 XUL tree removal crash and remote code execution</p>
	<p>MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView</p>
	<p>MFSA 2010-57 Crash and remote code execution in normalizeDocument</p>
	<p>MFSA 2010-58 Crash on Mac using fuzzed font in data: URL</p>
	<p>MFSA 2010-59 SJOW creates scope chains ending in outer object</p>
	<p>MFSA 2010-60 XSS using SJOW scripted function</p>
	<p>MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute</p>
	<p>MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS</p>
	<p>MFSA 2010-63 Information leak via XMLHttpRequest statusText</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2762</cvename>
	<cvename>CVE-2010-2763</cvename>
	<cvename>CVE-2010-2764</cvename>
	<cvename>CVE-2010-2765</cvename>
	<cvename>CVE-2010-2766</cvename>
	<cvename>CVE-2010-2767</cvename>
	<cvename>CVE-2010-2768</cvename>
	<cvename>CVE-2010-2769</cvename>
	<cvename>CVE-2010-2770</cvename>
	<cvename>CVE-2010-2760</cvename>
	<cvename>CVE-2010-3131</cvename>
	<cvename>CVE-2010-3166</cvename>
	<cvename>CVE-2010-3167</cvename>
	<cvename>CVE-2010-3168</cvename>
	<cvename>CVE-2010-3169</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-49.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-50.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-51.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-52.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-53.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-54.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-55.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-56.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-57.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-58.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-59.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-60.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-61.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-62.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-63.html</url>
	</references>
	<dates>
	<discovery>2010-09-07</discovery>
	<entry>2010-09-08</entry>
	<modified>2010-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="67b514c3-ba8f-11df-8f6e-000c29a67389">
	<topic>sudo -- Flaw in Runas group matching</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><ge>1.7.0</ge><lt>1.7.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group.html">
	<p>Beginning with sudo version 1.7.0 it has been possible to grant
	permission to run a command using a specified group via sudo -g
	option (run as group). A flaw exists in the logic that matches
	Runas groups in the sudoers file when the -u option is also
	specified (run as user). This flaw results in a positive match for
	the user specified via -u so long as the group specified via -g
	is allowed by the sudoers file.</p>
	<p>Exploitation of the flaw requires that Sudo be configured with
	sudoers entries that contain a Runas group. Entries that do not
	contain a Runas group, or only contain a Runas user are not
	affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2956</cvename>
	<url>http://www.sudo.ws/sudo/alerts/runas_group.html</url>
	</references>
	<dates>
	<discovery>2010-09-07</discovery>
	<entry>2010-09-07</entry>
	</dates>
	</vuln>

	<vuln vid="29b7e3f4-b6a9-11df-ae63-f255a795cb21">
	<topic>lftp -- multiple HTTP client download filename vulnerability</topic>
	<affects>
	<package>
	<name>lftp</name>
	<range><lt>4.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The get1 command, as used by lftpget, in LFTP before 4.0.6 does
	not properly validate a server-provided filename before determining
	the destination filename of a download, which allows remote servers
	to create or overwrite arbitrary files via a Content-Disposition
	header that suggests a crafted filename, and possibly execute
	arbitrary code as a consequence of writing to a dotfile in a home
	directory.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2251</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=591580</url>
	</references>
	<dates>
	<discovery>2010-06-09</discovery>
	<entry>2010-09-03</entry>
	</dates>
	</vuln>

	<vuln vid="d754b7d2-b6a7-11df-826c-e464a695cb21">
	<topic>wget -- multiple HTTP client download filename vulnerability</topic>
	<affects>
	<package>
	<name>wget</name>
	<name>wget-devel</name>
	<range><le>1.12_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU Wget version 1.12 and earlier uses a server-provided filename
	instead of the original URL to determine the destination filename of
	a download, which allows remote servers to create or overwrite
	arbitrary files via a 3xx redirect to a URL with a .wgetrc filename
	followed by a 3xx redirect to a URL with a crafted filename, and
	possibly execute arbitrary code as a consequence of writing to a
	dotfile in a home directory.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2252</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=602797</url>
	</references>
	<dates>
	<discovery>2010-06-09</discovery>
	<entry>2010-09-03</entry>
	</dates>
	</vuln>

	<vuln vid="3a7c5fc4-b50c-11df-977b-ecc31dd8ad06">
	<topic>p5-libwww -- possibility to remote servers to create file with a .(dot) character</topic>
	<affects>
	<package>
	<name>p5-libwww</name>
	<range><lt>5.835</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>lwp-download in libwww-perl before 5.835 does not reject downloads
	to filenames that begin with a `.' (dot) character, which allows
	remote servers to create or overwrite files via a 3xx redirect to a
	URL with a crafted filename or a Content-Disposition header that
	suggests a crafted filename, and possibly execute arbitrary code as
	a consequence of writing to a dotfile in a home directory.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2253</cvename>
	<url>http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes</url>
	</references>
	<dates>
	<discovery>2010-06-09</discovery>
	<entry>2010-08-31</entry>
	</dates>
	</vuln>

	<vuln vid="167953a4-b01c-11df-9a98-0015587e2cc1">
	<topic>quagga -- stack overflow and DoS vulnerabilities</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>0.99.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Red Hat security team reported two vulnerabilities:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2010/08/24/3">
	<p>A stack buffer overflow flaw was found in the way Quagga's bgpd
	daemon processed Route-Refresh messages. A configured
	Border Gateway Protocol (BGP) peer could send a
	Route-Refresh message with specially-crafted Outbound
	Route Filtering (ORF) record, which would cause the
	master BGP daemon (bgpd) to crash or, possibly, execute
	arbitrary code with the privileges of the user running
	bgpd.</p>
	<p>A NULL pointer dereference flaw was found in the way
	Quagga's bgpd daemon parsed paths of autonomous systems
	(AS). A configured BGP peer could send a BGP update AS
	path request with unknown AS type, which could lead to
	denial of service (bgpd daemon crash).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openwall.com/lists/oss-security/2010/08/24/3</url>
	<url>http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100</url>
	</references>
	<dates>
	<discovery>2010-08-24</discovery>
	<entry>2010-08-25</entry>
	</dates>
	</vuln>

	<vuln vid="8cbf4d65-af9a-11df-89b8-00151735203a">
	<topic>bugzilla -- information disclosure, denial of service</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><gt>2.17.1</gt><lt>3.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.2.7/">
	<ul>
	<li>Remote Information Disclosure:
	An unprivileged user is normally not allowed to view
	other users' group membership. But boolean charts
	let the user use group-based pronouns, indirectly
	disclosing group membership. This security fix
	restricts the use of pronouns to groups the user
	belongs to.</li>
	<li>Notification Bypass:
	Normally, when a user is impersonated, he receives
	an email informing him that he is being impersonated,
	containing the identity of the impersonator. However,
	it was possible to impersonate a user without this
	notification being sent.</li>
	<li>Remote Information Disclosure:
	An error message thrown by the "Reports" and "Duplicates"
	page confirmed the non-existence of products, thus
	allowing users to guess confidential product names.
	(Note that the "Duplicates" page was not vulnerable
	in Bugzilla 3.6rc1 and above though.)</li>
	<li>Denial of Service:
	If a comment contained the phrases "bug X" or
	"attachment X", where X was an integer larger than the
	maximum 32-bit signed integer size, PostgreSQL would
	throw an error, and any page containing that comment would
	not be viewable. On most Bugzillas, any user can enter
	a comment on any bug, so any user could have used this to
	deny access to one or all bugs. Bugzillas running on
	databases other than PostgreSQL are not affected.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2756</cvename>
	<cvename>CVE-2010-2757</cvename>
	<cvename>CVE-2010-2758</cvename>
	<cvename>CVE-2010-2759</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=417048</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=450013</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=577139</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=519835</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=583690</url>
	</references>
	<dates>
	<discovery>2010-08-05</discovery>
	<entry>2010-08-24</entry>
	</dates>
	</vuln>

	<vuln vid="b6069837-aadc-11df-82df-0015f2db7bde">
	<topic>OpenTTD -- Denial of service (server) via infinite loop</topic>
	<affects>
	<package>
	<name>openttd</name>
	<range><ge>1.0.1</ge><lt>1.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenTTD Team reports:</p>
	<blockquote cite="http://security.openttd.org/en/CVE-2010-2534">
	<p>When multiple commands are queued (at the server) for execution
	in the next game tick and an client joins the server can get into
	an infinite loop. With the default settings triggering this bug
	is difficult (if not impossible), however the larger value of
	the "frame_freq" setting is easier it is to trigger the bug.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2534</cvename>
	<url>http://security.openttd.org/en/CVE-2010-2534</url>
	</references>
	<dates>
	<discovery>2010-06-27</discovery>
	<entry>2010-08-22</entry>
	</dates>
	</vuln>

	<vuln vid="67a1c3ae-ad69-11df-9be6-0015587e2cc1">
	<topic>corkscrew -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>corkscrew</name>
	<range><le>2.0</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The affected corkscrew versions use sscanf calls without proper
	bounds checking. In the authentication file parsing routine
	this can cause an exploitable buffer overflow condition.
	A similar but issue exists in the server response code but
	appears to be non-exploitable.</p>
	</body>
	</description>
	<references>
	<url>http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt</url>
	</references>
	<dates>
	<discovery>2010-08-21</discovery>
	<entry>2010-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="274922b8-ad20-11df-af1f-00e0814cab4e">
	<topic>phpmyadmin -- Several XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.3.5.1</lt></range>
	</package>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.10.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin Team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php">
	<p>It was possible to conduct a XSS attack using crafted URLs org
	POST parameters on several pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-3056</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php</url>
	</references>
	<dates>
	<discovery>2010-08-09</discovery>
	<entry>2010-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="68c7187a-abd2-11df-9be6-0015587e2cc1">
	<topic>slim -- insecure PATH assignment</topic>
	<affects>
	<package>
	<name>slim</name>
	<range><lt>1.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SLiM assigns logged on users a PATH in which the current
	working directory ("./") is included. This PATH can allow
	unintentional code execution through planted binaries and
	has therefore been fixed SLiM version 1.3.2.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2945</cvename>
	<url>http://seclists.org/oss-sec/2010/q3/198</url>
	</references>
	<dates>
	<discovery>2010-05-12</discovery>
	<entry>2010-08-19</entry>
	<modified>2010-08-20</modified>
	</dates>
	</vuln>

	<vuln vid="34e0316a-aa91-11df-8c2e-001517289bf8">
	<topic>ruby -- UTF-7 encoding XSS vulnerability in WEBrick</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.7.248_3,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.430,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/">
	<p>WEBrick have had a cross-site scripting vulnerability that allows
	an attacker to inject arbitrary script or HTML via a crafted URI.
	This does not affect user agents that strictly implement HTTP/1.1,
	however, some user agents do not.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>40895</bid>
	<cvename>CVE-2010-0541</cvename>
	<url>http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/</url>
	</references>
	<dates>
	<discovery>2010-08-16</discovery>
	<entry>2010-08-17</entry>
	<modified>2010-08-20</modified>
	</dates>
	</vuln>

	<vuln vid="b74a8076-9b1f-11df-9f58-021e8c343e76">
	<topic>isolate -- local root exploit</topic>
	<affects>
	<package>
	<name>isolate</name>
	<range><lt>20100717</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://code.google.com/p/isolate/">
	<p>Isolate currently suffers from some bad security bugs! These
	are local root privilege escalation bugs. Thanks to the helpful
	person who reported them (email Chris if you want credit!).
	We're working to fix them ASAP, but until then, isolate is
	unsafe and you should uninstall it. Sorry!</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/148911</freebsdpr>
	<url>http://code.google.com/p/isolate/</url>
	</references>
	<dates>
	<discovery>2010-07-29</discovery>
	<entry>2010-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="e7d91a3c-a7c9-11df-870c-00242b513d7c">
	<topic>vlc -- invalid id3v2 tags may lead to invalid memory dereferencing</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><gt>0.9.0,3</gt><lt>1.1.2_1,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>VideoLAN project reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa1004.html">
	<p>VLC fails to perform sufficient input validation when trying to
	extract some meta-informations about input media through ID3v2
	tags. In the failure case, VLC attempt dereference an invalid
	memory address, and a crash will ensure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2937</cvename>
	<url>http://www.videolan.org/security/sa1004.html</url>
	</references>
	<dates>
	<discovery>2010-07-29</discovery>
	<entry>2010-08-14</entry>
	</dates>
	</vuln>

	<vuln vid="e19e74a4-a712-11df-b234-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r280</lt></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r82</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-16.html">
	<p>Critical vulnerabilities have been identified in Adobe
	Flash Player version 10.1.53.64 and earlier. These
	vulnerabilities could cause the application to crash and
	could potentially allow an attacker to take control of the
	affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0209</cvename>
	<cvename>CVE-2010-2188</cvename>
	<cvename>CVE-2010-2213</cvename>
	<cvename>CVE-2010-2214</cvename>
	<cvename>CVE-2010-2215</cvename>
	<cvename>CVE-2010-2216</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb10-16.html</url>
	</references>
	<dates>
	<discovery>2010-01-06</discovery>
	<entry>2010-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="71273c4d-a6ec-11df-8a8d-0008743bf21a">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>10.61</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Opera Destkop Team reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1061/">
	<ul>
	<li>Fixed an issue where heap buffer overflow in HTML5 canvas could
	be used to execute arbitrary code, as reported by Kuzzcc.</li>
	<li>Fixed an issue where unexpected changes in tab focus could be
	used to run programs from the Internet, as reported by Jakob Balle
	and Sven Krewitt of Secunia.</li>
	<li>Fixed an issue where news feed preview could subscribe to feeds
	without interaction, as reported by Alexios Fakos.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/search/view/966/</url>
	<url>http://www.opera.com/support/search/view/967/</url>
	<url>http://www.opera.com/support/search/view/968/</url>
	</references>
	<dates>
	<discovery>2010-08-12</discovery>
	<entry>2010-08-13</entry>
	</dates>
	</vuln>

	<vuln vid="c2eac2b5-9a7d-11df-8e32-000f20797ede">
	<topic>firefox -- Dangling pointer crash regression from plugin parameter array fix</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.8,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.8,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2755</cvename>
	<url>https://www.mozilla.org/security/announce/2010/mfsa2010-48.html</url>
	</references>
	<dates>
	<discovery>2010-07-20</discovery>
	<entry>2010-08-09</entry>
	</dates>
	</vuln>

	<vuln vid="26e1c48a-9fa7-11df-81b5-00e0814cab4e">
	<topic>Piwik -- Local File Inclusion Vulnerability</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><gt>0.6</gt><lt>0.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary,
	remote file inclusion using a directory traversal pattern infinite
	a crafted request for a data renderer.</p>
	<blockquote cite="http://secunia.com/advisories/40703">
	<p>A vulnerability has been reported in Piwik, which can before
	exploited by malicious people to disclose potentially
	sensitive information. Input passed to unspecified parameters
	when requesting a data renderer is not properly verified before
	being used to include files. This can be exploited to includes
	arbitrary files from local resources via directory traversal
	attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2786</cvename>
	<url>http://secunia.com/advisories/40703</url>
	</references>
	<dates>
	<discovery>2010-07-28</discovery>
	<entry>2010-08-04</entry>
	</dates>
	</vuln>

	<vuln vid="43024078-9b63-11df-8983-001d60d86f38">
	<topic>libmspack -- infinite loop denial of service</topic>
	<affects>
	<package>
	<name>libmspack</name>
	<range><le>0.0.20060920</le></range>
	</package>
	<package>
	<name>cabextract</name>
	<range><lt>1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a denial of service vulnerability in libmspack. The
	libmspack code is built into cabextract, so it is also
	vulnerable.</p>
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/40719/">
	<p>The vulnerability is caused due to an error when copying data
	from an uncompressed block (block type 0) and can be exploited
	to trigger an infinite loop by tricking an application using the
	library into processing specially crafted MS-ZIP archives.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/40719/</url>
	</references>
	<dates>
	<discovery>2010-07-26</discovery>
	<entry>2010-07-30</entry>
	</dates>
	</vuln>

	<vuln vid="28a7310f-9855-11df-8d36-001aa0166822">
	<topic>apache -- Remote DoS bug in mod_cache and mod_dav</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><ge>2.2.0</ge><lt>2.2.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache ChangeLog reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.16">
	<p>mod_dav, mod_cache: Fix Handling of requests without a path segment.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1452</cvename>
	<url>http://www.apache.org/dist/httpd/CHANGES_2.2.16</url>
	<url>https://issues.apache.org/bugzilla/show_bug.cgi?id=49246</url>
	<url>http://svn.apache.org/viewvc?view=revision&revision=966349</url>
	</references>
	<dates>
	<discovery>2010-07-21</discovery>
	<entry>2010-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="827bc2b7-95ed-11df-9160-00e0815b8da8">
	<topic>git -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>git</name>
	<range><ge>1.5.6</ge><lt>1.7.1.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Greg Brockman reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2010/07/22/1">
	<p>If an attacker were to create a crafted working copy where the
	user runs any git command, the attacker could force execution
	of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2542</cvename>
	<url>http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc</url>
	<url>http://www.openwall.com/lists/oss-security/2010/07/22/1</url>
	</references>
	<dates>
	<discovery>2010-07-20</discovery>
	<entry>2010-07-23</entry>
	</dates>
	</vuln>

	<vuln vid="0502c1cb-8f81-11df-a0bb-0050568452ac">
	<topic>codeigniter -- file upload class vulnerability</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><lt>1.7.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Derek Jones reports:</p>
	<blockquote cite="http://codeigniter.com/news/codeigniter_1.7.2_security_patch/">
	<p>A fix has been implemented for a security flaw in
	CodeIgniter 1.7.2. All applications using the File
	Upload class should install the patch to ensure that
	their application is not subject to a vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://codeigniter.com/news/codeigniter_1.7.2_security_patch/</url>
	<url>http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch</url>
	</references>
	<dates>
	<discovery>2010-07-12</discovery>
	<entry>2010-07-21</entry>
	</dates>
	</vuln>

	<vuln vid="8c2ea875-9499-11df-8e32-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.7,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.11,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.6.7,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.11</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.6</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)</p>
	<p>MFSA 2010-35 DOM attribute cloning remote code execution vulnerability</p>
	<p>MFSA 2010-36 Use-after-free error in NodeIterator</p>
	<p>MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability</p>
	<p>MFSA 2010-38 Arbitrary code execution using SJOW and fast native function</p>
	<p>MFSA 2010-39 nsCSSValue::Array index integer overflow</p>
	<p>MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability</p>
	<p>MFSA 2010-41 Remote code execution using malformed PNG image</p>
	<p>MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts</p>
	<p>MFSA 2010-43 Same-origin bypass using canvas context</p>
	<p>MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish</p>
	<p>MFSA 2010-45 Multiple location bar spoofing vulnerabilities</p>
	<p>MFSA 2010-46 Cross-domain data theft using CSS</p>
	<p>MFSA 2010-47 Cross-origin data leakage from script filename in error messages</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0654</cvename>
	<cvename>CVE-2010-1205</cvename>
	<cvename>CVE-2010-1206</cvename>
	<cvename>CVE-2010-1207</cvename>
	<cvename>CVE-2010-1208</cvename>
	<cvename>CVE-2010-1209</cvename>
	<cvename>CVE-2010-1210</cvename>
	<cvename>CVE-2010-1211</cvename>
	<cvename>CVE-2010-1212</cvename>
	<cvename>CVE-2010-1213</cvename>
	<cvename>CVE-2010-1214</cvename>
	<cvename>CVE-2010-1215</cvename>
	<cvename>CVE-2010-2751</cvename>
	<cvename>CVE-2010-2752</cvename>
	<cvename>CVE-2010-2753</cvename>
	<cvename>CVE-2010-2754</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-34.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-35.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-36.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-37.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-38.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-39.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-40.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-41.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-42.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-43.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-44.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-45.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-46.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-47.html</url>
	</references>
	<dates>
	<discovery>2010-07-20</discovery>
	<entry>2010-07-21</entry>
	</dates>
	</vuln>

	<vuln vid="9a8fecef-92c0-11df-b140-0015f2db7bde">
	<topic>vte -- Classic terminal title set+query attack</topic>
	<affects>
	<package>
	<name>vte</name>
	<range><lt>0.24.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kees Cook reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/512388">
	<p>Janne Snabb discovered that applications using VTE, such as
	gnome-terminal, did not correctly filter window and icon title
	request escape codes. If a user were tricked into viewing
	specially crafted output in their terminal, a remote attacker
	could execute arbitrary commands with user privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2713</cvename>
	<url>http://www.securityfocus.com/archive/1/512388</url>
	</references>
	<dates>
	<discovery>2010-07-15</discovery>
	<entry>2010-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="19419b3b-92bd-11df-b140-0015f2db7bde">
	<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gustavo Noronha reports:</p>
	<blockquote cite="http://blog.kov.eti.br/?p=116">
	<p>Debian's Michael Gilbert has done a great job going through all
	CVEs released about WebKit, and including patches in the Debian
	package. 1.2.3 includes all of the commits from trunk to fix those,
	too.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1386</cvename>
	<cvename>CVE-2010-1392</cvename>
	<cvename>CVE-2010-1405</cvename>
	<cvename>CVE-2010-1407</cvename>
	<cvename>CVE-2010-1416</cvename>
	<cvename>CVE-2010-1417</cvename>
	<cvename>CVE-2010-1418</cvename>
	<cvename>CVE-2010-1421</cvename>
	<cvename>CVE-2010-1422</cvename>
	<cvename>CVE-2010-1501</cvename>
	<cvename>CVE-2010-1664</cvename>
	<cvename>CVE-2010-1665</cvename>
	<cvename>CVE-2010-1758</cvename>
	<cvename>CVE-2010-1759</cvename>
	<cvename>CVE-2010-1760</cvename>
	<cvename>CVE-2010-1761</cvename>
	<cvename>CVE-2010-1762</cvename>
	<cvename>CVE-2010-1767</cvename>
	<cvename>CVE-2010-1770</cvename>
	<cvename>CVE-2010-1771</cvename>
	<cvename>CVE-2010-1772</cvename>
	<cvename>CVE-2010-1773</cvename>
	<cvename>CVE-2010-1774</cvename>
	<cvename>CVE-2010-2264</cvename>
	<url>http://blog.kov.eti.br/?p=116</url>
	</references>
	<dates>
	<discovery>2010-07-16</discovery>
	<entry>2010-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="ba61ce15-8a7b-11df-87ec-0050569b2d21">
	<topic>redmine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>0.9.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Eric Davis reports:</p>
	<blockquote cite="http://www.redmine.org/news/41">
	<p>This security release addresses some security
	vulnerabilities found in the advanced subversion
	integration module (Redmine.pm perl script).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/news/41</url>
	</references>
	<dates>
	<discovery>2010-07-08</discovery>
	<entry>2010-07-10</entry>
	</dates>
	</vuln>

	<vuln vid="25ed4ff8-8940-11df-a339-0026189baca3">
	<topic>bogofilter -- heap underrun on malformed base64 input</topic>
	<affects>
	<package>
	<name>bogofilter</name>
	<range><lt>1.2.1_2</lt></range>
	</package>
	<package>
	<name>bogofilter-sqlite</name>
	<range><lt>1.2.1_1</lt></range>
	</package>
	<package>
	<name>bogofilter-tc</name>
	<range><lt>1.2.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Julius Plenz reports:</p>
	<blockquote cite="http://www.bogofilter.org/pipermail/bogofilter-dev/2010-June/003475.html">
	<p>I found a bug in the base64_decode function which may cause memory
	corruption when the function is executed on a malformed base64
	encoded string.</p>
	<p>If a string starting with an equal-sign is passed to the
	base64_decode function it triggers a memory corruption that
	in some cases makes bogofilter crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2494</cvename>
	<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01</url>
	</references>
	<dates>
	<discovery>2010-06-28</discovery>
	<entry>2010-07-06</entry>
	</dates>
	</vuln>

	<vuln vid="f1331504-8849-11df-89b8-00151735203a">
	<topic>bugzilla -- information disclosure</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><gt>2.17.1</gt><lt>3.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.2.6/">
	<ul>
	<li>Normally, information about time-tracking (estimated
	hours, actual hours, hours worked, and deadlines) is
	restricted to users in the "time-tracking group".
	However, any user was able, by crafting their own
	search URL, to search for bugs based using those
	fields as criteria, thus possibly exposing sensitive
	time-tracking information by a user seeing that a bug
	matched their search.</li>
	<li>If $use_suexec was set to "1" in the localconfig file,
	then the localconfig file's permissions were set as
	world-readable by checksetup.pl. This allowed any user
	with local shell access to see the contents of the file,
	including the database password and the site_wide_secret
	variable used for CSRF protection.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1204</cvename>
	<cvename>CVE-2010-0180</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=309952</url>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=561797</url>
	</references>
	<dates>
	<discovery>2010-06-24</discovery>
	<entry>2010-07-05</entry>
	</dates>
	</vuln>

	<vuln vid="8685d412-8468-11df-8d45-001d7d9eb79a">
	<topic>kvirc -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>kvirc</name>
	<name>kvirc-devel</name>
	<range><lt>4.0.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two security vulnerabilities have been discovered:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2451">
	<p>Multiple format string vulnerabilities in the DCC functionality
	in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2452">
	<p>Directory traversal vulnerability in the DCC functionality
	in KVIrc 3.4 and 4.0 allows remote attackers to overwrite
	arbitrary files via unknown vectors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-2451</cvename>
	<cvename>CVE-2010-2452</cvename>
	<url>http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html</url>
	</references>
	<dates>
	<discovery>2010-05-17</discovery>
	<entry>2010-06-30</entry>
	</dates>
	</vuln>

	<vuln vid="edef3f2f-82cf-11df-bcce-0018f3e2eb82">
	<topic>png -- libpng decompression buffer overflow</topic>
	<affects>
	<package>
	<name>png</name>
	<range>
	<lt>1.4.3</lt>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PNG project describes the problem in an advisory:</p>
	<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
	<p>Several versions of libpng through 1.4.2 (and through 1.2.43
	in the older series) contain a bug whereby progressive
	applications such as web browsers (or the rpng2 demo app included
	in libpng) could receive an extra row of image data beyond the
	height reported in the header, potentially leading to an
	out-of-bounds write to memory (depending on how the application
	is written) and the possibility of execution of an attacker's
	code with the privileges of the libpng user (including remote
	compromise in the case of a libpng-based browser visiting a
	hostile web site).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>41174</bid>
	<cvename>CVE-2010-1205</cvename>
	<url>http://www.libpng.org/pub/png/libpng.html</url>
	</references>
	<dates>
	<discovery>2010-03-30</discovery>
	<entry>2010-06-28</entry>
	<modified>2010-06-28</modified>
	</dates>
	</vuln>

	<vuln vid="66759ce6-7530-11df-9c33-000c29ba66d2">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle</name>
	<range><lt>1.9.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Moodle release notes report multiple vulnerabilities
	which could allow cross site scripting, XSS attacks,
	unauthorised deletion of attempts in some instances.</p>
	</body>
	</description>
	<references>
	<url>http://docs.moodle.org/en/Moodle_1.9.9_release_notes</url>
	</references>
	<dates>
	<discovery>2010-06-08</discovery>
	<entry>2010-06-28</entry>
	</dates>
	</vuln>

	<vuln vid="1cd87e2a-81e3-11df-81d8-00262d5ed8ee">
	<topic>mDNSResponder -- corrupted stack crash when parsing bad resolv.conf</topic>
	<affects>
	<package>
	<name>mDNSResponder</name>
	<range><le>214</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Juli Mallett reports:</p>
	<blockquote>
	<p>mdnsd will crash on some systems with a corrupt stack and once
	that's fixed it will still leak a file descriptor when parsing
	resolv.conf. The crash is because scanf is used with %10s for a
	buffer that is only 10 chars long. The buffer size needs increased
	to 11 chars to hold the trailing NUL. To fix the leak, an fclose
	needs added.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/147007</freebsdpr>
	</references>
	<dates>
	<discovery>2010-05-26</discovery>
	<entry>2010-06-27</entry>
	</dates>
	</vuln>

	<vuln vid="77b9f9bc-7fdf-11df-8a8d-0008743bf21a">
	<topic>opera -- Data URIs can be used to allow cross-site scripting</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>10.11</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><le>10.20_2,1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Opera Desktop Team reports:</p>
	<blockquote cite="http://www.opera.com/support/kb/view/955/">
	<p>Data URIs are allowed to run scripts that manipulate
	pages from the site that directly opened them. In some cases, the opening site
	is not correctly detected. In these cases, Data URIs may erroneously be able to
	run scripts so that they interact with sites that did not directly cause them to
	be opened.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/kb/view/955/</url>
	</references>
	<dates>
	<discovery>2010-06-21</discovery>
	<entry>2010-06-25</entry>
	</dates>
	</vuln>

	<vuln vid="e02e6a4e-6b26-11df-96b2-0015587e2cc1">
	<topic>cacti -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.7f</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities have been reported to exist in older version of
	Cacti. The release notes of Cacti 0.8.7f summarizes the problems as
	follows:</p>
	<blockquote cite="http://www.cacti.net/release_notes_0_8_7f.php">
	<ul>
	<li>SQL injection and shell escaping issues</li>
	<li>Cross-site scripting issues</li>
	<li>Cacti Graph Viewer SQL injection vulnerability</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html</url>
	<url>http://www.cacti.net/release_notes_0_8_7f.php</url>
	<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
	<url>http://www.vupen.com/english/advisories/2010/1204</url>
	</references>
	<dates>
	<discovery>2010-05-24</discovery>
	<entry>2010-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="99858b7c-7ece-11df-a007-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.4,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.10,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.10</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.5</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-33 User tracking across sites using Math.random()</p>
	<p>MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present</p>
	<p>MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes</p>
	<p>MFSA 2010-30 Integer Overflow in XSLT Node Sorting</p>
	<p>MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal</p>
	<p>MFSA 2010-28 Freed object reuse across plugin instances</p>
	<p>MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()</p>
	<p>MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)</p>
	<p>MFSA 2010-25 Re-use of freed object due to scope confusion</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5913</cvename>
	<cvename>CVE-2010-0183</cvename>
	<cvename>CVE-2010-1121</cvename>
	<cvename>CVE-2010-1125</cvename>
	<cvename>CVE-2010-1197</cvename>
	<cvename>CVE-2010-1199</cvename>
	<cvename>CVE-2010-1196</cvename>
	<cvename>CVE-2010-1198</cvename>
	<cvename>CVE-2010-1200</cvename>
	<cvename>CVE-2010-1201</cvename>
	<cvename>CVE-2010-1202</cvename>
	<cvename>CVE-2010-1203</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-33.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-32.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-31.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-30.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-29.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-28.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-27.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-26.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
	</references>
	<dates>
	<discovery>2010-06-22</discovery>
	<entry>2010-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="25673e6e-786b-11df-a921-0245fb008c0b">
	<topic>ziproxy -- security vulnerability in PNG decoder</topic>
	<affects>
	<package>
	<name>ziproxy</name>
	<range><ge>3.1.0</ge></range>
	<range><lt>3.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel Mealha Cabrita reports:</p>
	<blockquote cite="http://ziproxy.sourceforge.net/#news">
	<p>Fixed security vulnerability (heap-related) in PNG decoder.
	(new bug from 3.1.0)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://ziproxy.sourceforge.net/#news</url>
	<mlist msgid="201006150731.30474.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net</mlist>
	</references>
	<dates>
	<discovery>2010-06-15</discovery>
	<entry>2010-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="8816bf3a-7929-11df-bcce-0018f3e2eb82">
	<topic>tiff -- Multiple integer overflows</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><lt>3.9.4</lt></range>
	</package>
	<package>
	<name>linux-tiff</name>
	<name>linux-f10-tiff</name>
	<range><lt>3.9.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tielei Wang:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2009-012.html">
	<p>Multiple integer overflows in inter-color spaces conversion
	tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow
	context-dependent attackers to execute arbitrary code via a
	TIFF image with large (1) width and (2) height values, which
	triggers a heap-based buffer overflow in the (a) cvt_whole_image
	function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2347</cvename>
	<url>http://www.remotesensing.org/libtiff/v3.9.4.html</url>
	<url>http://www.ocert.org/advisories/ocert-2009-012.html</url>
	</references>
	<dates>
	<discovery>2009-05-22</discovery>
	<entry>2010-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="144e524a-77eb-11df-ae06-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r277</lt></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r53</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-14.html">
	<p>Critical vulnerabilities have been identified in Adobe
	Flash Player version 10.0.45.2 and earlier. These
	vulnerabilities could cause the application to crash and
	could potentially allow an attacker to take control of the
	affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4546</cvename>
	<cvename>CVE-2009-3793</cvename>
	<cvename>CVE-2010-1297</cvename>
	<cvename>CVE-2010-2160</cvename>
	<cvename>CVE-2010-2161</cvename>
	<cvename>CVE-2010-2162</cvename>
	<cvename>CVE-2010-2163</cvename>
	<cvename>CVE-2010-2164</cvename>
	<cvename>CVE-2010-2165</cvename>
	<cvename>CVE-2010-2166</cvename>
	<cvename>CVE-2010-2167</cvename>
	<cvename>CVE-2010-2169</cvename>
	<cvename>CVE-2010-2170</cvename>
	<cvename>CVE-2010-2171</cvename>
	<cvename>CVE-2010-2172</cvename>
	<cvename>CVE-2010-2173</cvename>
	<cvename>CVE-2010-2174</cvename>
	<cvename>CVE-2010-2175</cvename>
	<cvename>CVE-2010-2176</cvename>
	<cvename>CVE-2010-2177</cvename>
	<cvename>CVE-2010-2178</cvename>
	<cvename>CVE-2010-2179</cvename>
	<cvename>CVE-2010-2180</cvename>
	<cvename>CVE-2010-2181</cvename>
	<cvename>CVE-2010-2182</cvename>
	<cvename>CVE-2010-2183</cvename>
	<cvename>CVE-2010-2184</cvename>
	<cvename>CVE-2010-2185</cvename>
	<cvename>CVE-2010-2186</cvename>
	<cvename>CVE-2010-2187</cvename>
	<cvename>CVE-2010-2188</cvename>
	<cvename>CVE-2010-2189</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb10-14.html</url>
	</references>
	<dates>
	<discovery>2008-10-02</discovery>
	<entry>2010-06-14</entry>
	</dates>
	</vuln>

	<vuln vid="313da7dc-763b-11df-bcce-0018f3e2eb82">
	<topic>tiff -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>tiff</name>
	<range><lt>3.9.3</lt></range>
	</package>
	<package>
	<name>linux-tiff</name>
	<range><lt>3.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kevin Finisterre reports:</p>
	<blockquote cite="http://support.apple.com/kb/HT4196">
	<p>Multiple integer overflows in the handling of TIFF files may
	result in a heap buffer overflow. Opening a maliciously crafted
	TIFF file may lead to an unexpected application termination or
	arbitrary code execution. The issues are addressed through
	improved bounds checking. Credit to Kevin Finisterre of
	digitalmunition.com for reporting these issues.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1411</cvename>
	<url>http://www.remotesensing.org/libtiff/v3.9.3.html</url>
	<url>http://support.apple.com/kb/HT4196</url>
	</references>
	<dates>
	<discovery>2010-04-15</discovery>
	<entry>2010-06-12</entry>
	</dates>
	</vuln>

	<vuln vid="d42e5b66-6ea0-11df-9c8d-00e0815b8da8">
	<topic>sudo -- Secure path vulnerability</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><lt>1.7.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://sudo.ws/sudo/alerts/secure_path.html">
	<p>Most versions of the C library function getenv() return the
	first instance of an environment variable to the caller. However,
	some programs, notably the GNU Bourne Again SHell (bash), do
	their own environment parsing and may choose the last instance
	of a variable rather than the first one.</p>
	<p>An attacker may manipulate the environment of the process that
	executes Sudo such that a second PATH variable is present. When
	Sudo runs a bash script, it is this second PATH variable that
	is used by bash, regardless of whether or not Sudo has overwritten
	the first instance of PATH. This may allow an attacker to
	subvert the program being run under Sudo and execute commands
	he/she would not otherwise be allowed to run.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1646</cvename>
	<url>http://sudo.ws/sudo/alerts/secure_path.html</url>
	</references>
	<dates>
	<discovery>2010-06-02</discovery>
	<entry>2010-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="b43004b8-6a53-11df-bc7b-0245fb008c0b">
	<topic>ziproxy -- atypical huge picture files vulnerability</topic>
	<affects>
	<package>
	<name>ziproxy</name>
	<range><lt>3.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ziproxy 3.0.1 release fixes a security vulnerability related
	to atypical huge picture files (>4GB of size once expanded).</p>
	</body>
	</description>
	<references>
	<bid>40344</bid>
	<cvename>CVE-2010-1513</cvename>
	<url>http://ziproxy.sourceforge.net/#news</url>
	<url>http://secunia.com/advisories/39941</url>
	<mlist msgid="201005210019.37119.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net</mlist>
	</references>
	<dates>
	<discovery>2010-05-20</discovery>
	<entry>2010-05-28</entry>
	</dates>
	</vuln>

	<vuln vid="fc55e396-6deb-11df-8b8e-000c29ba66d2">
	<topic>mediawiki -- two security vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><lt>1.15.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two security vulnerabilities were discovered:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html">
	<p>Noncompliant CSS parsing behaviour in Internet Explorer
	allows attackers to construct CSS strings which are treated
	as safe by previous versions of MediaWiki, but are decoded
	to unsafe strings by Internet Explorer.</p>
	<p>A CSRF vulnerability was discovered in our login interface.
	Although regular logins are protected as of 1.15.3, it was
	discovered that the account creation and password reset
	reset features were not protected from CSRF. This could lead
	to unauthorised access to private wikis.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/39922/</url>
	<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html</url>
	</references>
	<dates>
	<discovery>2010-05-28</discovery>
	<entry>2010-06-02</entry>
	</dates>
	</vuln>

	<vuln vid="fcc39d22-5777-11df-bf33-001a92771ec2">
	<topic>redmine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>redmine</name>
	<range><lt>0.9.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Redmine release announcement reports that
	several cross side scripting vulnerabilities
	and a potential data disclosure vulnerability have
	been fixed in the latest release.</p>
	</body>
	</description>
	<references>
	<url>http://www.redmine.org/news/39</url>
	</references>
	<dates>
	<discovery>2010-05-01</discovery>
	<entry>2010-05-14</entry>
	</dates>
	</vuln>

	<vuln vid="28022228-5a0e-11df-942d-0015587e2cc1">
	<topic>wireshark -- DOCSIS dissector denial of service</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<range><le>1.2.6_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability found in the DOCSIS dissector can cause
	Wireshark to crash when a malformed packet trace file is
	opened. This means that an attacker will have to trick a
	victim into opening such a trace file before being able
	to crash the application</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1455</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2010-03.html</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2010-04.html</url>
	</references>
	<dates>
	<discovery>2010-05-05</discovery>
	<entry>2010-05-07</entry>
	</dates>
	</vuln>

	<vuln vid="c0869649-5a0c-11df-942d-0015587e2cc1">
	<topic>piwik -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><le>0.5.5</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Piwik security advisory reports:</p>
	<blockquote cite="http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/">
	<p>A non-persistent, cross-site scripting vulnerability
	(XSS) was found in Piwik's Login form that reflected
	the form_url parameter without being properly escaped
	or filtered.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1453</cvename>
	<url>http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/</url>
	</references>
	<dates>
	<discovery>2010-04-15</discovery>
	<entry>2010-05-07</entry>
	</dates>
	</vuln>

	<vuln vid="7132c842-58e2-11df-8d80-0015587e2cc1">
	<topic>spamass-milter -- remote command execution vulnerability</topic>
	<affects>
	<package>
	<name>spamass-milter</name>
	<range><le>0.3.1_8</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The spamassassin milter plugin contains a vulnerability
	that can allow remote attackers to execute commands on
	affected systems.</p>
	<p>The vulnerability can be exploited trough a special-crafted
	email header when the plugin was started with the '-x'
	(expand) flag.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1132</cvename>
	<url>http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html</url>
	<url>http://xforce.iss.net/xforce/xfdb/56732</url>
	</references>
	<dates>
	<discovery>2010-03-07</discovery>
	<entry>2010-05-06</entry>
	</dates>
	</vuln>

	<vuln vid="694da5b4-5877-11df-8d80-0015587e2cc1">
	<topic>mediawiki -- authenticated CSRF vulnerability</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><lt>1.15.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A MediaWiki security announcement reports:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html">
	<p>MediaWiki was found to be vulnerable to login CSRF.
	An attacker who controls a user account on the target
	wiki can force the victim to log in as the attacker,
	via a script on an external website.</p>
	<p>If the wiki is configured to allow user scripts, say
	with "$wgAllowUserJs = true" in LocalSettings.php, then
	the attacker can proceed to mount a phishing-style
	attack against the victim to obtain their password.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1150</cvename>
	<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html</url>
	<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=23076</url>
	</references>
	<dates>
	<discovery>2010-04-07</discovery>
	<entry>2010-05-05</entry>
	</dates>
	</vuln>

	<vuln vid="0491d15a-5875-11df-8d80-0015587e2cc1">
	<topic>lxr -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>lxr</name>
	<range><le>0.9.6</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dan Rosenberg reports:</p>
	<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com">
	<p>There are several cross-site scripting vulnerabilities
	in LXR. These vulnerabilities could allow an attacker
	to execute scripts in a user's browser, steal cookies
	associated with vulnerable domains, redirect the user
	to malicious websites, etc.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4497</cvename>
	<freebsdpr>ports/146337</freebsdpr>
	<url>http://secunia.com/advisories/38117</url>
	<url>http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com</url>
	</references>
	<dates>
	<discovery>2010-01-05</discovery>
	<entry>2010-05-05</entry>
	</dates>
	</vuln>

	<vuln vid="752ce039-5242-11df-9139-00242b513d7c">
	<topic>vlc -- unintended code execution with specially crafted data</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>1.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>VideoLAN project reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa1003.html">
	<p>VLC media player suffers from various vulnerabilities when
	attempting to parse malformatted or overly long byte streams.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>39629</bid>
	<url>http://www.videolan.org/security/sa1003.html</url>
	</references>
	<dates>
	<discovery>2010-04-19</discovery>
	<entry>2010-05-01</entry>
	<modified>2010-05-05</modified>
	</dates>
	</vuln>

	<vuln vid="8d10038e-515c-11df-83fb-0015587e2cc1">
	<topic>joomla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla15</name>
	<range><ge>1.5.1</ge><le>1.5.15</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joomla! reported the following vulnerabilities:</p>
	<blockquote cite="http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html">
	<p>If a user entered a URL with a negative query limit
	or offset, a PHP notice would display revealing information
	about the system..</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html">
	<p>The migration script in the Joomla! installer does not
	check the file type being uploaded. If the installation
	application is present, an attacker could use it to
	upload malicious files to a server.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html">
	<p>Session id doesn't get modified when user logs in. A
	remote site may be able to forward a visitor to the
	Joomla! site and set a specific cookie. If the user
	then logs in, the remote site can use that cookie to
	authenticate as that user.</p>
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html">
	<p>When a user requests a password reset, the reset tokens
	were stored in plain text in the database. While this
	is not a vulnerability in itself, it allows user accounts
	to be compromised if there is an extension on the site
	with an SQL injection vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html</url>
	<url>http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html</url>
	<url>http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html</url>
	<url>http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html</url>
	</references>
	<dates>
	<discovery>2010-04-23</discovery>
	<entry>2010-04-26</entry>
	</dates>
	</vuln>

	<vuln vid="5198ef84-4fdc-11df-83fb-0015587e2cc1">
	<topic>cacti -- SQL injection and command execution vulnerabilities</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><le>0.8.7e4</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Bonsai information security reports:</p>
	<blockquote cite="http://www.bonsai-sec.com/en/research/vulnerability.php">
	<p>A Vulnerability has been discovered in Cacti, which
	can be exploited by any user to conduct SQL Injection
	attacks. Input passed via the "export_item_id" parameter
	to "templates_export.php" script is not properly sanitized
	before being used in a SQL query.</p>
	</blockquote>
	<p>The same source also reported a command execution
	vulnerability. This second issue can be exploited by
	Cacti users who have the rights to modify device or
	graph configurations.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1431</cvename>
	<freebsdpr>ports/146021</freebsdpr>
	<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
	<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php</url>
	<url>http://www.debian.org/security/2010/dsa-2039</url>
	</references>
	<dates>
	<discovery>2010-04-21</discovery>
	<entry>2010-04-24</entry>
	<modified>2013-06-16</modified>
	</dates>
	</vuln>

	<vuln vid="f6429c24-4fc9-11df-83fb-0015587e2cc1">
	<topic>moodle -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moodle</name>
	<range><lt>1.9.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Moodle release notes report multiple vulnerabilities
	which could allow remote attackers to perform, amongst
	others, cross site scripting, user enumeration and SQL
	injection attacks.</p>
	</body>
	</description>
	<references>
	<url>http://docs.moodle.org/en/Moodle_1.9.8_release_notes</url>
	</references>
	<dates>
	<discovery>2010-03-25</discovery>
	<entry>2010-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="3383e706-4fc3-11df-83fb-0015587e2cc1">
	<topic>tomcat -- information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.30</lt></range>
	<range><gt>6.0.0</gt><lt>6.0.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache software foundation reports:</p>
	<blockquote cite="http://seclists.org/bugtraq/2010/Apr/200">
	<p>The "WWW-Authenticate" header for BASIC and DIGEST
	authentication includes a realm name. If a <realm-name>
	element is specified for the application in web.xml it
	will be used. However, a <realm-name> is not
	specified then Tomcat will generate one.</p>
	<p>In some circumstances this can expose the local
	hostname or IP address of the machine running Tomcat.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1157</cvename>
	<freebsdpr>ports/146022</freebsdpr>
	<url>http://seclists.org/bugtraq/2010/Apr/200</url>
	</references>
	<dates>
	<discovery>2010-04-22</discovery>
	<entry>2010-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="f6b6beaa-4e0e-11df-83fb-0015587e2cc1">
	<cancelled/>
	</vuln>

	<vuln vid="86b8b655-4d1a-11df-83fb-0015587e2cc1">
	<topic>krb5 -- KDC double free vulnerability</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MIT Kerberos team reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt">
	<p>An authenticated remote attacker can crash the KDC by
	inducing the KDC to perform a double free. Under some
	circumstances on some platforms, this could also allow
	malicious code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1320</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt</url>
	</references>
	<dates>
	<discovery>2010-04-20</discovery>
	<entry>2010-04-21</entry>
	</dates>
	</vuln>

	<vuln vid="a4746a86-4c89-11df-83fb-0015587e2cc1">
	<topic>e107 -- code execution and XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>e107</name>
	<range><lt>0.7.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reported two vulnerabilities in e107:</p>
	<p>The first problem affects installations that have the
	Content Manager plugin enabled. This plugin does not
	sanitize the "content_heading" parameter correctly and
	is therefore vulnerable to a cross site scripting attack.</p>
	<p>The second vulnerability is related to the avatar upload
	functionality. Images containing PHP code can be uploaded
	and executed.</p>
	</body>
	</description>
	<references>
	<bid>39540</bid>
	<cvename>CVE-2010-0996</cvename>
	<cvename>CVE-2010-0997</cvename>
	<freebsdpr>ports/145885</freebsdpr>
	<url>http://e107.org/comment.php?comment.news.864</url>
	<url>http://secunia.com/secunia_research/2010-43/</url>
	<url>http://secunia.com/secunia_research/2010-44/</url>
	<url>http://xforce.iss.net/xforce/xfdb/57932</url>
	</references>
	<dates>
	<discovery>2010-04-15</discovery>
	<entry>2010-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="09910d76-4c82-11df-83fb-0015587e2cc1">
	<topic>fetchmail -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range>
	<ge>4.6.3</ge>
	<le>6.3.16</le>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fetchmail developer Matthias Andree reported a vulnerability
	that allows remote attackers to crash the application
	when it is runs in verbose mode.</p>
	<blockquote cite="http://gitorious.org/fetchmail/fetchmail/commit/ec06293">
	<p>Fetchmail before release 6.3.17 did not properly
	sanitize external input (mail headers and UID). When a
	multi-character locale (such as UTF-8) was in use, this
	could cause memory exhaustion and thus a denial of
	service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1167</cvename>
	<freebsdpr>ports/145857</freebsdpr>
	<url>http://gitorious.org/fetchmail/fetchmail/commit/ec06293</url>
	<url>http://seclists.org/oss-sec/2010/q2/76</url>
	</references>
	<dates>
	<discovery>2010-04-18</discovery>
	<entry>2010-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="a2c4d3d5-4c7b-11df-83fb-0015587e2cc1">
	<topic>pidgin -- multiple remote denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>pidgin</name>
	<range><lt>2.6.6</lt></range>
	</package>
	<package>
	<name>libpurple</name>
	<range><lt>2.6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Three denial of service vulnerabilities where found in
	pidgin and allow remote attackers to crash the application.
	The developers summarized these problems as follows:</p>
	<blockquote cite="http://pidgin.im/news/security/?id=45">
	<p>Pidgin can become unresponsive when displaying large
	numbers of smileys</p>
	</blockquote>
	<blockquote cite="http://pidgin.im/news/security/?id=44">
	<p>Certain nicknames in group chat rooms can trigger a
	crash in Finch</p>
	</blockquote>
	<blockquote cite="http://pidgin.im/news/security/?id=43">
	<p>Failure to validate all fields of an incoming message
	can trigger a crash</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38294</bid>
	<cvename>CVE-2010-0277</cvename>
	<cvename>CVE-2010-0420</cvename>
	<cvename>CVE-2010-0423</cvename>
	<url>http://pidgin.im/news/security/?id=43</url>
	<url>http://pidgin.im/news/security/?id=44</url>
	<url>http://pidgin.im/news/security/?id=45</url>
	</references>
	<dates>
	<discovery>2010-02-18</discovery>
	<entry>2010-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="4fb5d2cd-4c77-11df-83fb-0015587e2cc1">
	<topic>png -- libpng decompression denial of service</topic>
	<affects>
	<package>
	<name>png</name>
	<range>
	<gt>1.2.43</gt>
	<lt>1.4.1</lt>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability in libpng can result in denial of service
	conditions when a remote attacker tricks a victim to open
	a specially-crafted PNG file.</p>
	<p>The PNG project describes the problem in an advisory:</p>
	<blockquote cite="http://libpng.sourceforge.net/ADVISORY-1.4.1.html">
	<p>Because of the efficient compression method used in
	Portable Network Graphics (PNG) files, a small PNG file
	can expand tremendously, acting as a "decompression
	bomb".</p>
	<p>Malformed PNG chunks can consume a large amount of CPU
	and wall-clock time and large amounts of memory, up to
	all memory available on a system</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38478</bid>
	<certvu>576029</certvu>
	<cvename>CVE-2010-0205</cvename>
	<url>http://libpng.sourceforge.net/ADVISORY-1.4.1.html</url>
	<url>http://secunia.com/advisories/38774</url>
	<url>http://xforce.iss.net/xforce/xfdb/56661</url>
	</references>
	<dates>
	<discovery>2010-02-27</discovery>
	<entry>2010-04-20</entry>
	</dates>
	</vuln>

	<vuln vid="c8c31c41-49ed-11df-83fb-0015587e2cc1">
	<topic>curl -- libcurl buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>curl</name>
	<range>
	<ge>7.10.5</ge>
	<lt>7.20.0</lt>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cURL project reports in a security advisory:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20100209.html">
	<p>Using the affected libcurl version to download compressed
	content over HTTP, an application can ask libcurl to
	automatically uncompress data. When doing so, libcurl
	can wrongly send data up to 64K in size to the callback
	which thus is much larger than the documented maximum
	size.</p>
	<p>An application that blindly trusts libcurl's max limit
	for a fixed buffer size or similar is then a possible
	target for a buffer overflow vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0734</cvename>
	<url>http://curl.haxx.se/docs/adv_20100209.html</url>
	<url>http://www.debian.org/security/2010/dsa-2023</url>
	<url>http://www.openwall.com/lists/oss-security/2010/02/09/5</url>
	</references>
	<dates>
	<discovery>2010-02-09</discovery>
	<entry>2010-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="a04a3c13-4932-11df-83fb-0015587e2cc1">
	<topic>ejabberd -- queue overload denial of service vulnerability</topic>
	<affects>
	<package>
	<name>ejabberd</name>
	<range><lt>2.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Red Hat security response team reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2010/01/29/1">
	<p>A remotely exploitable DoS from XMPP client to ejabberd
	server via too many "client2server" messages (causing the
	message queue on the server to get overloaded, leading
	to server crash) has been found.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38003</bid>
	<cvename>CVE-2010-0305</cvename>
	<url>http://secunia.com/advisories/38337</url>
	<url>http://support.process-one.net/browse/EJAB-1173</url>
	<url>http://www.openwall.com/lists/oss-security/2010/01/29/1</url>
	<url>http://xforce.iss.net/xforce/xfdb/56025</url>
	</references>
	<dates>
	<discovery>2010-01-29</discovery>
	<entry>2010-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="3b7967f1-49e8-11df-83fb-0015587e2cc1">
	<topic>irssi -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>irssi</name>
	<range><lt>0.8.15</lt></range>
	</package>
	<package>
	<name>zh-irssi</name>
	<range><lt>0.8.15</lt></range>
	</package>
	<package>
	<name>irssi-devel</name>
	<range><lt>20100325</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two vulnerabilities have found in irssi. The first issue
	could allow man-in-the-middle attacks due to a missing
	comparison of SSL server hostnames and the certificate
	domain names (e.g. CN).</p>
	<p>A second vulnerability, related to the nick matching code,
	could be triggered by remote attackers in order to crash
	an irssi client when leaving a channel.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1155</cvename>
	<cvename>CVE-2010-1156</cvename>
	<url>http://xforce.iss.net/xforce/xfdb/57790</url>
	<url>http://xforce.iss.net/xforce/xfdb/57791</url>
	</references>
	<dates>
	<discovery>2010-04-16</discovery>
	<entry>2010-04-19</entry>
	</dates>
	</vuln>

	<vuln vid="a30573dc-4893-11df-a5f9-001641aeabdf">
	<topic>krb5 -- remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range><le>1.6.3_9</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An authenticated remote attacker can causing a denial
	of service by using a newer version of the kadmin protocol
	than the server supports.</p>
	<p>The MIT Kerberos team also reports the cause:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt">
	<p>The Kerberos administration daemon (kadmind) can crash
	due to referencing freed memory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>39247</bid>
	<cvename>CVE-2010-0629</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt</url>
	</references>
	<dates>
	<discovery>2010-04-06</discovery>
	<entry>2010-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="9ac0f9c4-492b-11df-83fb-0015587e2cc1">
	<topic>krb5 -- multiple denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>krb5</name>
	<range>
	<ge>1.7</ge><le>1.7_2</le>
	</range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two vulnerabilities in krb5 can be used by remote
	attackers in denial of service attacks. The MIT security
	advisories report this as follows:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt">
	<p>An unauthenticated remote attacker can send an invalid
	request to a KDC process that will cause it to crash
	due to an assertion failure, creating a denial of
	service.</p>
	</blockquote>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt">
	<p>An unauthenticated remote attacker could cause a GSS-API
	application, including the Kerberos administration
	daemon (kadmind) to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38260</bid>
	<bid>38904</bid>
	<cvename>CVE-2010-0283</cvename>
	<cvename>CVE-2010-0628</cvename>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt</url>
	<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt</url>
	</references>
	<dates>
	<discovery>2010-02-16</discovery>
	<entry>2010-04-19</entry>
	<modified>2013-06-16</modified>
	</dates>
	</vuln>

	<vuln vid="5053420c-4935-11df-83fb-0015587e2cc1">
	<topic>mahara -- sql injection vulnerability</topic>
	<affects>
	<package>
	<name>mahara</name>
	<range><lt>1.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Debian security team reports:</p>
	<blockquote cite="http://www.debian.org/security/2010/dsa-2030">
	<p>It was discovered that mahara, an electronic portfolio,
	weblog, and resume builder is not properly escaping input
	when generating a unique username based on a remote user
	name from a single sign-on application. An attacker can
	use this to compromise the mahara database via crafted
	user names.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>39253</bid>
	<cvename>CVE-2010-0400</cvename>
	<url>http://www.debian.org/security/2010/dsa-2030</url>
	</references>
	<dates>
	<discovery>2010-04-06</discovery>
	<entry>2010-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="1a9f678d-48ca-11df-85f8-000c29a67389">
	<topic>sudo -- Privilege escalation with sudoedit</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><lt>1.7.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="">
	<p>Sudo's command matching routine expects actual commands to include
	one or more slash ('/') characters. The flaw is that sudo's path
	resolution code did not add a "./" prefix to commands found in the
	current working directory. This creates an ambiguity between a
	"sudoedit" command found in the cwd and the "sudoedit"
	pseudo-command in the sudoers file. As a result, a user may be
	able to run an arbitrary command named "sudoedit" in the current
	working directory. For the attack to be successful, the PATH
	environment variable must include "." and may not include any other
	directory that contains a "sudoedit" command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1163</cvename>
	<url>http://www.sudo.ws/pipermail/sudo-announce/2010-April/000093.html</url>
	<url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html</url>
	</references>
	<dates>
	<discovery>2010-04-09</discovery>
	<entry>2010-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="3987c5d1-47a9-11df-a0d5-0016d32f24fb">
	<topic>KDM -- local privilege escalation vulnerability</topic>
	<affects>
	<package>
	<name>kdebase</name>
	<range><le>3.5.10_6</le></range>
	</package>
	<package>
	<name>kdebase-workspace</name>
	<range><le>4.3.5_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20100413-1.txt">
	<p>KDM contains a race condition that allows local attackers
	to make arbitrary files on the system world-writeable.
	This can happen while KDM tries to create its control
	socket during user login. A local attacker with a valid
	local account can under certain circumstances make use of
	this vulnerability to execute arbitrary code as root.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0436</cvename>
	<url>http://www.kde.org/info/security/advisory-20100413-1.txt</url>
	</references>
	<dates>
	<discovery>2010-04-13</discovery>
	<entry>2010-04-14</entry>
	<modified>2010-04-14</modified>
	</dates>
	</vuln>

	<vuln vid="805603a1-3e7a-11df-a5a1-0050568452ac">
	<topic>dojo -- cross-site scripting and other vulnerabilities</topic>
	<affects>
	<package>
	<name>dojo</name>
	<range><lt>1.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Dojo Toolkit team reports:</p>
	<blockquote cite="http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/">
	<p>Some PHP files did not properly escape input.</p>
	<p>Some files could operate like "open redirects". A bad actor
	could form an URL that looks like it came from a trusted
	site, but the user would be redirected or load content from
	the bad actor's site.</p>
	<p>A file exposed a more serious cross-site scripting
	vulnerability with the possibility of executing code on the
	domain where the file exists.</p>
	<p>The Dojo build process defaulted to copying over tests and
	demos, which are normally not needed and just increased the
	number of files that could be targets of attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
	<url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
	<url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
	<url>http://secunia.com/advisories/38964</url>
	<url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
	</references>
	<dates>
	<discovery>2010-03-11</discovery>
	<entry>2010-04-06</entry>
	</dates>
	</vuln>

	<vuln vid="8ad1c404-3e78-11df-a5a1-0050568452ac">
	<topic>Zend Framework -- security issues in bundled Dojo library</topic>
	<affects>
	<package>
	<name>ZendFramework</name>
	<range><lt>1.10.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Zend Framework team reports:</p>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-07">
	<p>Several files in the bundled Dojo library were identified
	as having potential exploits, and the Dojo team also advised
	disabling or removing any PHP scripts in the Dojo library tree
	when deploying to production.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
	<url>http://framework.zend.com/security/advisory/ZF2010-07</url>
	<url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
	<url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
	<url>http://secunia.com/advisories/38964</url>
	<url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
	</references>
	<dates>
	<discovery>2010-04-01</discovery>
	<entry>2010-04-06</entry>
	</dates>
	</vuln>

	<vuln vid="ec8f449f-40ed-11df-9edc-000f20797ede">
	<topic>firefox -- Re-use of freed object due to scope confusion</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6,1</gt><lt>3.6.3,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2009-25 Re-use of freed object due to scope confusion</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1121</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
	</references>
	<dates>
	<discovery>2010-04-01</discovery>
	<entry>2010-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="9ccfee39-3c3b-11df-9edc-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0</gt><lt>2.0.4</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.4</lt></range>
	</package>
	<package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.9,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.19,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.0.19,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.9</lt></range>
	</package>
	<package>
	<name>nss</name>
	<name>linux-f10-nss</name>
	<range><lt>3.12.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy</p>
	<p>MFSA 2010-23 Image src redirect to mailto: URL opens email editor</p>
	<p>MFSA 2010-22 Update NSS to support TLS renegotiation indication</p>
	<p>MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy</p>
	<p>MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop</p>
	<p>MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray</p>
	<p>MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView</p>
	<p>MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection</p>
	<p>MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0181</cvename>
	<cvename>CVE-2009-3555</cvename>
	<cvename>CVE-2010-0179</cvename>
	<cvename>CVE-2010-0178</cvename>
	<cvename>CVE-2010-0177</cvename>
	<cvename>CVE-2010-0176</cvename>
	<cvename>CVE-2010-0175</cvename>
	<cvename>CVE-2010-0174</cvename>
	<cvename>CVE-2010-0173</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-24.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-23.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-22.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-21.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-20.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-19.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-18.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-17.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-16.html</url>
	</references>
	<dates>
	<discovery>2010-03-30</discovery>
	<entry>2010-03-30</entry>
	</dates>
	</vuln>

	<vuln vid="e050119b-3856-11df-b2b2-002170daae37">
	<topic>postgresql -- bitsubstr overflow</topic>
	<affects>
	<package>
	<name>postgresql-server</name>
	<range><ge>7.4</ge><lt>7.4.28</lt></range>
	<range><ge>8.0</ge><lt>8.0.24</lt></range>
	<range><ge>8.1</ge><lt>8.1.20</lt></range>
	<range><ge>8.2</ge><lt>8.2.16</lt></range>
	<range><ge>8.3</ge><lt>8.3.10</lt></range>
	<range><ge>8.4</ge><lt>8.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BugTraq reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/37973">
	<p>PostgreSQL is prone to a buffer-overflow
	vulnerability because the application fails to
	perform adequate boundary checks on user-supplied
	data.</p>
	<p>Attackers can exploit this issue to execute
	arbitrary code with elevated privileges or
	crash the affected application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>37973</bid>
	<cvename>CVE-2010-0442</cvename>
	</references>
	<dates>
	<discovery>2010-01-27</discovery>
	<entry>2010-03-25</entry>
	</dates>
	</vuln>

	<vuln vid="c175d72f-3773-11df-8bb8-0211d880e350">
	<topic>gtar -- buffer overflow in rmt client</topic>
	<affects>
	<package>
	<name>gtar</name>
	<range><lt>1.22_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakob Lell reports:</p>
	<blockquote cite="http://www.agrs.tu-berlin.de/index.php?id=78327">
	<p>The rmt client implementation of GNU Tar/Cpio contains
	a heap-based buffer overflow which possibly allows
	arbitrary code execution.</p>
	<p>The problem can be exploited when using an
	untrusted/compromised rmt server.</p>
	</blockquote>
	</body>
	</description> <references>
	<cvename>CVE-2010-0624</cvename>
	<url>http://www.agrs.tu-berlin.de/index.php?id=78327</url>
	</references> <dates>
	<discovery>2010-03-24</discovery> <entry>2010-03-24</entry>
	</dates>
	</vuln>

	<vuln vid="5d5ed535-3653-11df-9edc-000f20797ede">
	<topic>firefox -- WOFF heap corruption due to integer overflow</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.6,1</gt><lt>3.6.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-08 WOFF heap corruption due to integer overflow</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-1028</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-08.html</url>
	</references>
	<dates>
	<discovery>2010-03-22</discovery>
	<entry>2010-03-23</entry>
	</dates>
	</vuln>

	<vuln vid="56cfe192-329f-11df-abb2-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.19</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch</p>
	<p>MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail</p>
	<p>MFSA 2009-68 NTLM reflection vulnerability</p>
	<p>MFSA 2009-62 Download filename spoofing with RTL override</p>
	<p>MFSA 2009-59 Heap buffer overflow in string to number conversion</p>
	<p>MFSA 2009-49 TreeColumns dangling pointer vulnerability</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0161</cvename>
	<cvename>CVE-2010-0163</cvename>
	<cvename>CVE-2009-3075</cvename>
	<cvename>CVE-2009-3072</cvename>
	<cvename>CVE-2009-2463</cvename>
	<cvename>CVE-2009-3385</cvename>
	<cvename>CVE-2009-3983</cvename>
	<cvename>CVE-2009-3376</cvename>
	<cvename>CVE-2009-0689</cvename>
	<cvename>CVE-2009-3077</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-07.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-06.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
	</references>
	<dates>
	<discovery>2010-03-16</discovery>
	<entry>2010-03-19</entry>
	</dates>
	</vuln>

	<vuln vid="e39caf05-2d6f-11df-aec2-000c29ba66d2">
	<topic>egroupware -- two vulnerabilities</topic>
	<affects>
	<package>
	<name>egroupware</name>
	<range><lt>1.6.003</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Egroupware Team report:</p>
	<blockquote cite="http://www.egroupware.org/Home?category_id=95&item=93">
	<p>Nahuel Grisolia from CYBSEC S.A. Security Systems found two security
	problems in EGroupware:</p>
	<p>Serious remote command execution (allowing to run arbitrary command
	on the web server by simply issuing a HTTP request!).</p>
	<p>A reflected cross-site scripting (XSS).</p>
	<p>Both require NO valid EGroupware account and work without being logged
	in!</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38609</bid>
	<url>http://secunia.com/advisories/38859/</url>
	<url>http://www.egroupware.org/Home?category_id=95&item=93</url>
	</references>
	<dates>
	<discovery>2010-03-09</discovery>
	<entry>2010-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="b3531fe1-2b03-11df-b6db-00248c9b4be7">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.22</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/node/731710">
	<p>A user-supplied value is directly output during installation
	allowing a malicious user to craft a URL and perform a cross-site
	scripting attack. The exploit can only be conducted on sites not yet
	installed.</p>
	<p>The API function drupal_goto() is susceptible to a phishing attack.
	An attacker could formulate a redirect in a way that gets the Drupal
	site to send the user to an arbitrarily provided URL. No user
	submitted data will be sent to that URL.</p>
	<p>Locale module and dependent contributed modules do not sanitize the
	display of language codes, native and English language names properly.
	While these usually come from a preselected list, arbitrary
	administrator input is allowed. This vulnerability is mitigated by the
	fact that the attacker must have a role with the 'administer
	languages' permission.</p>
	<p>Under certain circumstances, a user with an open session that is
	blocked can maintain his/her session on the Drupal site, despite being
	blocked.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/731710</url>
	</references>
	<dates>
	<discovery>2010-03-03</discovery>
	<entry>2010-03-08</entry>
	</dates>
	</vuln>

	<vuln vid="018a84d0-2548-11df-b4a3-00e0815b8da8">
	<topic>sudo -- Privilege escalation with sudoedit</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><lt>1.7.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="">
	<p>When sudo performs its command matching, there is a special case
	for pseudo-commands in the sudoers file (currently, the only
	pseudo-command is sudoedit). Unlike a regular command,
	pseudo-commands do not begin with a slash ('/'). The flaw is that
	sudo's the matching code would only check against the list of
	pseudo-commands if the user-specified command also contained no
	slashes. As a result, if the user ran "sudo ./sudoedit" the normal
	matching code path was followed, which uses stat(2) to verify that
	the user-specified command matches the one in sudoers. In this
	case, it would compare the "./sudoedit" specified by the user with
	"sudoedit" from the sudoers file, resulting in a positive
	match.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.sudo.ws/pipermail/sudo-announce/2010-February/000092.html</url>
	<url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate.html</url>
	<url>http://secunia.com/advisories/38659</url>
	<cvename>CVE-2010-0426</cvename>
	<bid>38362</bid>
	</references>
	<dates>
	<discovery>2010-01-29</discovery>
	<entry>2010-03-01</entry>
	</dates>
	</vuln>

	<vuln vid="c97d7a37-2233-11df-96dd-001b2134ef46">
	<topic>openoffice.org -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openoffice.org</name>
	<range><lt>3.2.0</lt></range>
	<range><ge>3.2.20010101</ge><lt>3.2.20100203</lt></range>
	<range><ge>3.3.20010101</ge><lt>3.3.20100207</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OpenOffice.org Security Team reports:</p>
	<blockquote cite="http://www.openoffice.org/security/bulletin.html">
	<p>Fixed in OpenOffice.org 3.2</p>
	<p>CVE-2006-4339: Potential vulnerability from 3rd party
	libxml2 libraries</p>
	<p>CVE-2009-0217: Potential vulnerability from 3rd party
	libxmlsec libraries</p>
	<p>CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable
	version of MSVC Runtime</p>
	<p>CVE-2009-2949: Potential vulnerability related to XPM file
	processing</p>
	<p>CVE-2009-2950: Potential vulnerability related to GIF file
	processing</p>
	<p>CVE-2009-3301/2: Potential vulnerability related to MS-Word
	document processing</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.openoffice.org/security/bulletin.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2006-4339.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2009-0217.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2009-2493.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2009-2949.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2009-2950.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html</url>
	<cvename>CVE-2006-4339</cvename>
	<cvename>CVE-2009-0217</cvename>
	<cvename>CVE-2009-2493</cvename>
	<cvename>CVE-2009-2949</cvename>
	<cvename>CVE-2009-2950</cvename>
	<cvename>CVE-2009-3301</cvename>
	<cvename>CVE-2009-3302</cvename>
	</references>
	<dates>
	<discovery>2006-08-24</discovery>
	<entry>2010-02-25</entry>
	<modified>2010-02-27</modified>
	</dates>
	</vuln>

	<vuln vid="f82c85d8-1c6e-11df-abb2-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.8,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.18,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.0.18,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.8</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.3</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2010-05 XSS hazard using SVG document and binary Content-Type</p>
	<p>MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain</p>
	<p>MFSA 2010-03 Use-after-free crash in HTML parser</p>
	<p>MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability</p>
	<p>MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0159</cvename>
	<cvename>CVE-2010-0160</cvename>
	<cvename>CVE-2009-1571</cvename>
	<cvename>CVE-2009-3988</cvename>
	<cvename>CVE-2010-0162</cvename>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-01.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-02.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-03.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-04.html</url>
	<url>http://www.mozilla.org/security/announce/2010/mfsa2010-05.html</url>
	</references>
	<dates>
	<discovery>2010-02-17</discovery>
	<entry>2010-02-18</entry>
	<modified>2010-02-28</modified>
	</dates>
	</vuln>

	<vuln vid="1a3bd81f-1b25-11df-bd1a-002170daae37">
	<topic>lighttpd -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Lighttpd security advisory reports:</p>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt">
	<p>If you send the request data very slow (e.g. sleep
	0.01 after each byte), lighttpd will easily use all
	available memory and die (especially for parallel
	requests), allowing a DoS within minutes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38036</bid>
	<cvename>CVE-2010-0295</cvename>
	<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt</url>
	</references>
	<dates>
	<discovery>2010-02-02</discovery>
	<entry>2010-02-16</entry>
	</dates>
	</vuln>

	<vuln vid="81d9dc0c-1988-11df-8e66-0019996bc1f7">
	<topic>squid -- Denial of Service vulnerability in HTCP</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>2.7.1</ge><lt>2.7.7_4</lt></range>
	<range><ge>3.0.1</ge><lt>3.0.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2010:2 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_2.txt">
	<p>Due to incorrect processing Squid is vulnerable to a
	denial of service attack when receiving specially crafted
	HTCP packets.</p>
	<p>This problem allows any machine to perform a denial
	of service attack on the Squid service when its HTCP port
	is open.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0639</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2010_2.txt</url>
	</references>
	<dates>
	<discovery>2010-02-12</discovery>
	<entry>2010-02-14</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="ff6519ad-18e5-11df-9bdd-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r262</lt></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.0r45</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-06.html">
	<p>A critical vulnerability has been identified in Adobe
	Flash Player version 10.0.42.34 and earlier. This
	vulnerability (CVE-2010-0186) could subvert the domain sandbox
	and make unauthorized cross-domain requests. This update also
	resolves a potential Denial of Service issue (CVE-2010-0187).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0186</cvename>
	<cvename>CVE-2010-0187</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb10-06.html</url>
	</references>
	<dates>
	<discovery>2010-02-11</discovery>
	<entry>2010-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="0a82ac0c-1886-11df-b0d1-0015f2db7bde">
	<topic>gnome-screensaver -- Multiple monitor hotplug issues</topic>
	<affects>
	<package>
	<name>gnome-screensaver</name>
	<range><lt>2.28.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ray Strode reports:</p>
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609337">
	<p>Under certain circumstances it is possible to circumvent the security of screen
	locking functionality of gnome-screensaver by changing the systems physical
	monitor configuration.</p>
	</blockquote>
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609789">
	<p>gnome-screensaver can lose its keyboard grab when locked, exposing the system
	to intrusion by adding and removing monitors.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0414</cvename>
	<cvename>CVE-2010-0422</cvename>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=609337</url>
	<url>https://bugzilla.gnome.org/show_bug.cgi?id=609789</url>
	</references>
	<dates>
	<discovery>2010-02-08</discovery>
	<entry>2010-02-13</entry>
	</dates>
	</vuln>

	<vuln vid="2a6a966f-1774-11df-b5c1-0026189baca3">
	<topic>fetchmail -- heap overflow on verbose X.509 display</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><ge>6.3.11</ge><lt>6.3.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2010-01.txt">
	<p>In verbose mode, fetchmail prints X.509 certificate subject and
	issuer information to the user, and counts and allocates a malloc()
	buffer for that purpose.</p>
	<p>If the material to be displayed contains characters with high bit
	set and the platform treats the "char" type as signed, this can cause
	a heap buffer overrun because non-printing characters are escaped as
	\xFF..FFnn, where nn is 80..FF in hex.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>38088</bid>
	<cvename>CVE-2010-0562</cvename>
	<url>http://www.fetchmail.info/fetchmail-SA-2010-01.txt</url>
	<mlist msgid="20100205014643.GA25506@merlin.emma.line.org">https://lists.berlios.de/pipermail/fetchmail-announce/2010-February/000073.html</mlist>
	</references>
	<dates>
	<discovery>2010-02-04</discovery>
	<entry>2010-02-12</entry>
	</dates>
	</vuln>

	<vuln vid="bb0a8795-15dc-11df-bf0a-002170daae37">
	<topic>wireshark -- LWRES vulnerability</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark project reports:</p>
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2010-02.html">
	<p>Babi discovered several buffer overflows in the
	LWRES dissector.</p>
	<p>It may be possible to make Wireshark crash remotely
	or by convincing someone to read a malformed packet
	trace file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0304</cvename>
	<url>http://secunia.com/advisories/38257/</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2010-02.html</url>
	</references>
	<dates>
	<discovery>2010-01-27</discovery>
	<entry>2010-02-10</entry>
	</dates>
	</vuln>

	<vuln vid="6b575419-14cf-11df-a628-001517351c22">
	<topic>otrs -- SQL injection</topic>
	<affects>
	<package>
	<name>otrs</name>
	<range><lt>2.4.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>OTRS Security Advisory reports:</p>
	<blockquote cite="http://otrs.org/advisory/OSA-2010-01-en/">
	<p>Missing security quoting for SQL statements allows agents and
	customers to manipulate SQL queries. So it's possible for
	authenticated users to inject SQL queries
	via string manipulation of statements.</p>
	<p>A malicious user may be able to manipulate SQL queries to read
	or modify records in the database. This way it could also be
	possible to get access to more permissions (e. g. administrator
	permissions).</p>
	<p>To use this vulnerability the malicious user needs to have
	a valid Agent- or Customer-session.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0438</cvename>
	<url>http://otrs.org/advisory/OSA-2010-01-en/</url>
	</references>
	<dates>
	<discovery>2010-02-08</discovery>
	<entry>2010-02-08</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="cae01d7b-110d-11df-955a-00219b0fc4d8">
	<topic>apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long)</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><lt>1.3.42</lt></range>
	</package>
	<package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.42</lt></range>
	</package>
	<package>
	<name>apache+ipv6</name>
	<range><lt>1.3.42</lt></range>
	</package>
	<package>
	<name>apache_fp</name>
	<range><ge>0</ge></range>
	</package>
	<package>
	<name>ru-apache</name>
	<range><lt>1.3.42+30.23</lt></range>
	</package>
	<package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.42</lt></range>
	</package>
	<package>
	<name>apache+ssl</name>
	<range><lt>1.3.42.1.57_2</lt></range>
	</package>
	<package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><lt>1.3.41+2.8.27_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache ChangeLog reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_1.3.42">
	<p>Integer overflow in the ap_proxy_send_fb function in
	proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before
	1.3.42 on 64-bit platforms allows remote origin servers to cause a
	denial of service (daemon crash) or possibly execute arbitrary code
	via a large chunk size that triggers a heap-based buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0010</url>
	<url>http://www.security-database.com/detail.php?alert=CVE-2010-0010</url>
	<url>http://security-tracker.debian.org/tracker/CVE-2010-0010</url>
	<url>http://www.vupen.com/english/Reference-CVE-2010-0010.php</url>
	</references>
	<dates>
	<discovery>2009-06-30</discovery>
	<entry>2010-02-03</entry>
	<modified>2010-02-03</modified>
	</dates>
	</vuln>

	<vuln vid="296ecb59-0f6b-11df-8bab-0019996bc1f7">
	<topic>squid -- Denial of Service vulnerability in DNS handling</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>2.7.1</ge><lt>2.7.7_3</lt></range>
	<range><ge>3.0.1</ge><lt>3.0.23</lt></range>
	<range><ge>3.1.0.1</ge><lt>3.1.0.15_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2010:1 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_1.txt">
	<p>Due to incorrect data validation Squid is vulnerable to a denial
	of service attack when processing specially crafted DNS packets.</p>
	<p>This problem allows any trusted client or external server who can
	determine the squid receiving port to perform a short-term denial
	of service attack on the Squid service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0308</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2010_1.txt</url>
	</references>
	<dates>
	<discovery>2010-01-14</discovery>
	<entry>2010-02-01</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="696053c6-0f50-11df-a628-001517351c22">
	<topic>bugzilla -- information leak</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><gt>3.3.1</gt><lt>3.4.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.0.10/">
	<p>When moving a bug from one product to another, an intermediate
	page is displayed letting you select the groups the bug should
	be restricted to in the new product. However, a regression in
	the 3.4.x series made it ignore all groups which are not
	available in both products. As a workaround, you had to move
	the bug to the new product first and then restrict it to the
	desired groups, in two distinct steps, which could make the bug
	temporarily public.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3387</cvename>
	<url>http://www.bugzilla.org/security/3.0.10/</url>
	</references>
	<dates>
	<discovery>2010-01-31</discovery>
	<entry>2010-02-01</entry>
	</dates>
	</vuln>

	<vuln vid="192609c8-0c51-11df-82a0-00248c9b4be7">
	<topic>irc-ratbox -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ircd-ratbox</name>
	<range><lt>2.2.9</lt></range>
	</package>
	<package>
	<name>ircd-ratbox-devel</name>
	<range><lt>3.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/509201">
	<p>The first affects the /quote HELP module and allows a user
	to trigger an IRCD crash on some platforms.</p>
	<p>The second affects the /links processing module when the
	flatten_links configuration option is not enabled.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4016</cvename>
	<cvename>CVE-2010-0300</cvename>
	<url>http://www.debian.org/security/2010/dsa-1980</url>
	<url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000890.html</url>
	<url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html</url>
	</references>
	<dates>
	<discovery>2010-01-25</discovery>
	<entry>2010-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="848539dc-0458-11df-8dd7-002170daae37">
	<topic>dokuwiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20091225_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dokuwiki reports:</p>
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1853">
	<p>The plugin does no checks against cross-site request
	forgeries (CSRF) which can be exploited to e.g. change
	the access control rules by tricking a logged in
	administrator into visiting a malicious web site.</p>
	</blockquote>
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1847">
	<p>The bug allows listing the names of arbitrary file on
	the webserver - not their contents. This could leak
	private information about wiki pages and server structure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2010-0288</cvename>
	<cvename>CVE-2010-0287</cvename>
	<cvename>CVE-2010-0289</cvename>
	<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1847</url>
	<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1853</url>
	</references>
	<dates>
	<discovery>2010-01-17</discovery>
	<entry>2010-01-18</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="c9263916-006f-11df-94cb-0050568452ac">
	<topic>Zend Framework -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ZendFramework</name>
	<range><lt>1.9.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Zend Framework team reports:</p>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-06">
	<p>Potential XSS or HTML Injection vector in Zend_Json.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-05">
	<p>Potential XSS vector in Zend_Service_ReCaptcha_MailHide.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-04">
	<p>Potential MIME-type Injection in Zend_File_Transfer
	Executive Summary.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-03">
	<p>Potential XSS vector in Zend_Filter_StripTags when
	comments allowed.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-02">
	<p>Potential XSS vector in Zend_Dojo_View_Helper_Editor.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-01">
	<p>Potential XSS vectors due to inconsistent encodings.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-02">
	<p>XSS vector in Zend_Filter_StripTags.</p>
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-01">
	<p>LFI vector in Zend_View::setScriptPath() and render().</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://framework.zend.com/security/advisory/ZF2010-06</url>
	<url>http://framework.zend.com/security/advisory/ZF2010-05</url>
	<url>http://framework.zend.com/security/advisory/ZF2010-04</url>
	<url>http://framework.zend.com/security/advisory/ZF2010-03</url>
	<url>http://framework.zend.com/security/advisory/ZF2010-02</url>
	<url>http://framework.zend.com/security/advisory/ZF2010-01</url>
	<url>http://framework.zend.com/security/advisory/ZF2009-02</url>
	<url>http://framework.zend.com/security/advisory/ZF2009-01</url>
	</references>
	<dates>
	<discovery>2009-12-31</discovery>
	<entry>2010-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="dd8f2394-fd08-11de-b425-00215c6a37bb">
	<topic>powerdns-recursor -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>3.1.7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS Security Advisory reports:</p>
	<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-01.html">
	<p>PowerDNS Recursor up to and including 3.1.7.1 can be
	brought down and probably exploited.</p>
	</blockquote>
	<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-02.html">
	<p>PowerDNS Recursor up to and including 3.1.7.1 can be
	spoofed into accepting bogus data</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>37650</bid>
	<bid>37653</bid>
	<cvename>CVE-2009-4010</cvename>
	<cvename>CVE-2009-4009</cvename>
	</references>
	<dates>
	<discovery>2010-01-06</discovery>
	<entry>2010-01-09</entry>
	</dates>
	</vuln>

	<vuln vid="56ba8728-f987-11de-b28d-00215c6a37bb">
	<topic>PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection</topic>
	<affects>
	<package>
	<name>pear-Net_Ping</name>
	<range><lt>2.4.5</lt></range>
	</package>
	<package>
	<name>pear-Net_Traceroute</name>
	<range><lt>0.21.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PEAR Security Advisory reports:</p>
	<blockquote cite="http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/">
	<p>Multiple remote arbitrary command injections have been
	found in the Net_Ping and Net_Traceroute.</p>
	<p>When input from forms are used directly, the attacker
	could pass variables that would allow him to execute
	remote arbitrary command injections.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>37093</bid>
	<bid>37094</bid>
	<cvename>CVE-2009-4024</cvename>
	<cvename>CVE-2009-4025</cvename>
	<url>http://pear.php.net/advisory20091114-01.txt</url>
	</references>
	<dates>
	<discovery>2009-11-14</discovery>
	<entry>2010-01-04</entry>
	</dates>
	</vuln>

	<vuln vid="751823d4-f189-11de-9344-00248c9b4be7">
	<topic>drupal -- multiple cross-site scripting</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.21</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/node/661586">
	<p>The Contact module does not correctly handle certain user input
	when displaying category information. Users privileged to create
	contact categories can insert arbitrary HTML and script code into the
	contact module administration page. Such a cross-site scripting attack
	may lead to the malicious user gaining administrative access.</p>
	<p>The Menu module does not correctly handle certain user input when
	displaying the menu administration overview. Users privileged to
	create new menus can insert arbitrary HTML and script code into the
	menu module administration page. Such a cross-site scripting attack
	may lead to the malicious user gaining administrative access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4370</cvename>
	<url>http://drupal.org/node/661586</url>
	</references>
	<dates>
	<discovery>2009-12-16</discovery>
	<entry>2009-12-25</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="4d6076fe-ee7a-11de-9cd0-001a926c7637">
	<topic>fuser -- missing user's privileges check</topic>
	<affects>
	<package>
	<name>fuser</name>
	<range><lt>1142334561_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Denis Barov reports:</p>
	<blockquote>
	<p>sysutils/fuser allows user to send any signal to any process when
	installed with suid bit.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<freebsdpr>ports/141852</freebsdpr>
	</references>
	<dates>
	<discovery>2009-09-15</discovery>
	<entry>2009-12-21</entry>
	</dates>
	</vuln>

	<vuln vid="4465c897-ee5c-11de-b6ef-00215c6a37bb">
	<topic>monkey -- improper input validation vulnerability</topic>
	<affects>
	<package>
	<name>monkey</name>
	<range><lt>0.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Census Labs reports:</p>
	<blockquote cite="http://census-labs.com/news/2009/12/14/monkey-httpd/">
	<p>We have discovered a remotely exploitable
	"improper input validation" vulnerability in the Monkey
	web server that allows an attacker to perform denial of
	service attacks by repeatedly crashing worker threads
	that process HTTP requests.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://census-labs.com/news/2009/12/14/monkey-httpd/</url>
	<url>http://groups.google.com/group/monkeyd/browse_thread/thread/055b4e9b83973861/</url>
	</references>
	<dates>
	<discovery>2009-12-14</discovery>
	<entry>2009-12-21</entry>
	</dates>
	</vuln>

	<vuln vid="39a25a63-eb5c-11de-b650-00215c6a37bb">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP developers reports:</p>
	<blockquote cite="http://www.php.net/releases/5_2_12.php">
	<p>This release focuses on improving the stability of the
	PHP 5.2.x branch with over 60 bug fixes, some of which
	are security related. All users of PHP 5.2 are encouraged
	to upgrade to this release.</p>
	<p>Security Enhancements and Fixes in PHP 5.2.12:</p>
	<ul>
	<li>Fixed a safe_mode bypass in tempnam() identified by
	Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)</li>
	<li>Fixed a open_basedir bypass in posix_mkfifo()
	identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)</li>
	<li>Added "max_file_uploads" INI directive, which can
	be set to limit the number of file uploads per-request
	to 20 by default, to prevent possible DOS via temporary
	file exhaustion, identified by Bogdan Calin.
	(CVE-2009-4017, Ilia)</li>
	<li>Added protection for $_SESSION from interrupt
	corruption and improved "session.save_path" check,
	identified by Stefan Esser. (CVE-2009-4143, Stas)</li>
	<li>Fixed bug #49785 (insufficient input string
	validation of htmlspecialchars()). (CVE-2009-4142,
	Moriyoshi, hello at iwamot dot com)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3557</cvename>
	<cvename>CVE-2009-3558</cvename>
	<cvename>CVE-2009-4017</cvename>
	<cvename>CVE-2009-4142</cvename>
	<cvename>CVE-2009-4143</cvename>
	<url>http://www.php.net/releases/5_2_12.php</url>
	</references>
	<dates>
	<discovery>2009-12-17</discovery>
	<entry>2009-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="e7bc5600-eaa0-11de-bd9c-00215c6a37bb">
	<topic>postgresql -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql-client</name>
	<name>postgresql-server</name>
	<range><ge>7.4</ge><lt>7.4.27</lt></range>
	<range><ge>8.0</ge><lt>8.0.23</lt></range>
	<range><ge>8.1</ge><lt>8.1.19</lt></range>
	<range><ge>8.2</ge><lt>8.2.15</lt></range>
	<range><ge>8.3</ge><lt>8.3.9</lt></range>
	<range><ge>8.4</ge><lt>8.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PostgreSQL project reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4034">
	<p>PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
	8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
	and 8.4.x before 8.4.2 does not properly handle a '\0' character
	in a domain name in the subject's Common Name (CN) field of an
	X.509 certificate, which (1) allows man-in-the-middle attackers
	to spoof arbitrary SSL-based PostgreSQL servers via a crafted
	server certificate issued by a legitimate Certification Authority,
	and (2) allows remote attackers to bypass intended client-hostname
	restrictions via a crafted client certificate issued by a legitimate
	Certification Authority, a related issue to CVE-2009-2408.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136">
	<p>PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
	8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
	and 8.4.x before 8.4.2 does not properly manage session-local
	state during execution of an index function by a database
	superuser, which allows remote authenticated users to gain
	privileges via a table with crafted index functions, as
	demonstrated by functions that modify (1) search_path or
	(2) a prepared statement, a related issue to CVE-2007-6600
	and CVE-2009-3230.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4034</cvename>
	<cvename>CVE-2009-4136</cvename>
	</references>
	<dates>
	<discovery>2009-11-20</discovery>
	<entry>2009-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="5486669e-ea9f-11de-bd9c-00215c6a37bb">
	<topic>tptest -- pwd Remote Stack Buffer Overflow</topic>
	<affects>
	<package>
	<name>tptest</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33785">
	<p>TPTEST is prone to a remote stack-based buffer-overflow
	vulnerability. An attacker can exploit this issue to
	execute arbitrary code within the context of the affected
	application. Failed exploit attempts will result in a
	denial-of-service condition.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33785</bid>
	</references>
	<dates>
	<discovery>2009-02-16</discovery>
	<entry>2009-12-17</entry>
	</dates>
	</vuln>

	<vuln vid="01c57d20-ea26-11de-bd39-00248c9b4be7">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.6,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.16,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.0.16,1</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.0.1</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.1</lt></range>
	</package>

	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2009-71 GeckoActiveXObject exception messages can be used to
	enumerate installed COM objects</p>
	<p>MFSA 2009-70 Privilege escalation via chrome window.opener</p>
	<p>MFSA 2009-69 Location bar spoofing vulnerabilities</p>
	<p>MFSA 2009-68 NTLM reflection vulnerability</p>
	<p>MFSA 2009-67 Integer overflow, crash in libtheora video
	library</p>
	<p>MFSA 2009-66 Memory safety fixes in liboggplay media library</p>
	<p>MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/
	1.9.0.16)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3388</cvename>
	<cvename>CVE-2009-3389</cvename>
	<cvename>CVE-2009-3979</cvename>
	<cvename>CVE-2009-3980</cvename>
	<cvename>CVE-2009-3981</cvename>
	<cvename>CVE-2009-3982</cvename>
	<cvename>CVE-2009-3983</cvename>
	<cvename>CVE-2009-3984</cvename>
	<cvename>CVE-2009-3985</cvename>
	<cvename>CVE-2009-3986</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-71.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-70.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-69.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-67.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-66.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-65.html</url>
	</references>
	<dates>
	<discovery>2009-12-16</discovery>
	<entry>2009-12-16</entry>
	<modified>2010-01-21</modified>
	</dates>
	</vuln>

	<vuln vid="1b3f854b-e4bd-11de-b276-000d8787e1be">
	<topic>freeradius -- remote packet of death vulnerability</topic>
	<affects>
	<package>
	<name>freeradius</name>
	<range><lt>1.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>freeRADIUS Vulnerability Notifications reports:</p>
	<blockquote cite="http://freeradius.org/security.html">
	<p>2009.09.09 v1.1.7 - Anyone who can send packets to
	the server can crash it by sending a Tunnel-Password
	attribute in an Access-Request packet. This
	vulnerability is not otherwise exploitable. We have
	released 1.1.8 to correct this vulnerability.</p>
	<p>This issue is similar to the previous Tunnel-Password
	issue noted below. The vulnerable versions are 1.1.3
	through 1.1.7. Version 2.x is not affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3111</cvename>
	<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111</url>
	<url>http://freeradius.org/security.html</url>
	<url>http://www.milw0rm.com/exploits/9642</url>
	</references>
	<dates>
	<discovery>2009-09-09</discovery>
	<entry>2009-12-14</entry>
	<modified>2009-12-14</modified>
	</dates>
	</vuln>

	<vuln vid="bec38383-e6cb-11de-bdd4-000c2930e89b">
	<topic>pligg -- Cross-Site Scripting and Cross-Site Request Forgery</topic>
	<affects>
	<package>
	<name>pligg</name>
	<range><lt>1.0.3b</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/37349">
	<p>Russ McRee has discovered some vulnerabilities in Pligg, which can
	be exploited by malicious people to conduct cross-site scripting and
	request forgery attacks.</p>
	<p>Input passed via the "Referer" HTTP header to various scripts (e.g.
	admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php,
	submit.php, submit_groups.php, user_add_remove_links.php, and
	user_settings.php) is not properly sanitised before being returned to
	the user. This can be exploited to execute arbitrary HTML and script
	code in a user's browser session in context of an affected site.</p>
	<p>The application allows users to perform certain actions via HTTP
	requests without performing any validity checks to verify the requests.
	This can be exploited to e.g. create an arbitrary user with administrative
	privileges if a logged-in administrative user visits a malicious web
	site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4786</cvename>
	<cvename>CVE-2009-4787</cvename>
	<cvename>CVE-2009-4788</cvename>
	<url>http://secunia.com/advisories/37349/</url>
	<url>http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/</url>
	</references>
	<dates>
	<discovery>2009-12-02</discovery>
	<entry>2009-12-12</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="fcbf56dd-e667-11de-920a-00248c9b4be7">
	<topic>piwik -- php code execution</topic>
	<affects>
	<package>
	<name>piwik</name>
	<range><lt>0.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/37649">
	<p>Stefan Esser has reported a vulnerability in Piwik, which can be
	exploited by malicious people to compromise a vulnerable system.</p>
	<p>The vulnerability is caused due to the core/Cookie.php script using
	"unserialize()" with user controlled input. This can be exploited to
	e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()"
	methods of a serialized object passed via an HTTP cookie.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4137</cvename>
	<url>http://secunia.com/advisories/37649/</url>
	<url>http://www.sektioneins.de/de/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/index.html</url>
	<url>http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/</url>
	</references>
	<dates>
	<discovery>2009-12-10</discovery>
	<entry>2009-12-11</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="30211c45-e52a-11de-b5cd-00e0815b8da8">
	<topic>dovecot -- Insecure directory permissions</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<range><ge>1.2.*</ge><lt>1.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dovecot author reports:</p>
	<blockquote cite="http://www.dovecot.org/list/dovecot-news/2009-November/000143.html">
	<p>Dovecot v1.2.x had been creating base_dir (and its parents if
	necessary) with 0777 permissions. The base_dir's permissions get
	changed to 0755 automatically at startup, but you may need to
	chmod the parent directories manually.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3897</cvename>
	<bid>37084</bid>
	<url>http://secunia.com/advisories/37443</url>
	</references>
	<dates>
	<discovery>2009-11-20</discovery>
	<entry>2009-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="3c1a672e-e508-11de-9f4a-001b2134ef46">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r260</lt></range>
	</package>
	<package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.0r42</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb09-19.html">
	<p>Critical vulnerabilities have been identified in Adobe
	Flash Player version 10.0.32.18 and earlier. These
	vulnerabilities could cause the application to crash and
	could potentially allow an attacker to take control of the
	affected system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3794</cvename>
	<cvename>CVE-2009-3796</cvename>
	<cvename>CVE-2009-3797</cvename>
	<cvename>CVE-2009-3798</cvename>
	<cvename>CVE-2009-3799</cvename>
	<cvename>CVE-2009-3800</cvename>
	<cvename>CVE-2009-3951</cvename>
	<url>http://www.zerodayinitiative.com/advisories/ZDI-09-092/</url>
	<url>http://www.zerodayinitiative.com/advisories/ZDI-09-093/</url>
	<url>http://www.adobe.com/support/security/bulletins/apsb09-19.html</url>
	</references>
	<dates>
	<discovery>2009-07-14</discovery>
	<entry>2009-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="eab8c3bd-e50c-11de-9cd0-001a926c7637">
	<topic>ruby -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>ruby</name>
	<range><ge>1.9.1,1</ge><lt>1.9.1.376,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/">
	<p>There is a heap overflow vulnerability in String#ljust,
	String#center and String#rjust. This has allowed an attacker to run
	arbitrary code in some rare cases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4124</cvename>
	<url>http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/</url>
	</references>
	<dates>
	<discovery>2009-11-30</discovery>
	<entry>2009-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="714c1406-e4cf-11de-883a-003048590f9e">
	<topic>rt -- Session fixation vulnerability</topic>
	<affects>
	<package>
	<name>rt</name>
	<range><lt>3.8.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/37546">
	<p>A vulnerability has been reported in RT, which can be exploited by
	malicious people to conduct session fixation attacks.
	The vulnerability is caused due to an error in the handling of
	sessions and can be exploited to hijack another user's session by
	tricking the user into logging in after following a specially crafted
	link.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>37162</bid>
	<cvename>CVE-2009-3585</cvename>
	</references>
	<dates>
	<discovery>2009-12-01</discovery>
	<entry>2009-12-09</entry>
	</dates>
	</vuln>

	<vuln vid="5f030587-e39a-11de-881e-001aa0166822">
	<topic>expat2 -- Parser crash with specially formatted UTF-8 sequences</topic>
	<affects>
	<package>
	<name>expat2</name>
	<name>linux-f10-expat</name>
	<range><lt>2.0.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
	<p>The updatePosition function in lib/xmltok_impl.c in
	libexpat in Expat 2.0.1, as used in Python, PyXML,
	w3c-libwww, and other software, allows context-dependent
	attackers to cause a denial of service (application crash)
	via an XML document with crafted UTF-8 sequences that
	trigger a buffer over-read.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3720</cvename>
	</references>
	<dates>
	<discovery>2009-01-17</discovery>
	<entry>2009-12-08</entry>
	</dates>
	</vuln>

	<vuln vid="e9fca207-e399-11de-881e-001aa0166822">
	<topic>expat2 -- buffer over-read and crash</topic>
	<affects>
	<package>
	<name>expat2</name>
	<range><lt>2.0.1_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
	<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in
	Expat 2.0.1, as used in the XML-Twig module for Perl, allows
	context-dependent attackers to cause a denial of service
	(application crash) via an XML document with malformed UTF-8
	sequences that trigger a buffer over-read, related to the
	doProlog function in lib/xmlparse.c.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3560</cvename>
	</references>
	<dates>
	<discovery>2009-10-05</discovery>
	<entry>2009-12-08</entry>
	</dates>
	</vuln>

	<vuln vid="6431c4db-deb4-11de-9078-0030843d3802">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>10.10.20091120</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>10.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Team reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1010/">
	<ul>
	<li>Fixed a heap buffer overflow in string to number conversion</li>
	<li>Fixed an issue where error messages could leak onto unrelated
	sites</li>
	<li>Fixed a moderately severe issue, as reported by Chris Evans of
	the Google Security Team; details will be disclosed at a later
	date.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0689</cvename>
	<cvename>CVE-2009-4071</cvename>
	<url>http://www.opera.com/support/kb/view/941/</url>
	<url>http://www.opera.com/support/kb/view/942/</url>
	</references>
	<dates>
	<discovery>2009-11-23</discovery>
	<entry>2009-12-01</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="77c14729-dc5e-11de-92ae-02e0184b8d35">
	<topic>libtool -- Library Search Path Privilege Escalation Issue</topic>
	<affects>
	<package>
	<name>libtool</name>
	<range><lt>2.2.6b</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia.com</p>
	<blockquote cite="http://secunia.com/advisories/37414/">
	<p>Do not attempt to load an unqualified module.la file from the
	current directory (by default) since doing so is insecure and is
	not compliant with the documentation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3736</cvename>
	<url>http://secunia.com/advisories/37414/</url>
	<url>http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html</url>
	</references>
	<dates>
	<discovery>2009-11-25</discovery>
	<entry>2009-11-28</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="94edff42-d93d-11de-a434-0211d880e350">
	<topic>libvorbis -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libvorbis</name>
	<range><lt>1.2.3_1,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Ubuntu security team reports:</p>
	<blockquote cite="http://www.ubuntu.com/usn/usn-861-1">
	<p>It was discovered that libvorbis did not correctly
	handle certain malformed vorbis files. If a user were
	tricked into opening a specially crafted vorbis file
	with an application that uses libvorbis, an attacker
	could cause a denial of service or possibly execute
	arbitrary code with the user's privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1420</cvename>
	<cvename>CVE-2009-3379</cvename>
	</references>
	<dates>
	<discovery>2009-11-24</discovery>
	<entry>2009-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="92ca92c1-d859-11de-89f9-001517351c22">
	<topic>bugzilla -- information leak</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><gt>3.3.1</gt><lt>3.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.4.3/">
	<p>When a bug is in a group, none of its information
	(other than its status and resolution) should be visible
	to users outside that group. It was discovered that
	as of 3.3.2, Bugzilla was showing the alias of the bug
	(a very short string used as a shortcut for looking up
	the bug) to users outside of the group, if the protected
	bug ended up in the "Depends On" or "Blocks" list of any
	other bug.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3386</cvename>
	<url>http://www.bugzilla.org/security/3.4.3/</url>
	</references>
	<dates>
	<discovery>2009-11-18</discovery>
	<entry>2009-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="04104985-d846-11de-84e4-00215af774f0">
	<topic>cacti -- cross-site scripting issues</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.7e4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cacti development team reports:</p>
	<blockquote cite="http://docs.cacti.net/#cross-site_scripting_fixes">
	<p>The Cross-Site Scripting patch has been posted.</p>
	<p>This patch addresses cross-site scripting issues reported
	by Moritz Naumann.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4032</cvename>
	<url>http://docs.cacti.net/#cross-site_scripting_fixes</url>
	</references>
	<dates>
	<discovery>2009-11-21</discovery>
	<entry>2009-11-23</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="0640198a-d117-11de-b667-0030843d3802">
	<topic>wordpress -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>2.8.6,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>2.8.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/37332/">
	<p>The security issue is caused due to the wp_check_filetype()
	function in /wp-includes/functions.php improperly validating uploaded
	files. This can be exploited to execute arbitrary PHP code by
	uploading a malicious PHP script with multiple extensions.</p>
	<p>Successful exploitation of this vulnerability requires that Apache
	is not configured to handle the mime-type for media files with an e.g.
	"gif", "jpg", "png", "tif", "wmv" extension.</p>
	<p>Input passed via certain parameters to press-this.php is not
	properly sanitised before being displayed to the user. This can be
	exploited to insert arbitrary HTML and script code, which will be
	executed in a user's browser session in context of an affected site
	when the malicious data is being viewed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3890</cvename>
	<cvename>CVE-2009-3891</cvename>
	<url>http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/</url>
	<url>http://secunia.com/advisories/37332/</url>
	</references>
	<dates>
	<discovery>2009-11-12</discovery>
	<entry>2009-11-14</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="68bda678-caab-11de-a97e-be89dfd1042e">
	<topic>p5-HTML-Parser -- denial of service</topic>
	<affects>
	<package>
	<name>p5-HTML-Parser</name>
	<range><lt>3.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3627">
	<p>The decode_entities function in util.c in HTML-Parser before
	3.63 allows context-dependent attackers to cause a denial of service
	(infinite loop) via an incomplete SGML numeric character reference,
	which triggers generation of an invalid UTF-8 character.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>36807</bid>
	<cvename>CVE-2009-3627</cvename>
	<url>http://secunia.com/advisories/37155</url>
	</references>
	<dates>
	<discovery>2009-10-23</discovery>
	<entry>2009-11-06</entry>
	</dates>
	</vuln>

	<vuln vid="4e8344a3-ca52-11de-8ee8-00215c6a37bb">
	<topic>gd -- '_gdGetColors' remote buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>gd</name>
	<range><lt>2.0.35_2,1</lt></range>
	</package>
	<package>
	<name>php5-gd</name>
	<range><lt>5.2.11_2</lt></range>
	</package>
	<package>
	<name>php4-gd</name>
	<range><lt>4.4.9_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
	<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and
	5.3.0, and the GD Graphics Library 2.x, does not properly
	verify a certain colorsTotal structure member, which might
	allow remote attackers to conduct buffer overflow or buffer
	over-read attacks via a crafted GD file, a different
	vulnerability than CVE-2009-3293.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>36712</bid>
	<cvename>CVE-2009-3546</cvename>
	<url>http://secunia.com/advisories/37069</url>
	<url>http://secunia.com/advisories/37080</url>
	</references>
	<dates>
	<discovery>2009-10-15</discovery>
	<entry>2009-11-05</entry>
	<modified>2010-06-17</modified>
	</dates>
	</vuln>

	<vuln vid="6693bad2-ca50-11de-8ee8-00215c6a37bb">
	<topic>typo3 -- multiple vulnerabilities in TYPO3 Core</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><lt>4.2.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>TYPO3 develop team reports:</p>
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/">
	<p>Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12
	and below, 4.2.9 and below, 4.3.0beta1 and below.</p>
	<p>SQL injection, Cross-site scripting (XSS), Information
	disclosure, Frame hijacking, Remote shell command execution
	and Insecure Install Tool authentication/session handling.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>36801</bid>
	<cvename>CVE-2009-3628</cvename>
	<cvename>CVE-2009-3629</cvename>
	<cvename>CVE-2009-3630</cvename>
	<cvename>CVE-2009-3631</cvename>
	<cvename>CVE-2009-3632</cvename>
	<cvename>CVE-2009-3633</cvename>
	<cvename>CVE-2009-3634</cvename>
	<cvename>CVE-2009-3635</cvename>
	<cvename>CVE-2009-3636</cvename>
	<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/</url>
	<url>http://secunia.com/advisories/37122/</url>
	</references>
	<dates>
	<discovery>2009-10-22</discovery>
	<entry>2009-11-05</entry>
	</dates>
	</vuln>

	<vuln vid="3149ab1c-c8b9-11de-b87b-0011098ad87f">
	<topic>vlc -- stack overflow in MPA, AVI and ASF demuxer</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><ge>0.5.0</ge><lt>1.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>VideoLAN reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa0901.html">
	<p>When parsing a MP4, ASF or AVI file with an overly deep box
	structure, a stack overflow might occur. It would overwrite the
	return address and thus redirect the execution flow.</p>
	<p>If successful, a malicious third party could trigger execution
	of arbitrary code within the context of the VLC media player.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.videolan.org/security/sa0901.html</url>
	</references>
	<dates>
	<discovery>2009-09-14</discovery>
	<entry>2009-11-03</entry>
	</dates>
	</vuln>

	<vuln vid="6f358f5a-c7ea-11de-a9f3-0030843d3802">
	<topic>KDE -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>kdebase-runtime</name>
	<range><ge>4.0.*</ge><lt>4.3.1_2</lt></range>
	</package>
	<package>
	<name>kdelibs</name>
	<range><ge>4.0.*</ge><lt>4.3.1_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2009-015.html">
	<p>Ark input sanitization errors: The KDE archiving tool, Ark,
	performs insufficient validation which leads to specially crafted
	archive files, using unknown MIME types, to be rendered using a KHTML
	instance, this can trigger uncontrolled XMLHTTPRequests to remote
	sites.</p>
	<p>IO Slaves input sanitization errors: KDE protocol handlers perform
	insufficient input validation, an attacker can craft malicious URI
	that would trigger JavaScript execution. Additionally the 'help://'
	protocol handler suffer from directory traversal. It should be noted
	that the scope of this issue is limited as the malicious URIs cannot
	be embedded in Internet hosted content.</p>
	<p>KMail input sanitization errors: The KDE mail client, KMail, performs
	insufficient validation which leads to specially crafted email
	attachments, using unknown MIME types, to be rendered using a KHTML
	instance, this can trigger uncontrolled XMLHTTPRequests to remote
	sites.</p>
	<p>The exploitation of these vulnerabilities is unlikely according to
	Portcullis and KDE but the execution of active content is nonetheless
	unexpected and might pose a threat.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.ocert.org/advisories/ocert-2009-015.html</url>
	</references>
	<dates>
	<discovery>2009-10-30</discovery>
	<entry>2009-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="2fda6bd2-c53c-11de-b157-001999392805">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>10.01.20091019</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>10.01</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Team Reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1001/">
	<ul>
	<li>Fixed an issue where certain domain names could allow execution
	of arbitrary code, as reported by Chris Weber of Casaba Security</li>
	<li>Fixed an issue where scripts can run on the feed subscription
	page, as reported by Inferno</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3831</cvename>
	<url>http://www.opera.com/support/kb/view/938/</url>
	<url>http://www.opera.com/support/kb/view/939/</url>
	</references>
	<dates>
	<discovery>2009-10-28</discovery>
	<entry>2009-10-31</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="83d7d149-b965-11de-a515-0022156e8794">
	<topic>Enhanced cTorrent -- stack-based overflow</topic>
	<affects>
	<package>
	<name>ctorrent</name>
	<range><lt>3.3.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Securityfocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/34584">
	<p>cTorrent and dTorrent are prone to a remote buffer-overflow
	vulnerability because the software fails to properly
	bounds-check user-supplied input before copying it to an
	insufficiently sized memory buffer.</p>
	<p>Successful exploits allow remote attackers to execute
	arbitrary machine code in the context of a vulnerable
	application. Failed exploit attempts will likely result in
	denial-of-service conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34584</bid>
	<cvename>CVE-2009-1759</cvename>
	<url>http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959</url>
	</references>
	<dates>
	<discovery>2009-10-15</discovery>
	<entry>2009-10-28</entry>
	</dates>
	</vuln>

	<vuln vid="c87aa2d2-c3c4-11de-ab08-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.4,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.15,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>3.0.15</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	<p>MFSA 2009-64 Crashes with evidence of memory
	corruption (rv:1.9.1.4/ 1.9.0.15)</p>
	<p>MFSA 2009-63 Upgrade media libraries to fix memory
	safety bugs</p>
	<p>MFSA 2009-62 Download filename spoofing with RTL
	override</p>
	<p>MFSA 2009-61 Cross-origin data theft through
	document.getSelection()</p>
	<p>MFSA 2009-59 Heap buffer overflow in string to
	number conversion</p>
	<p>MFSA 2009-57 Chrome privilege escalation in
	XPCVariant::VariantDataToJS()</p>
	<p>MFSA 2009-56 Heap buffer overflow in GIF color map
	parser</p>
	<p>MFSA 2009-55 Crash in proxy auto-configuration
	regexp parsing</p>
	<p>MFSA 2009-54 Crash with recursive web-worker calls</p>
	<p>MFSA 2009-53 Local downloaded file tampering</p>
	<p>MFSA 2009-52 Form history vulnerable to stealing</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3380</cvename>
	<cvename>CVE-2009-3381</cvename>
	<cvename>CVE-2009-3382</cvename>
	<cvename>CVE-2009-3383</cvename>
	<cvename>CVE-2009-3379</cvename>
	<cvename>CVE-2009-3378</cvename>
	<cvename>CVE-2009-3377</cvename>
	<cvename>CVE-2009-3376</cvename>
	<cvename>CVE-2009-3375</cvename>
	<cvename>CVE-2009-1563</cvename>
	<cvename>CVE-2009-3374</cvename>
	<cvename>CVE-2009-3373</cvename>
	<cvename>CVE-2009-3372</cvename>
	<cvename>CVE-2009-3371</cvename>
	<cvename>CVE-2009-3274</cvename>
	<cvename>CVE-2009-3370</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-64.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-63.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-61.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-57.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-56.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-55.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-54.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-53.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-52.html</url>
	</references>
	<dates>
	<discovery>2009-10-27</discovery>
	<entry>2009-10-28</entry>
	<modified>2009-12-14</modified>
	</dates>
	</vuln>

	<vuln vid="2544f543-c178-11de-b175-001cc0377035">
	<topic>elinks -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>elinks</name>
	<range><lt>0.11.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/36574/discuss">
	<p>ELinks is prone to an off-by-one buffer-overflow vulnerability
	because the application fails to accurately reference the last
	element of a buffer.</p>
	<p>Attackers may leverage this issue to execute arbitrary code in
	the context of the application. Failed attacks will cause
	denial-of-service conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>36574</bid>
	<cvename>CVE-2008-7224</cvename>
	<mlist msgid="20080204235429.GA28006@diku.dk">http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html</mlist>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347</url>
	</references>
	<dates>
	<discovery>2006-07-29</discovery>
	<entry>2009-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="692ab645-bf5d-11de-849b-00151797c2d4">
	<topic>squidGuard -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>squidGuard</name>
	<range><lt>1.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SquidGuard website reports:</p>
	<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015">
	<p>Patch 20091015 fixes one buffer overflow problem
	in sgLog.c when overlong URLs are requested.
	SquidGuard will then go into emergency mode were
	no blocking occurs. This is not required in this
	situation.</p>
	</blockquote>
	<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019">
	<p>Patch 20091019 fixes two bypass problems with URLs
	which length is close to the limit defined by MAX_BUF
	(default: 4096) in squidGuard and MAX_URL (default:
	4096 in squid 2.x and 8192 in squid 3.x) in squid.
	For this kind of URLs the proxy request exceeds MAX_BUF
	causing squidGuard to complain about not being able to
	parse the squid request. Increasing the buffer limit
	to be higher than the one defined in MAX_URL solves the
	issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3700</cvename>
	<cvename>CVE-2009-3826</cvename>
	<url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015</url>
	<url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019</url>
	</references>
	<dates>
	<discovery>2009-10-15</discovery>
	<entry>2009-10-22</entry>
	<modified>2010-05-06</modified>
	</dates>
	</vuln>

	<vuln vid="8581189c-bd5f-11de-8709-0017a4cccfc6">
	<topic>Xpdf -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>xpdf</name>
	<range><lt>3.02_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/507261">
	<p>Some vulnerabilities have been reported in Xpdf, which can be
	exploited by malicious people to potentially compromise a user's
	system.</p>
	<p>1) Multiple integer overflows in "SplashBitmap::SplashBitmap()"
	can be exploited to cause heap-based buffer overflows.</p>
	<p>2) An integer overflow error in "ObjectStream::ObjectStream()"
	can be exploited to cause a heap-based buffer overflow.</p>
	<p>3) Multiple integer overflows in "Splash::drawImage()" can be
	exploited to cause heap-based buffer overflows.</p>
	<p>4) An integer overflow error in "PSOutputDev::doImageL1Sep()"
	can be exploited to cause a heap-based buffer overflow when
	converting a PDF document to a PS file.</p>
	<p>Successful exploitation of the vulnerabilities may allow execution
	of arbitrary code by tricking a user into opening a specially crafted
	PDF file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/archive/1/507261</url>
	<url>http://secunia.com/advisories/37053/</url>
	</references>
	<dates>
	<discovery>2009-10-14</discovery>
	<entry>2009-10-20</entry>
	</dates>
	</vuln>

	<vuln vid="87917d6f-ba76-11de-bac2-001a4d563a0f">
	<topic>django -- denial-of-service attack</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><lt>1.1.1</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>11603,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django project reports:</p>
	<blockquote cite="http://www.djangoproject.com/weblog/2009/oct/09/security/">
	<p>Django's forms library includes field types which perform
	regular-expression-based validation of email addresses and
	URLs. Certain addresses/URLs could trigger a pathological
	performance case in these regular expression, resulting in
	the server process/thread becoming unresponsive, and consuming
	excessive CPU over an extended period of time. If deliberately
	triggered, this could result in an effectively
	denial-of-service attack.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3695</cvename>
	<url>http://www.djangoproject.com/weblog/2009/oct/09/security/</url>
	</references>
	<dates>
	<discovery>2009-10-09</discovery>
	<entry>2009-10-16</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="4769914e-b844-11de-b159-0030843d3802">
	<topic>phpmyadmin -- XSS and SQL injection vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.2.2.1</lt></range>
	</package>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin Team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php">
	<p>Cross-site scripting (XSS) vulnerability allows remote attackers to
	inject arbitrary web script or HTML via a crafted MySQL table name.</p>
	<p>SQL injection vulnerability allows remote attackers to inject SQL via
	various interface parameters of the PDF schema generator feature.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3696</cvename>
	<cvename>CVE-2009-3697</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php</url>
	</references>
	<dates>
	<discovery>2009-10-13</discovery>
	<entry>2009-10-13</entry>
	</dates>
	</vuln>

	<vuln vid="437a68cf-b752-11de-b6eb-00e0815b8da8">
	<topic>php5 -- Multiple security issues</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vendor reports</p>
	<blockquote cite="http://www.php.net/releases/5_2_11.php">
	<p>Security Enhancements and Fixes in PHP 5.2.11:
	Fixed certificate validation inside
	php_openssl_apply_verification_policy.
	Fixed sanity check for the color index in imagecolortransparent.
	Added missing sanity checks around exif processing.
	Fixed bug 44683 popen crashes when an invalid mode is passed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.php.net/releases/5_2_11.php</url>
	<cvename>CVE-2009-3291</cvename>
	<cvename>CVE-2009-3292</cvename>
	<cvename>CVE-2009-3293</cvename>
	</references>
	<dates>
	<discovery>2009-09-17</discovery>
	<entry>2009-10-12</entry>
	</dates>
	</vuln>

	<vuln vid="ebeed063-b328-11de-b6a5-0030843d3802">
	<topic>virtualbox -- privilege escalation</topic>
	<affects>
	<package>
	<name>virtualbox</name>
	<range><lt>3.0.51.r22902_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sun reports:</p>
	<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1">
	<p>A security vulnerability in the VBoxNetAdpCtl configuration tool
	for certain Sun VirtualBox 3.0 packages may allow local unprivileged
	users who are authorized to run VirtualBox to execute arbitrary
	commands with root privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3692</cvename>
	<url>http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1</url>
	<url>http://secunia.com/advisories/36929</url>
	</references>
	<dates>
	<discovery>2009-10-07</discovery>
	<entry>2009-10-07</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="50383bde-b25b-11de-8c83-02e0185f8d72">
	<topic>FreeBSD -- Devfs / VFS NULL pointer race condition</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_13</lt></range>
	<range><ge>6.4</ge><lt>6.4_7</lt></range>
	<range><ge>7.1</ge><lt>7.1_8</lt></range>
	<range><ge>7.2</ge><lt>7.2_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to the interaction between devfs and VFS, a race condition
	exists where the kernel might dereference a NULL pointer.</p>
	<h1>Impact:</h1>
	<p>Successful exploitation of the race condition can lead to local
	kernel privilege escalation, kernel data corruption and/or
	crash.</p>
	<p>To exploit this vulnerability, an attacker must be able to run
	code with user privileges on the target system.</p>
	<h1>Workaround:</h1>
	<p>An errata note, FreeBSD-EN-09:05.null has been released
	simultaneously to this advisory, and contains a kernel patch
	implementing a workaround for a more broad class of
	vulnerabilities. However, prior to those changes, no workaround
	is available.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-09:14.devfs</freebsdsa>
	</references>
	<dates>
	<discovery>2009-10-02</discovery>
	<entry>2009-10-06</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="90d2e58f-b25a-11de-8c83-02e0185f8d72">
	<topic>FreeBSD -- kqueue pipe race conditions</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.4_7</lt></range>
	<range><ge>6.4</ge><lt>6.3_13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>A race condition exists in the pipe close() code relating
	to kqueues, causing use-after-free for kernel memory, which
	may lead to an exploitable NULL pointer vulnerability in the
	kernel, kernel memory corruption, and other unpredictable
	results.</p>
	<h1>Impact:</h1>
	<p>Successful exploitation of the race condition can lead to
	local kernel privilege escalation, kernel data corruption
	and/or crash.</p>
	<p>To exploit this vulnerability, an attacker must be able to
	run code on the target system.</p>
	<h1>Workaround</h1>
	<p>An errata notice, FreeBSD-EN-09:05.null has been released
	simultaneously to this advisory, and contains a kernel patch
	implementing a workaround for a more broad class of
	vulnerabilities. However, prior to those changes, no
	workaround is available.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-09:13.pipe</freebsdsa>
	</references>
	<dates>
	<discovery>2009-10-02</discovery>
	<entry>2009-10-06</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="beb6f4a8-add5-11de-8b55-0030843d3802">
	<topic>mybb -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mybb</name>
	<range><lt>1.4.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>mybb team reports:</p>
	<blockquote cite="http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/">
	<p>Input passed via avatar extensions is not properly sanitised before
	being used in SQL queries. This can be exploited to manipulate SQL
	queries by uploading specially named avatars.</p>
	<p>The script allows to sign up with usernames containing zero width
	space characters, which can be exploited to e.g. conduct spoofing
	attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>36460</bid>
	<url>http://dev.mybboard.net/issues/464</url>
	<url>http://dev.mybboard.net/issues/418</url>
	<url>http://secunia.com/advisories/36803</url>
	<url>http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/</url>
	</references>
	<dates>
	<discovery>2009-09-21</discovery>
	<entry>2009-09-30</entry>
	</dates>
	</vuln>

	<vuln vid="bad1b090-a7ca-11de-873f-0030843d3802">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.20</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/node/579482">
	<p>The core OpenID module does not correctly implement Form API for
	the form that allows one to link user accounts with OpenID
	identifiers. A malicious user is therefore able to use cross site
	request forgeries to add attacker controlled OpenID identities to
	existing accounts. These OpenID identities can then be used to gain
	access to the affected accounts.</p>
	<p>The OpenID module is not a compliant implementation of the OpenID
	Authentication 2.0 specification. An implementation error allows a
	user to access the account of another user when they share the same
	OpenID 2.0 provider.</p>
	<p>File uploads with certain extensions are not correctly processed by
	the File API. This may lead to the creation of files that are
	executable by Apache. The .htaccess that is saved into the files
	directory by Drupal should normally prevent execution. The files are
	only executable when the server is configured to ignore the directives
	in the .htaccess file.</p>
	<p>Drupal doesn't regenerate the session ID when an anonymous user
	follows the one time login link used to confirm email addresses and
	reset forgotten passwords. This enables a malicious user to fix and
	reuse the session id of a victim under certain circumstances.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/579482</url>
	<url>http://secunia.com/advisories/36787/</url>
	<url>http://secunia.com/advisories/36786/</url>
	<url>http://secunia.com/advisories/36781/</url>
	<url>http://secunia.com/advisories/36776/</url>
	<url>http://secunia.com/advisories/36785/</url>
	</references>
	<dates>
	<discovery>2009-09-17</discovery>
	<entry>2009-09-22</entry>
	</dates>
	</vuln>

	<vuln vid="113cd7e9-a4e2-11de-84af-001195e39404">
	<topic>fwbuilder -- security issue in temporary file handling</topic>
	<affects>
	<package>
	<name>fwbuilder</name>
	<range><lt>3.0.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Firewall Builder release notes reports:</p>
	<blockquote cite="http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7">
	<p>Vadim Kurland (vadim.kurland@fwbuilder.org) reports:</p>
	<p>Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate
	iptables scripts with a security issue when also used to
	generate static routing configurations.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-4664</cvename>
	<url>http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7</url>
	</references>
	<dates>
	<discovery>2009-09-18</discovery>
	<entry>2009-09-18</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="b9ec7fe3-a38a-11de-9c6b-003048818f40">
	<topic>bugzilla -- two SQL injections, sensitive data exposure</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><gt>3.3.1</gt><lt>3.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.4/">
	<ul>
	<li>It is possible to inject raw SQL into the Bugzilla
	database via the "Bug.create" and "Bug.search" WebService
	functions.</li>
	<li>When a user would change his password, his new password would
	be exposed in the URL field of the browser if he logged in right
	after changing his password.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3125</cvename>
	<cvename>CVE-2009-3165</cvename>
	<cvename>CVE-2009-3166</cvename>
	<url>http://www.bugzilla.org/security/3.0.8/</url>
	</references>
	<dates>
	<discovery>2009-09-11</discovery>
	<entry>2009-09-17</entry>
	</dates>
	</vuln>

	<vuln vid="ee23aa09-a175-11de-96c0-0011098ad87f">
	<topic>horde-base -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>horde-base</name>
	<range><lt>3.3.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde team reports:</p>
	<blockquote cite="http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559">
	<p>An error within the form library when handling image form fields can
	be exploited to overwrite arbitrary local files.</p>
	<p>An error exists within the MIME Viewer library when rendering unknown
	text parts. This can be exploited to execute arbitrary HTML and script
	code in a user's browser session in context of an affected site if
	malicious data is viewed.</p>
	<p>The preferences system does not properly sanitise numeric preference
	types. This can be exploited to execute arbitrary HTML and script code
	in a user's browser session in contact of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://bugs.horde.org/ticket/?id=8311</url>
	<url>http://bugs.horde.org/ticket/?id=8399</url>
	<url>http://secunia.com/advisories/36665/</url>
	<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559</url>
	</references>
	<dates>
	<discovery>2009-05-28</discovery>
	<entry>2009-09-14</entry>
	<modified>2009-09-22</modified>
	</dates>
	</vuln>

	<vuln vid="152b27f0-a158-11de-990c-e5b1d4c882e0">
	<topic>nginx -- remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>nginx</name>
	<range><lt>0.7.62</lt></range>
	</package>
	<package>
	<name>nginx-devel</name>
	<range><lt>0.8.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>nginx development team reports:</p>
	<blockquote cite="http://nginx.net/CHANGES">
	<p>A segmentation fault might occur in worker process while
	specially crafted request handling.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2629</cvename>
	<url>http://nginx.net/CHANGES</url>
	<mlist msgid="20090914155338.GA2529@ngolde.de">http://lists.debian.org/debian-security-announce/2009/msg00205.html</mlist>
	</references>
	<dates>
	<discovery>2009-09-14</discovery>
	<entry>2009-09-14</entry>
	<modified>2009-09-15</modified>
	</dates>
	</vuln>

	<vuln vid="6e8f54af-a07d-11de-a649-000c2955660f">
	<topic>ikiwiki -- insufficient blacklisting in teximg plugin</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>3.1415926</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The IkiWiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index35h2">
	<p>IkiWikis teximg plugin's blacklisting of insecure TeX commands
	is insufficient; it can be bypassed and used to read arbitrary
	files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2944</cvename>
	<url>http://ikiwiki.info/security/#index35h2</url>
	</references>
	<dates>
	<discovery>2009-08-28</discovery>
	<entry>2009-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="b46f3a1e-a052-11de-a649-000c2955660f">
	<topic>xapian-omega -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>xapian-omega</name>
	<range><lt>1.0.16</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Olly Betts reports:</p>
	<blockquote cite="http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html">
	<p>There's a cross-site scripting issue in Omega - exception
	messages don't currently get HTML entities escaped, but can
	contain CGI parameter values in some cases.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2947</cvename>
	<url>http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html</url>
	</references>
	<dates>
	<discovery>2009-09-09</discovery>
	<entry>2009-09-13</entry>
	</dates>
	</vuln>

	<vuln vid="922d2398-9e2d-11de-a998-0030843d3802">
	<topic>mozilla firefox -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.3,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	<p>MFSA 2009-51 Chrome privilege escalation with FeedWriter</p>
	<p>MFSA 2009-50 Location bar spoofing via tall line-height Unicode
	characters</p>
	<p>MFSA 2009-49 TreeColumns dangling pointer vulnerability</p>
	<p>MFSA 2009-48 Insufficient warning for PKCS11 module installation
	and removal</p>
	<p>MFSA 2009-47 Crashes with evidence of memory corruption
	(rv:1.9.1.3/1.9.0.14)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3069</cvename>
	<cvename>CVE-2009-3070</cvename>
	<cvename>CVE-2009-3071</cvename>
	<cvename>CVE-2009-3072</cvename>
	<cvename>CVE-2009-3073</cvename>
	<cvename>CVE-2009-3074</cvename>
	<cvename>CVE-2009-3075</cvename>
	<cvename>CVE-2009-3076</cvename>
	<cvename>CVE-2009-3077</cvename>
	<cvename>CVE-2009-3078</cvename>
	<cvename>CVE-2009-3079</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-47.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-48.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-50.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-51.html</url>
	<url>http://secunia.com/advisories/36671/2/</url>
	</references>
	<dates>
	<discovery>2009-09-10</discovery>
	<entry>2009-09-10</entry>
	</dates>
	</vuln>

	<vuln vid="012b495c-9d51-11de-8d20-001bd3385381">
	<topic>cyrus-imapd -- Potential buffer overflow in Sieve</topic>
	<affects>
	<package>
	<name>cyrus-imapd</name>
	<range><gt>2.2.0</gt><lt>2.2.13_6</lt></range>
	<range><gt>2.3.0</gt><lt>2.3.14_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cyrus IMAP Server ChangeLog states:</p>
	<blockquote cite="http://cyrusimap.web.cmu.edu/imapd/changes.html">
	<p>Fixed CERT VU#336053 - Potential buffer overflow in Sieve.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2632</cvename>
	<bid>36296</bid>
	<url>http://www.kb.cert.org/vuls/id/336053</url>
	<url>http://www.debian.org/security/2009/dsa-1881</url>
	</references>
	<dates>
	<discovery>2009-09-02</discovery>
	<entry>2009-09-09</entry>
	<modified>2009-09-14</modified>
	</dates>
	</vuln>

	<vuln vid="24aa9970-9ccd-11de-af10-000c29a67389">
	<topic>silc-toolkit -- Format string vulnerabilities</topic>
	<affects>
	<package>
	<name>silc-toolkit</name>
	<range><lt>1.1.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SILC Changlog reports:</p>
	<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10">
	<p>An unspecified format string vulnerability exists in
	silc-toolkit.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3051</cvename>
	<url>http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10</url>
	<url>http://www.openwall.com/lists/oss-security/2009/09/03/5</url>
	</references>
	<dates>
	<discovery>2009-08-07</discovery>
	<entry>2009-09-08</entry>
	</dates>
	</vuln>

	<vuln vid="4582948a-9716-11de-83a5-001999392805">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>10.00.20090830</lt></range>
	</package>
	<package>
	<name>opera-devel</name>
	<range><le>10.00.b3_1,1</le></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>10.00</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Team Reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/1000/">
	<ul>
	<li>Issue where sites using revoked intermediate certificates might be shown as secure</li>
	<li>Issue where the collapsed address bar didn't show the current domain</li>
	<li>Issue where pages could trick users into uploading files</li>
	<li>Some IDNA characters not correctly displaying in the address bar</li>
	<li>Issue where Opera accepts nulls and invalid wild-cards in certificates</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/search/view/929/</url>
	<url>http://www.opera.com/support/search/view/930/</url>
	<url>http://www.opera.com/support/search/view/931/</url>
	<url>http://www.opera.com/support/search/view/932/</url>
	<url>http://www.opera.com/support/search/view/934/</url>
	</references>
	<dates>
	<discovery>2009-09-01</discovery>
	<entry>2009-09-04</entry>
	<modified>2009-10-29</modified>
	</dates>
	</vuln>

	<vuln vid="80aa98e0-97b4-11de-b946-0030843d3802">
	<topic>dnsmasq -- TFTP server remote code injection vulnerability</topic>
	<affects>
	<package>
	<name>dnsmasq</name>
	<range><lt>2.50</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Kelley reports:</p>
	<blockquote cite="http://www.thekelleys.org.uk/dnsmasq/CHANGELOG">
	<p>Fix security problem which allowed any host permitted to
	do TFTP to possibly compromise dnsmasq by remote buffer
	overflow when TFTP enabled.</p>
	<p>Fix a problem which allowed a malicious TFTP client to
	crash dnsmasq.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>36121</bid>
	<bid>36120</bid>
	<cvename>CVE-2009-2957</cvename>
	<cvename>CVE-2009-2958</cvename>
	<url>http://www.coresecurity.com/content/dnsmasq-vulnerabilities</url>
	<url>https://rhn.redhat.com/errata/RHSA-2009-1238.html</url>
	</references>
	<dates>
	<discovery>2009-08-31</discovery>
	<entry>2009-09-02</entry>
	</dates>
	</vuln>

	<vuln vid="e15f2356-9139-11de-8f42-001aa0166822">
	<topic>apache22 -- several vulnerabilities</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache ChangeLog reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.12">
	<p>CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.</p>
	<p>CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.</p>
	<p>CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.</p>
	<p>CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.</p>
	<p>CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1891</cvename><!-- vul: 2.2.11 -->
	<cvename>CVE-2009-1195</cvename><!-- vul: 2.2.x to 2.2.11 -->
	<cvename>CVE-2009-1890</cvename><!-- ok: 2.3.3 -->
	<cvename>CVE-2009-1191</cvename><!-- vul: 2.2.11 -->
	<cvename>CVE-2009-0023</cvename><!-- ok: apr 1.3.5 -->
	<cvename>CVE-2009-1955</cvename><!-- ok: apr-util 1.3.7 -->
	<cvename>CVE-2009-1956</cvename><!-- ok: apr-util 1.3.5 -->
	</references>
	<dates>
	<discovery>2009-07-28</discovery><!-- release date of 2.2.12 -->
	<entry>2009-08-25</entry>
	</dates>
	</vuln>

	<vuln vid="59e7af2d-8db7-11de-883b-001e3300a30d">
	<topic>pidgin -- MSN overflow parsing SLP messages</topic>
	<affects>
	<package>
	<name>pidgin</name>
	<name>libpurple</name>
	<name>finch</name>
	<range><lt>2.5.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/36384">
	<p>A vulnerability has been reported in Pidgin, which can be
	exploited by malicious people to potentially compromise a user's
	system.</p>
	<p>The vulnerability is caused due to an error in the
	"msn_slplink_process_msg()" function when processing MSN SLP
	messages and can be exploited to corrupt memory.</p>
	<p>Successful exploitation may allow execution of arbitrary
	code.</p>
	<p>The vulnerability is reported in versions 2.5.8 and prior.
	Other versions may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2694</cvename>
	<url>http://secunia.com/advisories/36384/</url>
	<url>http://www.pidgin.im/news/security/?id=34</url>
	</references>
	<dates>
	<discovery>2009-08-18</discovery>
	<entry>2009-08-20</entry>
	</dates>
	</vuln>

	<vuln vid="b31a1088-460f-11de-a11a-0022156e8794">
	<topic>GnuTLS -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.6.6</lt></range>
	</package>
	<package>
	<name>gnutls-devel</name>
	<range><lt>2.7.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/34783/discuss">
	<p>GnuTLS is prone to multiple remote vulnerabilities:</p>
	<ul>
	<li>A remote code-execution vulnerability.</li>
	<li>A denial-of-service vulnerability.</li>
	<li>A signature-generation vulnerability.</li>
	<li>A signature-verification vulnerability.</li>
	</ul>
	<p>An attacker can exploit these issues to potentially execute
	arbitrary code, trigger denial-of-service conditions, carry
	out attacks against data signed with weak signatures, and
	cause clients to accept expired or invalid certificates from
	servers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1415</cvename>
	<cvename>CVE-2009-1416</cvename>
	<cvename>CVE-2009-1417</cvename>
	<bid>34783</bid>
	<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515</url>
	<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516</url>
	<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517</url>
	</references>
	<dates>
	<discovery>2009-05-21</discovery>
	<entry>2009-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="856a6f84-8b30-11de-8062-00e0815b8da8">
	<topic>GnuTLS -- improper SSL certificate verification</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.8.3</lt></range>
	</package>
	<package>
	<name>gnutls-devel</name>
	<range><lt>2.9.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GnuTLS reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.network.gnutls.general/1733">
	<p>By using a NUL byte in CN/SAN fields, it was possible to fool
	GnuTLS into 1) not printing the entire CN/SAN field value when
	printing a certificate and 2) cause incorrect positive matches
	when matching a hostname against a certificate.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2730</cvename>
	<url>http://article.gmane.org/gmane.network.gnutls.general/1733</url>
	<url>http://secunia.com/advisories/36266</url>
	</references>
	<dates>
	<discovery>2009-08-11</discovery>
	<entry>2009-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="86ada694-8b30-11de-b9d0-000c6e274733">
	<topic>memcached -- memcached stats maps Information Disclosure Weakness</topic>
	<affects>
	<package>
	<name>memcached</name>
	<range><lt>1.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34915/">
	<p>A weakness has been reported in memcached, which can be exploited
	by malicious people to disclose system information.</p>
	<p>The weakness is caused due to the application disclosing the
	content of /proc/self/maps if a stats maps command is received.
	This can be exploited to disclose e.g. the addresses of allocated
	memory regions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1255</cvename>
	<url>http://secunia.com/advisories/34915/</url>
	</references>
	<dates>
	<discovery>2009-04-29</discovery>
	<entry>2009-08-17</entry>
	</dates>
	</vuln>

	<vuln vid="2430e9c3-8741-11de-938e-003048590f9e">
	<topic>wordpress -- remote admin password reset vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>2.8.4,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<range><lt>2.8.4</lt></range>
	</package>
	<package>
	<name>wordpress-mu</name>
	<range><lt>2.8.4a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>WordPress reports:</p>
	<blockquote cite="http://wordpress.org/development/2009/08/2-8-4-security-release/">
	<p>A specially crafted URL could be requested that would allow an
	attacker to bypass a security check to verify a user requested a
	password reset. As a result, the first account without a key in the
	database (usually the admin account) would have its password reset and
	a new password would be emailed to the account owner.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2762</cvename>
	<url>http://wordpress.org/development/2009/08/2-8-4-security-release/</url>
	<url>http://www.milw0rm.com/exploits/9410</url>
	</references>
	<dates>
	<discovery>2009-08-10</discovery>
	<entry>2009-08-12</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="5179d85c-8683-11de-91b9-0022157515b2">
	<topic>fetchmail -- improper SSL certificate subject verification</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><lt>6.3.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2009-01.txt">
	<p>Moxie Marlinspike demonstrated in July 2009 that some CAs would
	sign certificates that contain embedded NUL characters in the
	Common Name or subjectAltName fields of ITU-T X.509
	certificates.</p>
	<p>Applications that would treat such X.509 strings as
	NUL-terminated C strings (rather than strings that contain an
	explicit length field) would only check the part up to and
	excluding the NUL character, so that certificate names such as
	www.good.example\0www.bad.example.com would be mistaken as a
	certificate name for www.good.example. fetchmail also had this
	design and implementation flaw.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2666</cvename>
	<url>http://www.fetchmail.info/fetchmail-SA-2009-01.txt</url>
	</references>
	<dates>
	<discovery>2009-08-06</discovery>
	<entry>2009-08-11</entry>
	<modified>2009-08-13</modified>
	</dates>
	</vuln>

	<vuln vid="739b94a4-838b-11de-938e-003048590f9e">
	<topic>joomla15 -- com_mailto Timeout Issue</topic>
	<affects>
	<package>
	<name>joomla15</name>
	<range><lt>1.5.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joomla! Security Center reports:</p>
	<blockquote cite="http://developer.joomla.org/security/news/303-20090723-core-com-mailto-timeout-issue.html">
	<p>In com_mailto, it was possible to bypass timeout protection against
	sending automated emails.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://developer.joomla.org/security.html</url>
	<url>http://secunia.com/advisories/36097/</url>
	</references>
	<dates>
	<discovery>2009-07-22</discovery>
	<entry>2009-08-07</entry>
	<modified>2009-08-11</modified>
	</dates>
	</vuln>

	<vuln vid="bce1f76d-82d0-11de-88ea-001a4d49522b">
	<topic>subversion -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>subversion</name>
	<name>subversion-freebsd</name>
	<name>p5-subversion</name>
	<name>py-subversion</name>
	<range><lt>1.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Subversion Security Advisory reports:</p>
	<blockquote cite="http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt">
	<p>Subversion clients and servers have multiple heap
	overflow issues in the parsing of binary deltas. This is
	related to an allocation vulnerability in the APR library
	used by Subversion.</p>
	<p>Clients with commit access to a vulnerable server can
	cause a remote heap overflow; servers can cause a heap
	overflow on vulnerable clients that try to do a checkout
	or update.</p>
	<p>This can lead to a DoS (an exploit has been tested) and
	to arbitrary code execution (no exploit tested, but the
	possibility is clear).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2411</cvename>
	<url>http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt</url>
	</references>
	<dates>
	<discovery>2009-08-06</discovery>
	<entry>2009-08-06</entry>
	<modified>2009-08-07</modified>
	</dates>
	</vuln>

	<vuln vid="d67b517d-8214-11de-88ea-001a4d49522b">
	<topic>bugzilla -- product name information leak</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><gt>3.3.4</gt><lt>3.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.4/">
	<p>Normally, users are only supposed to see products that
	they can file bugs against in the "Product" drop-down on
	the bug-editing page. Instead, users were being shown all
	products, even those that they normally could not see. Any
	user who could edit any bug could see all product
	names.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.bugzilla.org/security/3.4/</url>
	</references>
	<dates>
	<discovery>2009-07-30</discovery>
	<entry>2009-08-05</entry>
	</dates>
	</vuln>

	<vuln vid="49e8f2ee-8147-11de-a994-0030843d3802">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>3.*,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.2</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.18</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	<p>MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name
	longer than 15 characters</p>
	<p>MFSA 2009-42: Compromise of SSL-protected communication</p>
	<p>MFSA 2009-43: Heap overflow in certificate regexp parsing</p>
	<p>MFSA 2009-44: Location bar and SSL indicator spoofing via window.open()
	on invalid URL</p>
	<p>MFSA 2009-45: Crashes with evidence of memory corruption
	(rv:1.9.1.2/1.9.0.13)</p>
	<p>MFSA 2009-46: Chrome privilege escalation due to incorrectly cached
	wrapper</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2404</cvename>
	<cvename>CVE-2009-2408</cvename>
	<cvename>CVE-2009-2454</cvename>
	<cvename>CVE-2009-2470</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-38.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-42.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-43.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-44.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-45.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-46.html</url>
	</references>
	<dates>
	<discovery>2009-08-03</discovery>
	<entry>2009-08-04</entry>
	<modified>2009-09-04</modified>
	</dates>
	</vuln>

	<vuln vid="4e306850-811f-11de-8a67-000c29a67389">
	<topic>silc-client -- Format string vulnerability</topic>
	<affects>
	<package>
	<name>silc-client</name>
	<name>silc-irssi-client</name>
	<range><lt>1.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SILC changelog reports:</p>
	<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Client%201.1.8">
	<p>An unspecified format string vulnerability exists in
	silc-client.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-3051</cvename>
	<url>http://silcnet.org/docs/changelog/SILC%20Client%201.1.8</url>
	</references>
	<dates>
	<discovery>2009-07-31</discovery>
	<entry>2009-08-04</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="0d0237d0-7f68-11de-984d-0011098ad87f">
	<topic>SquirrelMail -- Plug-ins compromise</topic>
	<affects>
	<package>
	<name>squirrelmail-multilogin-plugin</name>
	<range><ge>2.3.4</ge><lt>2.3.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The SquirrelMail Web Server has been compromised, and three plugins
	are affected.</p>
	<p>The port of squirrelmail-sasql-plugin is safe (right MD5), and
	change_pass is not in the FreeBSD ports tree, but multilogin has a
	wrong MD5.</p>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/mailarchive/message.php?msg_name=4A727634.3080008%40squirrelmail.org</url>
	<url>http://squirrelmail.org/index.php</url>
	</references>
	<dates>
	<discovery>2009-07-31</discovery>
	<entry>2009-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="83725c91-7c7e-11de-9672-00e0815b8da8">
	<topic>BIND -- Dynamic update message remote DoS</topic>
	<affects>
	<package>
	<name>bind9</name>
	<range><lt>9.3.6.1.1</lt></range>
	</package>
	<package>
	<name>bind9-sdb-postgresql</name>
	<name>bind9-sdb-ldap</name>
	<range><lt>9.4.3.3</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_12</lt></range>
	<range><ge>6.4</ge><lt>6.4_6</lt></range>
	<range><ge>7.1</ge><lt>7.1_7</lt></range>
	<range><ge>7.2</ge><lt>7.2_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When named(8) receives a specially crafted dynamic update
	message an internal assertion check is triggered which causes
	named(8) to exit.</p>
	<p>To trigger the problem, the dynamic update message must contains
	a record of type "ANY" and at least one resource record set (RRset)
	for this fully qualified domain name (FQDN) must exist on the
	server.</p>
	<h1>Impact:</h1>
	<p>An attacker which can send DNS requests to a nameserver can cause
	it to exit, thus creating a Denial of Service situation.</p>
	<h1>Workaround:</h1>
	<p>No generally applicable workaround is available, but some firewalls
	may be able to prevent nsupdate DNS packets from reaching the
	nameserver.</p>
	<p>NOTE WELL: Merely configuring named(8) to ignore dynamic updates
	is NOT sufficient to protect it from this vulnerability.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0696</cvename>
	<freebsdsa>SA-09:12.bind</freebsdsa>
	<url>http://www.kb.cert.org/vuls/id/725188</url>
	<url>https://www.isc.org/node/474</url>
	</references>
	<dates>
	<discovery>2009-07-28</discovery>
	<entry>2009-08-01</entry>
	<modified>2009-08-04</modified>
	</dates>
	</vuln>

	<vuln vid="708c65a5-7c58-11de-a994-0030843d3802">
	<topic>mono -- XML signature HMAC truncation spoofing</topic>
	<affects>
	<package>
	<name>mono</name>
	<range><lt>2.4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35852/">
	<p>A security issue has been reported in Mono, which can be
	exploited by malicious people to conduct spoofing attacks.</p>
	<p>The security issue is caused due to an error when processing
	certain XML signatures.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0217</cvename>
	<url>http://secunia.com/advisories/35852/</url>
	<url>http://www.kb.cert.org/vuls/id/466161</url>
	</references>
	<dates>
	<discovery>2009-07-15</discovery>
	<entry>2009-07-29</entry>
	</dates>
	</vuln>

	<vuln vid="e1156e90-7ad6-11de-b26a-0048543d60ce">
	<topic>squid -- several remote denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>3.0.1</ge><lt>3.0.17</lt></range>
	<range><ge>3.1.0.1</ge><lt>3.1.0.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2009:2 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_2.txt">
	<p>Due to incorrect buffer limits and related bound checks Squid
	is vulnerable to a denial of service attack when processing
	specially crafted requests or responses.</p>
	<p>Due to incorrect data validation Squid is vulnerable to a
	denial of service attack when processing specially crafted
	responses.</p>
	<p>These problems allow any trusted client or external server to
	perform a denial of service attack on the Squid service.</p>
	</blockquote>
	<p>Squid-2.x releases are not affected.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2621</cvename>
	<cvename>CVE-2009-2622</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2009_2.txt</url>
	</references>
	<dates>
	<discovery>2009-07-27</discovery>
	<entry>2009-07-27</entry>
	<modified>2009-08-06</modified>
	</dates>
	</vuln>

	<vuln vid="c1ef9b33-72a6-11de-82ea-0030843d3802">
	<topic>mozilla -- corrupt JIT state after deep return from native function</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><ge>3.5.*,1</ge><lt>3.5.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Project reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/2009/mfsa2009-41.html">
	<p>Firefox user zbyte reported a crash that we determined could result
	in an exploitable memory corruption problem. In certain cases after a
	return from a native function, such as escape(), the Just-in-Time
	(JIT) compiler could get into a corrupt state. This could be exploited
	by an attacker to run arbitrary code such as installing malware.</p>
	<p>This vulnerability does not affect earlier versions of Firefox
	which do not support the JIT feature.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2477</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-41.html</url>
	<url>http://www.kb.cert.org/vuls/id/443060</url>
	</references>
	<dates>
	<discovery>2009-07-16</discovery>
	<entry>2009-07-17</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="c444c8b7-7169-11de-9ab7-000c29a67389">
	<topic>isc-dhcp-client -- Stack overflow vulnerability</topic>
	<affects>
	<package>
	<name>isc-dhcp31-client</name>
	<range><le>3.1.1</le></range>
	</package>
	<package>
	<name>isc-dhcp30-client</name>
	<range><lt>3.0.7_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/410676">
	<p>The ISC DHCP dhclient application contains a stack buffer
	overflow, which may allow a remote, unauthenticated attacker to
	execute arbitrary code with root privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0692</cvename>
	<url>https://www.isc.org/node/468</url>
	<url>http://secunia.com/advisories/35785</url>
	<url>http://www.kb.cert.org/vuls/id/410676</url>
	</references>
	<dates>
	<discovery>2009-07-14</discovery>
	<entry>2009-07-15</entry>
	<modified>2009-07-21</modified>
	</dates>
	</vuln>

	<vuln vid="be927298-6f97-11de-b444-001372fd0af2">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.19</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Security Team reports:</p>
	<blockquote cite="http://drupal.org/node/507572">
	<p>Cross-site scripting</p>
	<p>The Forum module does not correctly handle certain arguments
	obtained from the URL. By enticing a suitably privileged user
	to visit a specially crafted URL, a malicious user is able to
	insert arbitrary HTML and script code into forum pages. Such a
	cross-site scripting attack may lead to the malicious user
	gaining administrative access. Wikipedia has more information
	about cross-site scripting (XSS).</p>
	<p>User signatures have no separate input format, they use the
	format of the comment with which they are displayed. A user
	will no longer be able to edit a comment when an administrator
	changes the comment's input format to a format that is not
	accessible to the user. However they will still be able to
	modify their signature, which will then be processed by the new
	input format.</p>
	<p>If the new format is very permissive, via their signature, the
	user may be able to insert arbitrary HTML and script code into
	pages or, when the PHP filter is enabled for the new format,
	execute PHP code. This issue affects Drupal 6.x only.</p>
	<p>When an anonymous user fails to login due to mistyping his
	username or password, and the page he is on contains a sortable
	table, the (incorrect) username and password are included in
	links on the table. If the user visits these links the password
	may then be leaked to external sites via the HTTP referer.</p>
	<p>In addition, if the anonymous user is enticed to visit the site
	via a specially crafted URL while the Drupal page cache is
	enabled, a malicious user might be able to retrieve the
	(incorrect) username and password from the page cache.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2372</cvename>
	<cvename>CVE-2009-2374</cvename>
	<cvename>CVE-2009-2373</cvename>
	<url>http://drupal.org/node/507572</url>
	<url>http://secunia.com/advisories/35681</url>
	</references>
	<dates>
	<discovery>2009-07-01</discovery>
	<entry>2009-07-13</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="70372cda-6771-11de-883a-00e0815b8da8">
	<topic>nfsen -- remote command execution</topic>
	<affects>
	<package>
	<name>nfsen</name>
	<range><lt>1.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>nfsen reports:</p>
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=967583">
	<p>Due to double input checking, a remote command execution security
	bug exists in all NfSen versions 1.3 and 1.3.1. Users are
	requested to update to nfsen-1.3.2.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/forum/forum.php?forum_id=967583</url>
	</references>
	<dates>
	<discovery>2009-06-18</discovery>
	<entry>2009-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="ba73f494-65a8-11de-aef5-001c2514716c">
	<topic>phpmyadmin -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.2.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin project reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php">
	<p>It was possible to conduct an XSS attack via a crafted
	SQL bookmark.</p>
	<p>All 3.x releases on which the "bookmarks" feature is
	active are affected, previous versions are not.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2284</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php</url>
	</references>
	<dates>
	<discovery>2009-06-30</discovery>
	<entry>2009-06-30</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="3ebd4cb5-657f-11de-883a-00e0815b8da8">
	<topic>nagios -- Command Injection Vulnerability</topic>
	<affects>
	<package>
	<name>nagios</name>
	<range><le>3.0.6_1</le></range>
	</package>
	<package>
	<name>nagios2</name>
	<range><le>2.12_3</le></range>
	</package>
	<package>
	<name>nagios-devel</name>
	<range><le>3.1.0_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35543?">
	<p>A vulnerability has been reported in Nagios, which can be
	exploited by malicious users to potentially compromise a
	vulnerable system.</p>
	<p>Input passed to the "ping" parameter in statuswml.cgi is not
	properly sanitised before being used to invoke the ping command.
	This can be exploited to inject and execute arbitrary shell
	commands.</p>
	<p>Successful exploitation requires access to the ping feature
	of the WAP interface.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-2288</cvename>
	<url>http://secunia.com/advisories/35543</url>
	<url>http://tracker.nagios.org/view.php?id=15</url>
	</references>
	<dates>
	<discovery>2009-05-29</discovery>
	<entry>2009-06-30</entry>
	<modified>2009-07-13</modified>
	</dates>
	</vuln>

	<vuln vid="f59dda75-5ff4-11de-a13e-00e0815b8da8">
	<topic>tor-devel -- DNS resolution vulnerability</topic>
	<affects>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.1.15-rc</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Tor Project reports:</p>
	<blockquote cite="https://git.torproject.org/checkout/tor/master/ChangeLog">
	<p>A malicious exit relay could convince a controller that the
	client's DNS question resolves to an internal IP address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>https://git.torproject.org/checkout/tor/master/ChangeLog</url>
	</references>
	<dates>
	<discovery>2009-06-20</discovery>
	<entry>2009-06-23</entry>
	</dates>
	</vuln>

	<vuln vid="c14aa48c-5ab7-11de-bc9b-0030843d3802">
	<topic>cscope -- multiple buffer overflows</topic>
	<affects>
	<package>
	<name>cscope</name>
	<range><lt>15.7a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34978">
	<p>Some vulnerabilities have been reported in Cscope, which
	potentially can be exploited by malicious people to compromise a
	user's system.</p>
	<p>The vulnerabilities are caused due to various boundary errors,
	which can be exploited to cause buffer overflows when parsing
	specially crafted files or directories.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34805</bid>
	<cvename>CVE-2009-0148</cvename>
	<url>http://secunia.com/advisories/34978</url>
	</references>
	<dates>
	<discovery>2009-05-31</discovery>
	<entry>2009-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="91a2066b-5ab6-11de-bc9b-0030843d3802">
	<topic>cscope -- buffer overflow</topic>
	<affects>
	<package>
	<name>cscope</name>
	<range><lt>15.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/34832">
	<p>Attackers may leverage this issue to execute arbitrary code
	in the context of the application. Failed attacks will cause
	denial-of-service conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34832</bid>
	<cvename>CVE-2009-1577</cvename>
	<url>http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19</url>
	</references>
	<dates>
	<discovery>2009-05-31</discovery>
	<entry>2009-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="bdccd14b-5aac-11de-a438-003048590f9e">
	<topic>joomla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla15</name>
	<range><lt>1.5.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35278/">
	<p>Some vulnerabilities have been reported in Joomla!, which can be
	exploited by malicious users to conduct script insertion attacks and
	by malicious people to conduct cross-site scripting attacks.</p>
	<p>Certain unspecified input is not properly sanitised before being
	used. This can be exploited to insert arbitrary HTML and script code,
	which will be executed in a user's browser session in the context of
	an affected site when the malicious data is displayed.</p>
	<p>Certain unspecified input passed to the user view of the com_users
	core component is not properly sanitised before being returned to the
	user. This can be exploited to execute arbitrary HTML and script code
	in a user's browser session in context of an affected site.</p>
	<p>Input passed via certain parameters to the "JA_Purity" template is
	not properly sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a user's
	browser session in context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1938</cvename>
	<cvename>CVE-2009-1939</cvename>
	<cvename>CVE-2009-1940</cvename>
	<url>http://secunia.com/advisories/35278/</url>
	<url>http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html</url>
	</references>
	<dates>
	<discovery>2009-06-03</discovery>
	<entry>2009-06-16</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="b1ca65e6-5aaf-11de-bc9b-0030843d3802">
	<topic>pidgin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>pidgin</name>
	<name>libpurple</name>
	<name>finch</name>
	<range><lt>2.5.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35194/">
	<p>Some vulnerabilities and weaknesses have been reported in Pidgin,
	which can be exploited by malicious people to cause a DoS or to
	potentially compromise a user's system.</p>
	<p>A truncation error in the processing of MSN SLP messages can be
	exploited to cause a buffer overflow.</p>
	<p>A boundary error in the XMPP SOCKS5 "bytestream" server when
	initiating an outgoing file transfer can be exploited to cause a
	buffer overflow.</p>
	<p>A boundary error exists in the implementation of the
	"PurpleCircBuffer" structure. This can be exploited to corrupt memory
	and cause a crash via specially crafted XMPP or Sametime
	packets.</p>
	<p>A boundary error in the "decrypt_out()" function can be exploited
	to cause a stack-based buffer overflow with 8 bytes and crash the
	application via a specially crafted QQ packet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>35067</bid>
	<cvename>CVE-2009-1373</cvename>
	<cvename>CVE-2009-1374</cvename>
	<cvename>CVE-2009-1375</cvename>
	<cvename>CVE-2009-1376</cvename>
	<url>http://secunia.com/advisories/35194/</url>
	<url>http://www.pidgin.im/news/security/?id=29</url>
	<url>http://www.pidgin.im/news/security/?id=30</url>
	<url>http://www.pidgin.im/news/security/?id=32</url>
	</references>
	<dates>
	<discovery>2009-06-03</discovery>
	<entry>2009-06-16</entry>
	</dates>
	</vuln>

	<vuln vid="d9b01c08-59b3-11de-828e-00e0815b8da8">
	<topic>git -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>git</name>
	<range><lt>1.6.3.2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/35338/discuss">
	<p>Git is prone to a denial-of-service vulnerability because it
	fails to properly handle some client requests.</p>
	<p>Attackers can exploit this issue to cause a daemon process to
	enter an infinite loop. Repeated exploits may consume excessive
	system resources, resulting in a denial of service condition.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>35338</bid>
	<cvename>CVE-2009-2108</cvename>
	<url>https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html</url>
	<url>http://article.gmane.org/gmane.comp.version-control.git/120724</url>
	</references>
	<dates>
	<discovery>2009-06-04</discovery>
	<entry>2009-06-15</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="62e0fbe5-5798-11de-bb78-001cc0377035">
	<topic>ruby -- BigDecimal denial of service vulnerability</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.7.160_1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/">
	<p>A denial of service (DoS) vulnerability was found on the
	BigDecimal standard library of Ruby. Conversion from BigDecimal
	objects into Float numbers had a problem which enables attackers
	to effectively cause segmentation faults.</p>
	<p>An attacker can cause a denial of service by causing BigDecimal
	to parse an insanely large number, such as:</p>
	<p><code>BigDecimal("9E69999999").to_s("F")</code></p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>35278</bid>
	<cvename>CVE-2009-1904</cvename>
	<url>http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/</url>
	</references>
	<dates>
	<discovery>2009-06-09</discovery>
	<entry>2009-06-13</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="da185955-5738-11de-b857-000f20797ede">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.20_8,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.11,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.11</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.22</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
	<p>MFSA 2009-32 JavaScript chrome privilege escalation</p>
	<p>MFSA 2009-31 XUL scripts bypass content-policy checks</p>
	<p>MFSA 2009-30 Incorrect principal set for file: resources
	loaded via location bar</p>
	<p>MFSA 2009-29 Arbitrary code execution using event listeners
	attached to an element whose owner document is null</p>
	<p>MFSA 2009-28 Race condition while accessing the private data
	of a NPObject JS wrapper class object</p>
	<p>MFSA 2009-27 SSL tampering via non-200 responses to proxy
	CONNECT requests</p>
	<p>MFSA 2009-26 Arbitrary domain cookie access by local file:
	resources</p>
	<p>MFSA 2009-25 URL spoofing with invalid unicode characters</p>
	<p>MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1392</cvename>
	<cvename>CVE-2009-1832</cvename>
	<cvename>CVE-2009-1833</cvename>
	<cvename>CVE-2009-1834</cvename>
	<cvename>CVE-2009-1835</cvename>
	<cvename>CVE-2009-1836</cvename>
	<cvename>CVE-2009-1837</cvename>
	<cvename>CVE-2009-1838</cvename>
	<cvename>CVE-2009-1839</cvename>
	<cvename>CVE-2009-1840</cvename>
	<cvename>CVE-2009-1841</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-24.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-25.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-26.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-27.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-28.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-29.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-30.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-31.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-32.html</url>
	<url>http://secunia.com/advisories/35331/</url>
	</references>
	<dates>
	<discovery>2009-06-11</discovery>
	<entry>2009-06-12</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="eb9212f7-526b-11de-bbf2-001b77d09812">
	<topic>apr -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apr</name>
	<range><lt>1.3.5.1.3.7</lt></range>
	</package>
	<package>
	<name>apache</name>
	<range><ge>2.2.0</ge><lt>2.2.11_5</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.63_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35284/">
	<p>Some vulnerabilities have been reported in APR-util, which
	can be exploited by malicious users and malicious people to
	cause a DoS (Denial of Service).</p>
	<p>A vulnerability is caused due to an error in the processing
	of XML files and can be exploited to exhaust all available
	memory via a specially crafted XML file containing a
	predefined entity inside an entity definition.</p>
	<p>A vulnerability is caused due to an error within the
	"apr_strmatch_precompile()" function in
	strmatch/apr_strmatch.c, which can be exploited to crash an
	application using the library.</p>
	</blockquote>
	<p>RedHat reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=3D504390">
	<p>A single NULL byte buffer overflow flaw was found in
	apr-util's apr_brigade_vprintf() function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>35221</bid>
	<cvename>CVE-2009-1955</cvename>
	<cvename>CVE-2009-1956</cvename>
	<cvename>CVE-2009-0023</cvename>
	<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
	<url>http://secunia.com/advisories/35284/</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=3D504390</url>
	</references>
	<dates>
	<discovery>2009-06-05</discovery>
	<entry>2009-06-08</entry>
	</dates>
	</vuln>

	<vuln vid="4f838b74-50a1-11de-b01f-001c2514716c">
	<topic>dokuwiki -- Local File Inclusion with register_globals on</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20090214_2</lt></range>
	</package>
	<package>
	<name>dokuwiki-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>DokuWiki reports:</p>
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1700">
	<p>A security hole was discovered which allows an attacker
	to include arbitrary files located on the attacked DokuWiki
	installation. The included file is executed in the PHP context.
	This can be escalated by introducing malicious code through
	uploading file via the media manager or placing PHP code in
	editable pages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1960</cvename>
	<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1700</url>
	</references>
	<dates>
	<discovery>2009-05-26</discovery>
	<entry>2009-06-04</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="82b55df8-4d5a-11de-8811-0030843d3802">
	<topic>openssl -- denial of service in DTLS implementation</topic>
	<affects>
	<package>
	<name>openssl</name>
	<range><ge>0.9.8</ge><lt>0.9.8k_1</lt></range>
	</package>
	<package>
	<name>linux-f10-openssl</name>
	<range><ge>0.9.8f</ge><lt>0.9.8m</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35128/">
	<p>Some vulnerabilities have been reported in OpenSSL, which can be
	exploited by malicious people to cause a DoS.</p>
	<p>The library does not limit the number of buffered DTLS records with
	a future epoch. This can be exploited to exhaust all available memory
	via specially crafted DTLS packets.</p>
	<p>An error when processing DTLS messages can be exploited to exhaust
	all available memory by sending a large number of out of sequence
	handshake messages.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1377</cvename>
	<cvename>CVE-2009-1378</cvename>
	<url>http://secunia.com/advisories/35128/</url>
	</references>
	<dates>
	<discovery>2009-05-18</discovery>
	<entry>2009-05-30</entry>
	<modified>2014-04-10</modified>
	</dates>
	</vuln>

	<vuln vid="399f4cd7-4d59-11de-8811-0030843d3802">
	<topic>eggdrop -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>eggdrop</name>
	<range><lt>1.6.19_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35104/">
	<p>The vulnerability is caused due to an error in the processing of
	private messages within the server module
	(/mod/server.mod/servrmsg.c). This can be exploited to cause a
	crash by sending a specially crafted message to the bot.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34985</bid>
	<cvename>CVE-2009-1789</cvename>
	<url>http://www.eggheads.org/news/2009/05/14/35</url>
	<url>http://secunia.com/advisories/35104/</url>
	</references>
	<dates>
	<discovery>2009-05-15</discovery>
	<entry>2009-05-30</entry>
	</dates>
	</vuln>

	<vuln vid="a2d4a330-4d54-11de-8811-0030843d3802">
	<topic>wireshark -- PCNFSD Dissector Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.0.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35201/">
	<p>A vulnerability has been reported in Wireshark, which can be
	exploited by malicious people to cause a DoS.</p>
	<p>The vulnerability is caused due to an error in the PCNFSD dissector
	and can be exploited to cause a crash via a specially crafted PCNFSD
	packet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1829</cvename>
	<url>http://secunia.com/advisories/35201/</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2009-03.html</url>
	</references>
	<dates>
	<discovery>2009-05-21</discovery>
	<entry>2009-05-30</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="6355efdb-4d4d-11de-8811-0030843d3802">
	<topic>libsndfile -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<range><lt>1.0.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35076/">
	<p>Two vulnerabilities have been reported in libsndfile, which can be
	exploited by malicious people to compromise an application using the
	library.</p>
	<p>A boundary error exists within the "voc_read_header()" function in
	src/voc.c. This can be exploited to cause a heap-based buffer overflow
	via a specially crafted VOC file.</p>
	<p>A boundary error exists within the "aiff_read_header()" function in
	src/aiff.c. This can be exploited to cause a heap-based buffer overflow
	via a specially crafted AIFF file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1788</cvename>
	<cvename>CVE-2009-1791</cvename>
	<url>http://secunia.com/advisories/35076/</url>
	<url>http://www.trapkit.de/advisories/TKADV2009-006.txt</url>
	</references>
	<dates>
	<discovery>2009-05-15</discovery>
	<entry>2009-05-30</entry>
	</dates>
	</vuln>

	<vuln vid="80f13884-4d4c-11de-8811-0030843d3802">
	<topic>slim -- local disclosure of X authority magic cookie</topic>
	<affects>
	<package>
	<name>slim</name>
	<range><lt>1.3.1_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/35132/">
	<p>A security issue has been reported in SLiM, which can be
	exploited by malicious, local users to disclose sensitive
	information.</p>
	<p>The security issue is caused due to the application
	generating the X authority file by passing the X authority
	cookie via the command line to "xauth". This can be exploited
	to disclose the X authority cookie by consulting the process
	list and e.g. gain access the user's display.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>35015</bid>
	<cvename>CVE-2009-1756</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306</url>
	</references>
	<dates>
	<discovery>2009-05-20</discovery>
	<entry>2009-05-30</entry>
	</dates>
	</vuln>

	<vuln vid="4175c811-f690-4898-87c5-755b3cf1bac6">
	<topic>ntp -- stack-based buffer overflow</topic>
	<affects>
	<package>
	<name>ntp</name>
	<range><lt>4.2.4p7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/853097">
	<p>ntpd contains a stack buffer overflow which may allow a remote
	unauthenticated attacker to execute arbitrary code on a vulnerable
	system or create a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>35017</bid>
	<cvename>CVE-2009-0159</cvename>
	<cvename>CVE-2009-1252</cvename>
	<url>http://www.kb.cert.org/vuls/id/853097</url>
	</references>
	<dates>
	<discovery>2009-05-06</discovery>
	<entry>2009-05-20</entry>
	</dates>
	</vuln>

	<vuln vid="5ed2f96b-33b7-4863-8c6b-540d22344424">
	<topic>imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability</topic>
	<affects>
	<package>
	<name>imap-uw</name>
	<range><lt>2007e</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33795">
	<p>University of Washington IMAP c-client is prone to a remote
	format-string vulnerability because the software fails to adequately
	sanitize user-supplied input before passing it as the
	format-specifier to a formatted-printing function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33795</bid>
	</references>
	<dates>
	<discovery>2009-02-17</discovery>
	<entry>2009-05-21</entry>
	<modified>2009-05-22</modified>
	</dates>
	</vuln>

	<vuln vid="37a8603d-4494-11de-bea7-000c29a67389">
	<topic>nsd -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>nsd</name>
	<range><lt>3.2.2</lt></range>
	</package>
	<package>
	<name>nsd2</name>
	<range><lt>2.3.7_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NLnet Labs:</p>
	<blockquote cite="http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html">
	<p>A one-byte buffer overflow has been reported in NSD. The
	problem affects all versions 2.0.0 to 3.2.1. The bug allows
	a carefully crafted exploit to bring down your DNS server. It
	is highly unlikely that this one byte overflow can lead to
	other (system) exploits.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1755</cvename>
	<url>http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html</url>
	</references>
	<dates>
	<discovery>2009-05-19</discovery>
	<entry>2009-05-19</entry>
	<modified>2009-05-22</modified>
	</dates>
	</vuln>

	<vuln vid="48e14d86-42f1-11de-ad22-000e35248ad7">
	<topic>libxine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.16.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xine developers report:</p>
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233">
	<ul>
	<li>Fix another possible int overflow in the 4XM demuxer.
	(ref. TKADV2009-004, CVE-2009-0385)</li>
	<li>Fix an integer overflow in the Quicktime demuxer.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0385</cvename>
	<cvename>CVE-2009-1274</cvename>
	<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
	<url>http://trapkit.de/advisories/TKADV2009-005.txt</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
	</references>
	<dates>
	<discovery>2009-04-04</discovery>
	<entry>2009-05-17</entry>
	</dates>
	</vuln>

	<vuln vid="51d1d428-42f0-11de-ad22-000e35248ad7">
	<topic>libxine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.16.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities were fixed in libxine 1.1.16.2.</p>
	<p>Tobias Klein reports:</p>
	<blockquote cite="http://trapkit.de/advisories/TKADV2009-004.txt">
	<p>FFmpeg contains a type conversion vulnerability while
	parsing malformed 4X movie files. The vulnerability may be
	exploited by a (remote) attacker to execute arbitrary code in
	the context of FFmpeg or an application using the FFmpeg
	library.</p>
	<p>Note: A similar issue also affects xine-lib < version
	1.1.16.2.</p>
	</blockquote>
	<p>xine developers report:</p>
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=660071">
	<ul>
	<li>Fix broken size checks in various input plugins (ref.
	CVE-2008-5239).</li>
	<li>More malloc checking (ref. CVE-2008-5240).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0698</cvename>
	<cvename>CVE-2008-5234</cvename>
	<cvename>CVE-2008-5240</cvename>
	<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
	</references>
	<dates>
	<discovery>2009-02-15</discovery>
	<entry>2009-05-17</entry>
	</dates>
	</vuln>

	<vuln vid="1e8031be-4258-11de-b67a-0030843d3802">
	<topic>php -- ini database truncation inside dba_replace() function</topic>
	<affects>
	<package>
	<name>php4-dba</name>
	<range><lt>4.4.9_1</lt></range>
	</package>
	<package>
	<name>php5-dba</name>
	<range><lt>5.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>securityfocus research reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/498746/30/0/threaded">
	<p>A bug that leads to the emptying of the INI file contents if
	the database key was not found exists in PHP dba extension in
	versions 5.2.6, 4.4.9 and earlier.</p>
	<p>Function dba_replace() are not filtering strings key and value.
	There is a possibility for the destruction of the file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-7068</cvename>
	<url>http://www.securityfocus.com/archive/1/498746/30/0/threaded</url>
	<url>http://securityreason.com/achievement_securityalert/58</url>
	</references>
	<dates>
	<discovery>2008-11-28</discovery>
	<entry>2009-05-16</entry>
	<modified>2013-06-16</modified>
	</dates>
	</vuln>

	<vuln vid="6a245f31-4254-11de-b67a-0030843d3802">
	<topic>libwmf -- embedded GD library Use-After-Free vulnerability</topic>
	<affects>
	<package>
	<name>libwmf</name>
	<range><lt>0.2.8.4_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34901">
	<p>A vulnerability has been reported in libwmf, which can be exploited
	by malicious people to cause a DoS (Denial of Service) or compromise
	an application using the library.</p>
	<p>The vulnerability is caused due to a use-after-free error within the
	embedded GD library, which can be exploited to cause a crash or
	potentially to execute arbitrary code via a specially crafted WMF
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34792</bid>
	<cvename>CVE-2009-1364</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=496864</url>
	<url>https://rhn.redhat.com/errata/RHSA-2009-0457.html</url>
	<url>http://secunia.com/advisories/34901/</url>
	</references>
	<dates>
	<discovery>2009-05-05</discovery>
	<entry>2009-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="48aab1d0-4252-11de-b67a-0030843d3802">
	<topic>libwmf -- integer overflow vulnerability</topic>
	<affects>
	<package>
	<name>libwmf</name>
	<range><lt>0.2.8.4_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/20921">
	<p>infamous41md has reported a vulnerability in libwmf, which
	potentially can be exploited by malicious people to compromise an
	application using the vulnerable library.</p>
	<p>The vulnerability is caused due to an integer overflow error when
	allocating memory based on a value taken directly from a WMF file
	without performing any checks. This can be exploited to cause a
	heap-based buffer overflow when a specially crafted WMF file is
	processed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>18751</bid>
	<cvename>CVE-2006-3376</cvename>
	<url>http://secunia.com/advisories/20921/</url>
	</references>
	<dates>
	<discovery>2006-07-03</discovery>
	<entry>2009-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="bfe218a5-4218-11de-b67a-0030843d3802">
	<topic>moinmoin -- cross-site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.8.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34821/">
	<p>Input passed via multiple parameters to action/AttachFile.py is not
	properly sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a user's
	browser session in the context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1482</cvename>
	<url>http://secunia.com/advisories/34821/</url>
	<url>http://moinmo.in/SecurityFixes</url>
	</references>
	<dates>
	<discovery>2009-04-21</discovery>
	<entry>2009-05-16</entry>
	</dates>
	</vuln>

	<vuln vid="4a638895-41b7-11de-b1cc-00219b0fc4d8">
	<topic>mod_perl -- cross-site scripting</topic>
	<affects>
	<package>
	<name>mod_perl</name>
	<range><lt>1.31</lt></range>
	</package>
	<package>
	<name>mod_perl2</name>
	<range><lt>2.05</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/3459796">
	<p>Certain input passed to the "Apache::Status" and "Apache2::Status"
	modules is not properly sanitised before being returned to the user.
	This can be exploited to execute arbitrary HTML and script code in a
	user's browser session in context of an affected website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0796</cvename>
	<url>http://secunia.com/advisories/34597</url>
	</references>
	<dates>
	<discovery>2009-02-28</discovery>
	<entry>2009-05-16</entry>
	<modified>2009-05-16</modified>
	</dates>
	</vuln>

	<vuln vid="a6605f4b-4067-11de-b444-001372fd0af2">
	<topic>drupal -- cross-site scripting</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.18</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Security Team reports:</p>
	<blockquote cite="http://drupal.org/node/461886">
	<p>When outputting user-supplied data Drupal strips potentially
	dangerous HTML attributes and tags or escapes characters which
	have a special meaning in HTML. This output filtering secures the
	site against cross site scripting attacks via user input.</p>
	<p>Certain byte sequences that are valid in the UTF-8 specification
	are potentially dangerous when interpreted as UTF-7. Internet
	Explorer 6 and 7 may decode these characters as UTF-7 if they
	appear before the <meta http-equiv="Content-Type" /> tag that
	specifies the page content as UTF-8, despite the fact that Drupal
	also sends a real HTTP header specifying the content as UTF-8.
	This enables attackers to execute cross site scripting attacks
	with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting
	contained an incomplete fix for the issue. HTML exports of books
	are still vulnerable, which means that anyone with edit
	permissions for pages in outlines is able to insert arbitrary HTML
	and script code in these exports.</p>
	<p>Additionally, the taxonomy module allows users with the
	'administer taxonomy' permission to inject arbitrary HTML and
	script code in the help text of any vocabulary.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/461886</url>
	<url>http://secunia.com/advisories/35045</url>
	</references>
	<dates>
	<discovery>2009-05-13</discovery>
	<entry>2009-05-14</entry>
	<modified>2009-05-16</modified>
	</dates>
	</vuln>

	<vuln vid="14ab174c-40ef-11de-9fd5-001bd3385381">
	<topic>cyrus-sasl -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>cyrus-sasl</name>
	<range><lt>2.1.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/238019">
	<p>The sasl_encode64() function converts a string into
	base64. The Cyrus SASL library contains buffer overflows
	that occur because of unsafe use of the sasl_encode64()
	function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0688</cvename>
	<url>http://www.kb.cert.org/vuls/id/238019</url>
	</references>
	<dates>
	<discovery>2009-04-08</discovery>
	<entry>2009-05-15</entry>
	</dates>
	</vuln>

	<vuln vid="fc4d0ae8-3fa3-11de-a3fd-0030843d3802">
	<topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33593/">
	<p>Some vulnerabilities have been reported in MoinMoin, which can be
	exploited by malicious people to conduct cross-site scripting attacks.</p>
	<p>Input passed to multiple parameters in action/AttachFile.py is not
	properly sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a user's
	browser session in the context of an affected site.</p>
	<p>Certain input passed to security/antispam.py is not properly
	sanitised before being returned to the user. This can be exploited to
	execute arbitrary HTML and script code in a user's browser session in
	the context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0260</cvename>
	<cvename>CVE-2009-0312</cvename>
	<url>http://moinmo.in/SecurityFixes</url>
	<url>http://secunia.com/advisories/33593</url>
	</references>
	<dates>
	<discovery>2009-01-21</discovery>
	<entry>2009-05-13</entry>
	</dates>
	</vuln>

	<vuln vid="f0f97b94-3f95-11de-a3fd-0030843d3802">
	<topic>ghostscript -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>ghostscript8</name>
	<name>ghostscript8-nox11</name>
	<range><lt>8.64</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/34340/discuss">
	<p>Ghostscript is prone to a remote buffer-overflow vulnerability
	because it fails to properly bounds-check user-supplied input before
	copying it into a finite-sized buffer.</p>
	<p>Exploiting this issue allows remote attackers to overwrite a
	sensitive memory buffer with arbitrary data, potentially allowing them
	to execute malicious machine code in the context of the affected
	application. This vulnerability may facilitate the compromise of
	affected computers.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34340</bid>
	<cvename>CVE-2008-6679</cvename>
	</references>
	<dates>
	<discovery>2009-02-03</discovery>
	<entry>2009-05-13</entry>
	</dates>
	</vuln>

	<vuln vid="4b172278-3f46-11de-becb-001cc0377035">
	<topic>pango -- integer overflow</topic>
	<affects>
	<package>
	<name>pango</name>
	<name>linux-pango</name>
	<name>linux-f8-pango</name>
	<name>linux-f10-pango</name>
	<range><lt>1.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oCERT reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2009-001.html">
	<p>Pango suffers from a multiplicative integer overflow which
	may lead to a potentially exploitable, heap overflow depending
	on the calling conditions.</p>
	<p>For example, this vulnerability is remotely reachable in Firefox
	by creating an overly large document.location value but only results
	in a process-terminating, allocation error (denial of service).</p>
	<p>The affected function is pango_glyph_string_set_size. An overflow
	check when doubling the size neglects the overflow possible on the
	subsequent allocation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34870</bid>
	<cvename>CVE-2009-1194</cvename>
	<url>http://secunia.com/advisories/35021/</url>
	</references>
	<dates>
	<discovery>2009-02-22</discovery>
	<entry>2009-05-13</entry>
	<modified>2009-10-01</modified>
	</dates>
	</vuln>

	<vuln vid="defce068-39aa-11de-a493-001b77d09812">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.0.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wireshark team reports:</p>
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-02.html">
	<p>Wireshark 1.0.7 fixes the following vulnerabilities:</p>
	<ul>
	<li>The PROFINET dissector was vulnerable to a format
	string overflow. (Bug 3382) Versions affected: 0.99.6 to
	1.0.6, CVE-2009-1210.</li>
	<li>The Check Point High-Availability Protocol (CPHAP)
	dissector could crash. (Bug 3269) Versions affected: 0.9.6
	to 1.0.6; CVE-2009-1268.</li>
	<li>Wireshark could crash while loading a Tektronix .rf5
	file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6,
	CVE-2009-1269.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34291</bid>
	<bid>34457</bid>
	<cvename>CVE-2009-1210</cvename>
	<cvename>CVE-2009-1268</cvename>
	<cvename>CVE-2009-1269</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2009-02.html</url>
	<url>http://secunia.com/advisories/34542</url>
	</references>
	<dates>
	<discovery>2009-04-06</discovery>
	<entry>2009-05-09</entry>
	<modified>2009-05-13</modified>
	</dates>
	</vuln>

	<vuln vid="736e55bc-39bb-11de-a493-001b77d09812">
	<topic>cups -- remote code execution and DNS rebinding</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>1.3.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo security team summarizes:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200904-20.xml">
	<p>The following issues were reported in CUPS:</p>
	<ul>
	<li>iDefense reported an integer overflow in the
	_cupsImageReadTIFF() function in the "imagetops" filter,
	leading to a heap-based buffer overflow (CVE-2009-0163).</li>
	<li>Aaron Siegel of Apple Product Security reported that the
	CUPS web interface does not verify the content of the "Host"
	HTTP header properly (CVE-2009-0164).</li>
	<li>Braden Thomas and Drew Yao of Apple Product Security
	reported that CUPS is vulnerable to CVE-2009-0146,
	CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and
	poppler.</li>
	</ul>
	<p>A remote attacker might send or entice a user to send a
	specially crafted print job to CUPS, possibly resulting in the
	execution of arbitrary code with the privileges of the
	configured CUPS user -- by default this is "lp", or a Denial
	of Service. Furthermore, the web interface could be used to
	conduct DNS rebinding attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34571</bid>
	<bid>34665</bid>
	<bid>34568</bid>
	<cvename>CVE-2009-0163</cvename>
	<cvename>CVE-2009-0164</cvename>
	<cvename>CVE-2009-0146</cvename>
	<cvename>CVE-2009-0147</cvename>
	<cvename>CVE-2009-0166</cvename>
	<url>http://www.cups.org/articles.php?L582</url>
	</references>
	<dates>
	<discovery>2009-05-05</discovery>
	<entry>2009-05-07</entry>
	<modified>2009-05-13</modified>
	</dates>
	</vuln>

	<vuln vid="fbc8413f-2f7a-11de-9a3f-001b77d09812">
	<topic>FreeBSD -- remotely exploitable crash in OpenSSL</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_10</lt></range>
	<range><ge>6.4</ge><lt>6.4_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_12</lt></range>
	<range><ge>7.1</ge><lt>7.1_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>The function ASN1_STRING_print_ex does not properly validate
	the lengths of BMPString or UniversalString objects before
	attempting to print them.</p>
	<h1>Impact</h1>
	<p>An application which attempts to print a BMPString or
	UniversalString which has an invalid length will crash as a
	result of OpenSSL accessing invalid memory locations. This
	could be used by an attacker to crash a remote application.</p>
	<h1>Workaround</h1>
	<p>No workaround is available, but applications which do not use
	the ASN1_STRING_print_ex function (either directly or indirectly)
	are not affected.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-09:08.openssl</freebsdsa>
	<cvename>CVE-2009-0590</cvename>
	</references>
	<dates>
	<discovery>2009-03-25</discovery>
	<entry>2009-05-07</entry>
	<modified>2009-05-13</modified>
	</dates>
	</vuln>

	<vuln vid="2748fdde-3a3c-11de-bbc5-00e0815b8da8">
	<topic>quagga -- Denial of Service</topic>
	<affects>
	<package>
	<name>quagga</name>
	<range><lt>0.99.11_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Security Team reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/503220">
	<p>It was discovered that Quagga, an IP routing daemon, could
	no longer process the Internet routing table due to broken
	handling of multiple 4-byte AS numbers in an AS path. If such
	a prefix is received, the BGP daemon crashes with an assert
	failure leading to a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34656</bid>
	<mlist msgid="Pine.LNX.4.64.0904301931590.24373@nacho.alt.net">http://lists.quagga.net/pipermail/quagga-dev/2009-April/006541.html</mlist>
	<cvename>CVE-2009-1572</cvename>
	</references>
	<dates>
	<discovery>2009-05-04</discovery>
	<entry>2009-05-06</entry>
	<modified>2009-05-07</modified>
	</dates>
	</vuln>

	<vuln vid="e3e30d99-58a8-4a3f-8059-a8b7cd59b881">
	<topic>openfire -- Openfire No Password Changes Security Bypass</topic>
	<affects>
	<package>
	<name>openfire</name>
	<range><lt>3.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34984/">
	<p>A vulnerability has been reported in Openfire which can
	be exploited by malicious users to bypass certain security
	restrictions. The vulnerability is caused due to Openfire
	not properly respecting the no password changes setting which
	can be exploited to change passwords by sending jabber:iq:auth
	passwd_change requests to the server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1596</cvename>
	<url>http://secunia.com/advisories/34984/</url>
	<url>http://www.igniterealtime.org/issues/browse/JM-1532</url>
	<url>http://www.igniterealtime.org/community/message/190288#190288</url>
	</references>
	<dates>
	<discovery>2009-05-04</discovery>
	<entry>2009-05-04</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="7a1ab8d4-35c1-11de-9672-0030843d3802">
	<topic>drupal -- cross site scripting</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.17</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Security Team reports:</p>
	<blockquote cite="http://drupal.org/node/449078">
	<p>When outputting user-supplied data Drupal strips potentially
	dangerous HTML attributes and tags or escapes characters which have a
	special meaning in HTML. This output filtering secures the site
	against cross site scripting attacks via user input.</p>
	<p>Certain byte sequences that are valid in the UTF-8 specification
	are potentially dangerous when interpreted as UTF-7. Internet Explorer
	6 and 7 may decode these characters as UTF-7 if they appear before the
	meta http-equiv="Content-Type" tag that specifies the page content
	as UTF-8, despite the fact that Drupal also sends a real HTTP header
	specifying the content as UTF-8. This behaviour enables malicious
	users to insert and execute Javascript in the context of the website
	if site visitors are allowed to post content.</p>
	<p>In addition, Drupal core also has a very limited information
	disclosure vulnerability under very specific conditions. If a user is
	tricked into visiting the site via a specially crafted URL and then
	submits a form (such as the search box) from that page, the
	information in their form submission may be directed to a third-party
	site determined by the URL and thus disclosed to the third party. The
	third party site may then execute a CSRF attack against the submitted
	form.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1575</cvename>
	<cvename>CVE-2009-1576</cvename>
	<url>http://drupal.org/node/449078</url>
	</references>
	<dates>
	<discovery>2009-04-30</discovery>
	<entry>2009-04-30</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="3b18e237-2f15-11de-9672-0030843d3802">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.20_7,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.9,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.9</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.17</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2009-22: Firefox allows Refresh header to redirect to
	javascript: URIs</p>
	<p>MFSA 2009-21: POST data sent to wrong site when saving web page
	with embedded frame</p>
	<p>MFSA 2009-20: Malicious search plugins can inject code into
	arbitrary sites</p>
	<p>MFSA 2009-19: Same-origin violations in XMLHttpRequest and
	XPCNativeWrapper.toString</p>
	<p>MFSA 2009-18: XSS hazard using third-party stylesheets and XBL
	bindings</p>
	<p>MFSA 2009-17: Same-origin violations when Adobe Flash loaded via
	view-source: scheme</p>
	<p>MFSA 2009-16: jar: scheme ignores the content-disposition: header
	on the inner URI</p>
	<p>MFSA 2009-15: URL spoofing with box drawing character</p>
	<p>MFSA 2009-14 Crashes with evidence of memory corruption
	(rv:1.9.0.9)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34656</bid>
	<cvename>CVE-2009-1303</cvename>
	<cvename>CVE-2009-1306</cvename>
	<cvename>CVE-2009-1307</cvename>
	<cvename>CVE-2009-1308</cvename>
	<cvename>CVE-2009-1309</cvename>
	<cvename>CVE-2009-1312</cvename>
	<cvename>CVE-2009-1311</cvename>
	<cvename>CVE-2009-1302</cvename>
	<cvename>CVE-2009-1304</cvename>
	<cvename>CVE-2009-1305</cvename>
	<cvename>CVE-2009-1310</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-22.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-21.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-20.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-19.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-18.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-17.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-16.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-15.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-14.html</url>
	</references>
	<dates>
	<discovery>2009-04-21</discovery>
	<entry>2009-04-22</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="50d233d9-374b-46ce-922d-4e6b3f777bef">
	<topic>poppler -- Poppler Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>poppler</name>
	<range><lt>0.10.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite=" http://secunia.com/advisories/34746/">
	<p>Some vulnerabilities have been reported in Poppler which can be
	exploited by malicious people to potentially compromise an
	application using the library.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/34746/</url>
	</references>
	<dates>
	<discovery>2009-04-17</discovery>
	<entry>2009-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="a21037d5-2c38-11de-ab3b-0017a4cccfc6">
	<topic>xpdf -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xpdf</name>
	<range><lt>3.02_11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://www.vupen.com/english/advisories/2009/1065">
	<p>Some vulnerabilities have been reported in Xpdf, which can be
	exploited by malicious people to potentially compromise a user's
	system.</p>
	<p>A boundary error exists when decoding JBIG2 symbol dictionary
	segments. This can be exploited to cause a heap-based buffer
	overflow and potentially execute arbitrary code.</p>
	<p>Multiple integer overflows in the JBIG2 decoder can be
	exploited to potentially execute arbitrary code.</p>
	<p>Multiple boundary errors in the JBIG2 decoder can be
	exploited to cause buffer overflows and potentially execute
	arbitrary code.</p>
	<p>Multiple errors in the JBIG2 decoder can be exploited can be
	exploited to free arbitrary memory and potentially execute arbitrary
	code.</p>
	<p>Multiple unspecified input validation errors in the JBIG2 decoder can
	be exploited to potentially execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0146</cvename>
	<cvename>CVE-2009-0147</cvename>
	<cvename>CVE-2009-0166</cvename>
	<cvename>CVE-2009-0799</cvename>
	<cvename>CVE-2009-0800</cvename>
	<cvename>CVE-2009-1179</cvename>
	<cvename>CVE-2009-1180</cvename>
	<cvename>CVE-2009-1181</cvename>
	<cvename>CVE-2009-1182</cvename>
	<cvename>CVE-2009-1183</cvename>
	<url>http://secunia.com/advisories/34291</url>
	<url>http://www.vupen.com/english/advisories/2009/1065</url>
	</references>
	<dates>
	<discovery>2009-04-16</discovery>
	<entry>2009-04-18</entry>
	<modified>2009-04-18</modified>
	</dates>
	</vuln>

	<vuln vid="20b4f284-2bfc-11de-bdeb-0030843d3802">
	<topic>freetype2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.3.9_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34723/">
	<p>Some vulnerabilities have been reported in FreeType, which can be
	exploited by malicious people to potentially compromise an application
	using the library.</p>
	<p>An integer overflow error within the "cff_charset_compute_cids()"
	function in cff/cffload.c can be exploited to potentially cause a
	heap-based buffer overflow via a specially crafted font.</p>
	<p>Multiple integer overflow errors within validation functions in
	sfnt/ttcmap.c can be exploited to bypass length validations and
	potentially cause buffer overflows via specially crafted fonts.</p>
	<p>An integer overflow error within the "ft_smooth_render_generic()"
	function in smooth/ftsmooth.c can be exploited to potentially cause a
	heap-based buffer overflow via a specially crafted font.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0946</cvename>
	<url>http://secunia.com/advisories/34723/</url>
	</references>
	<dates>
	<discovery>2009-04-16</discovery>
	<entry>2009-04-18</entry>
	</dates>
	</vuln>

	<vuln vid="cf91c1e4-2b6d-11de-931b-00e0815b8da8">
	<topic>ejabberd -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>ejabberd</name>
	<range><lt>2.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/34133">
	<p>The ejabberd application is prone to a cross-site scripting
	vulnerability.</p>
	<p>An attacker may leverage this issue to execute arbitrary script code
	in the browser of an unsuspecting user in the context of the affected
	site and to steal cookie-based authentication credentials.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34133</bid>
	<cvename>CVE-2009-0934</cvename>
	</references>
	<dates>
	<discovery>2009-03-16</discovery>
	<entry>2009-04-17</entry>
	</dates>
	</vuln>

	<vuln vid="872ae5be-29c0-11de-bdeb-0030843d3802">
	<topic>ziproxy -- multiple vulnerability</topic>
	<affects>
	<package>
	<name>ziproxy</name>
	<range><lt>2.7.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ziproxy Developers reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/MAPG-7N9GN8">
	<p>Multiple HTTP proxy implementations are prone to an
	information-disclosure vulnerability related to the interpretation of
	the 'Host' HTTP header. Specifically, this issue occurs when the proxy
	makes a forwarding decision based on the 'Host' HTTP header instead of
	the destination IP address.</p>
	<p>Attackers may exploit this issue to obtain sensitive information
	such as internal intranet webpages. Additional attacks may also be
	possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33858</bid>
	<cvename>CVE-2009-0804</cvename>
	<url>http://www.kb.cert.org/vuls/id/MAPG-7N9GN8</url>
	</references>
	<dates>
	<discovery>2009-02-23</discovery>
	<entry>2009-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="1a0e4cc6-29bf-11de-bdeb-0030843d3802">
	<topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.1.3.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin Team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php">
	<p>Setup script used to generate configuration can be fooled using a
	crafted POST request to include arbitrary PHP code in generated
	configuration file. Combined with ability to save files on server,
	this can allow unauthenticated users to execute arbitrary PHP code.
	This issue is on different parameters than PMASA-2009-3 and it was
	missed out of our radar because it was not existing in 2.11.x
	branch.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1285</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php</url>
	</references>
	<dates>
	<discovery>2009-04-14</discovery>
	<entry>2009-04-15</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="03d22656-2690-11de-8226-0030843d3802">
	<topic>drupal6-cck -- cross-site scripting</topic>
	<affects>
	<package>
	<name>drupal6-cck</name>
	<range><lt>2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal CCK plugin developer reports:</p>
	<blockquote cite="http://drupal.org/node/406520">
	<p>The Node reference and User reference sub-modules, which
	are part of the Content Construction Kit (CCK) project, lets
	administrators define node fields that are references to other
	nodes or to users. When displaying a node edit form, the
	titles of candidate referenced nodes or names of candidate
	referenced users are not properly filtered, allowing malicious
	users to inject arbitrary code on those pages. Such a cross
	site scripting (XSS) attack may lead to a malicious user
	gaining full administrative access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34172</bid>
	<cvename>CVE-2009-1069</cvename>
	<url>http://drupal.org/node/406520</url>
	</references>
	<dates>
	<discovery>2009-03-23</discovery>
	<entry>2009-04-11</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="0fe73a4a-1b18-11de-8226-0030843d3802">
	<topic>pivot-weblog -- file deletion vulnerability</topic>
	<affects>
	<package>
	<name>pivot-weblog</name>
	<range><lt>1.40.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34302">
	<p>A vulnerability has been discovered in Pivot, which can be
	exploited by malicious people to delete certain files.</p>
	<p>Input passed to the "refkey" parameter in
	extensions/bbclone_tools/count.php is not properly sanitised
	before being used to delete files. This can be exploited to
	delete files with the permissions of the web server via directory
	traversal sequences passed within the "refkey" parameter.</p>
	<p>NOTE: Users with the "Advanced" user level are able to include and
	execute uploaded PHP code via the "pivot_path" parameter in
	extensions/bbclone_tools/getkey.php when
	extensions/bbclone_tools/hr_conf.php can be deleted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>34160</bid>
	<url>http://secunia.com/advisories/34302/</url>
	</references>
	<dates>
	<discovery>2009-03-18</discovery>
	<entry>2009-03-27</entry>
	</dates>
	</vuln>

	<vuln vid="06f9174f-190f-11de-b2f0-001c2514716c">
	<topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
	<affects>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.5</lt></range>
	</package>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.1.3.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php">
	<p>Setup script used to generate configuration can be fooled
	using a crafted POST request to include arbitrary PHP code
	in generated configuration file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-1151</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php</url>
	</references>
	<dates>
	<discovery>2009-03-24</discovery>
	<entry>2009-03-25</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="6bb6188c-17b2-11de-ae4d-0030843d3802">
	<topic>amarok -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>amarok</name>
	<range><lt>1.4.10_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33505">
	<p>Tobias Klein has reported some vulnerabilities in Amarok, which
	potentially can be exploited by malicious people to compromise a
	user's system.</p>
	<p>Two integer overflow errors exist within the
	"Audible::Tag::readTag()" function in
	src/metadata/audible/audibletag.cpp. These can be exploited to cause
	heap-based buffer overflows via specially crafted Audible Audio
	files.</p>
	<p>Two errors within the "Audible::Tag::readTag()" function in
	src/metadata/audible/audibletag.cpp can be exploited to corrupt
	arbitrary memory via specially crafted Audible Audio files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33210</bid>
	<cvename>CVE-2009-0135</cvename>
	<cvename>CVE-2009-0136</cvename>
	<url>http://www.debian.org/security/2009/dsa-1706</url>
	<url>http://secunia.com/advisories/33505</url>
	</references>
	<dates>
	<discovery>2009-01-12</discovery>
	<entry>2009-03-23</entry>
	</dates>
	</vuln>

	<vuln vid="f6f19735-9245-4918-8a60-87948ebb4907">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vendor reports:</p>
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-01.html">
	<p>On non-Windows systems Wireshark could crash if the HOME
	environment variable contained sprintf-style string formatting
	characters. Wireshark could crash while reading a malformed
	NetScreen snoop file. Wireshark could crash while reading a
	Tektronix K12 text capture file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0599</cvename>
	<cvename>CVE-2009-0600</cvename>
	<cvename>CVE-2009-0601</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2009-01.html</url>
	</references>
	<dates>
	<discovery>2009-02-06</discovery>
	<entry>2009-03-22</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="72cba7b0-13cd-11de-a964-0030843d3802">
	<topic>netatalk -- arbitrary command execution in papd daemon</topic>
	<affects>
	<package>
	<name>netatalk</name>
	<range><lt>2.0.3_5,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33227/">
	<p>A vulnerability has been reported in Netatalk, which potentially
	can be exploited by malicious users to compromise a vulnerable system.</p>
	<p>The vulnerability is caused due to the papd daemon improperly
	sanitising several received parameters before passing them in a call
	to popen(). This can be exploited to execute arbitrary commands via
	a specially crafted printing request.</p>
	<p>Successful exploitation requires that a printer is configured to
	pass arbitrary values as parameters to a piped command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32925</bid>
	<cvename>CVE-2008-5718</cvename>
	<url>http://secunia.com/advisories/33227/</url>
	<url>http://www.openwall.com/lists/oss-security/2009/01/13/3</url>
	</references>
	<dates>
	<discovery>2008-12-19</discovery>
	<entry>2009-03-18</entry>
	<modified>2009-03-18</modified>
	</dates>
	</vuln>

	<vuln vid="37a365ed-1269-11de-a964-0030843d3802">
	<topic>gstreamer-plugins-good -- multiple memory overflows</topic>
	<affects>
	<package>
	<name>gstreamer-plugins-good</name>
	<range><ge>0.10.9,3</ge><lt>0.10.12,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33650/">
	<p>Tobias Klein has reported some vulnerabilities in GStreamer Good
	Plug-ins, which can potentially be exploited by malicious people to
	compromise a vulnerable system.</p>
	<p>A boundary error occurs within the "qtdemux_parse_samples()"
	function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts"
	Atom parsing. This can be exploited to cause a heap-based buffer
	overflow via a specially crafted QuickTime media file.</p>
	<p>An array indexing error exists in the "qtdemux_parse_samples()"
	function in gst/gtdemux/qtdemux.c when performing QuickTime "stss"
	Atom parsing. This can be exploited to corrupt memory via a specially
	crafted QuickTime media file.</p>
	<p>A boundary error occurs within the "qtdemux_parse_samples()"
	function in gst/gtdemux/qtdemux.c when performing QuickTime "stts"
	Atom parsing. This can be exploited to cause a heap-based buffer
	overflow via a specially crafted QuickTime media file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0386</cvename>
	<cvename>CVE-2009-0387</cvename>
	<cvename>CVE-2009-0397</cvename>
	<url>http://secunia.com/advisories/33650/</url>
	<url>http://trapkit.de/advisories/TKADV2009-003.txt</url>
	<url>http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html</url>
	</references>
	<dates>
	<discovery>2009-01-22</discovery>
	<entry>2009-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="c5af0747-1262-11de-a964-0030843d3802">
	<topic>libsndfile -- CAF processing integer overflow vulnerability</topic>
	<affects>
	<package>
	<name>libsndfile</name>
	<range><lt>1.0.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33980/">
	<p>The vulnerability is caused due to an integer overflow error in the
	processing of CAF description chunks. This can be exploited to cause a
	heap-based buffer overflow by tricking the user into processing a
	specially crafted CAF audio file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0186</cvename>
	<url>http://secunia.com/advisories/33980/</url>
	</references>
	<dates>
	<discovery>2009-03-03</discovery>
	<entry>2009-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="6733e1bf-125f-11de-a964-0030843d3802">
	<topic>ffmpeg -- 4xm processing memory corruption vulnerability</topic>
	<affects>
	<package>
	<name>ffmpeg</name>
	<range><lt>2008.07.27_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33711/">
	<p>Tobias Klein has reported a vulnerability in FFmpeg, which
	potentially can be exploited by malicious people to compromise an
	application using the library.</p>
	<p>The vulnerability is caused due to a signedness error within the
	"fourxm_read_header()" function in libavformat/4xm.c. This can be
	exploited to corrupt arbitrary memory via a specially crafted 4xm
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33502</bid>
	<cvename>CVE-2009-0385</cvename>
	<url>http://secunia.com/advisories/33711/</url>
	<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
	</references>
	<dates>
	<discovery>2009-01-28</discovery>
	<entry>2009-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="35c0b572-125a-11de-a964-0030843d3802">
	<topic>roundcube -- webmail script insertion and php code injection</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>0.2.1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33622/">
	<p>Some vulnerabilities have been reported in RoundCube Webmail, which
	can be exploited by malicious users to compromise a vulnerable system
	and by malicious people to conduct script insertion attacks and
	compromise a vulnerable system.</p>
	<p>The HTML "background" attribute within e.g. HTML emails is not
	properly sanitised before being used. This can be exploited to execute
	arbitrary HTML and script code in a user's browser session in context
	of an affected site if a malicious email is viewed.</p>
	<p>Input passed via a vCard is not properly sanitised before being
	used in a call to "preg_replace()" with the "e" modifier in
	program/include/rcube_vcard.php. This can be exploited to inject and
	execute arbitrary PHP code by e.g. tricking a user into importing a
	malicious vCard file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0413</cvename>
	<url>http://secunia.com/advisories/33622/</url>
	<url>http://sourceforge.net/forum/forum.php?forum_id=927958</url>
	<url>http://trac.roundcube.net/changeset/2245</url>
	<url>http://trac.roundcube.net/ticket/1485689</url>
	</references>
	<dates>
	<discovery>2009-01-21</discovery>
	<entry>2009-03-16</entry>
	<modified>2009-03-26</modified>
	</dates>
	</vuln>

	<vuln vid="ca0841ff-1254-11de-a964-0030843d3802">
	<topic>proftpd -- multiple sql injection vulnerabilities</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.2</lt></range>
	</package>
	<package>
	<name>proftpd-devel</name>
	<range><le>1.3.20080922</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33842/">
	<p>Some vulnerabilities have been reported in ProFTPD, which can be
	exploited by malicious people to conduct SQL injection attacks.</p>
	<p>The application improperly sets the character encoding prior to
	performing SQL queries. This can be exploited to manipulate SQL
	queries by injecting arbitrary SQL code in an environment using a
	multi-byte character encoding.</p>
	<p>An error exists in the "mod_sql" module when processing e.g. user
	names containing '%' characters. This can be exploited to bypass input
	sanitation routines and manipulate SQL queries by injecting arbitrary
	SQL code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0542</cvename>
	<cvename>CVE-2009-0543</cvename>
	<url>http://secunia.com/advisories/33842/</url>
	<url>http://bugs.proftpd.org/show_bug.cgi?id=3173</url>
	<url>http://bugs.proftpd.org/show_bug.cgi?id=3124</url>
	<url>http://milw0rm.com/exploits/8037</url>
	</references>
	<dates>
	<discovery>2009-02-06</discovery>
	<entry>2009-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="03140526-1250-11de-a964-0030843d3802">
	<topic>zabbix -- php frontend multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>zabbix</name>
	<range><lt>1.6.2_1,1</lt></range>
	</package>
	<package>
	<name>zabbix-agent</name>
	<range><lt>1.6.2_1,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34091/">
	<p>Some vulnerabilities have been reported in the ZABBIX PHP frontend,
	which can be exploited by malicious people to conduct cross-site
	request forgery attacks and malicious users to disclose sensitive
	information and compromise a vulnerable system.</p>
	<p>Input appended to and passed via the "extlang" parameter to the
	"calc_exp2()" function in include/validate.inc.php is not properly
	sanitised before being used. This can be exploited to inject and
	execute arbitrary PHP code.</p>
	<p>The application allows users to perform certain actions via HTTP
	requests without performing any validity checks to verify the
	requests. This can be exploited to e.g. create users by enticing a
	logged in administrator to visit a malicious web page.</p>
	<p>Input passed to the "srclang" parameter in locales.php (when "next"
	is set to a non-NULL value) is not properly verified before being used
	to include files. This can be exploited to include arbitrary files
	from local resources via directory traversal attacks and URL-encoded
	NULL bytes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/34091/</url>
	<url>http://www.ush.it/team/ush/hack-zabbix_162/adv.txt</url>
	</references>
	<dates>
	<discovery>2009-03-04</discovery>
	<entry>2009-03-16</entry>
	<modified>2009-03-23</modified>
	</dates>
	</vuln>

	<vuln vid="a2074ac6-124c-11de-a964-0030843d3802">
	<topic>php-mbstring -- php mbstring buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>php4-mbstring</name>
	<range><lt>4.4.9</lt></range>
	</package>
	<package>
	<name>php5-mbstring</name>
	<range><lt>5.2.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/32948">
	<p>PHP is prone to a buffer-overflow vulnerability because it fails to
	perform boundary checks before copying user-supplied data to
	insufficiently sized memory buffers. The issue affects the 'mbstring'
	extension included in the standard distribution.</p>
	<p>An attacker can exploit this issue to execute arbitrary machine
	code in the context of the affected webserver. Failed exploit attempts
	will likely crash the webserver, denying service to legitimate
	users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32948</bid>
	<cvename>CVE-2008-5557</cvename>
	</references>
	<dates>
	<discovery>2008-12-21</discovery>
	<entry>2009-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="4ce3c20b-124b-11de-a964-0030843d3802">
	<topic>phppgadmin -- directory traversal with register_globals enabled</topic>
	<affects>
	<package>
	<name>phppgadmin</name>
	<range><lt>4.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33014">
	<p>Dun has discovered a vulnerability in phpPgAdmin, which can be
	exploited by malicious people to disclose sensitive information.</p>
	<p>Input passed via the "_language" parameter to libraries/lib.inc.php
	is not properly sanitised before being used to include files. This can
	be exploited to include arbitrary files from local resources via
	directory traversal attacks and URL-encoded NULL bytes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32670</bid>
	<cvename>CVE-2008-5587</cvename>
	<url>http://secunia.com/advisories/33014</url>
	</references>
	<dates>
	<discovery>2008-12-08</discovery>
	<entry>2009-03-16</entry>
	</dates>
	</vuln>

	<vuln vid="8c5205b4-11a0-11de-a964-0030843d3802">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.64</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Team reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/964/">
	<p>An unspecified error in the processing of JPEG images can be
	exploited to trigger a memory corruption.</p>
	<p>An error can be exploited to execute arbitrary script code in a
	different domain via unspecified plugins.</p>
	<p>An unspecified error has a "moderately severe" impact. No further
	information is available.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0914</cvename>
	<cvename>CVE-2009-0915</cvename>
	<url>http://www.opera.com/docs/changelogs/freebsd/964/</url>
	<url>http://secunia.com/advisories/34135/</url>
	</references>
	<dates>
	<discovery>2009-03-15</discovery>
	<entry>2009-03-15</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="e848a92f-0e7d-11de-92de-000bcdc1757a">
	<topic>epiphany -- untrusted search path vulnerability</topic>
	<affects>
	<package>
	<name>epiphany</name>
	<range><lt>2.24.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5985">
	<p>Untrusted search path vulnerability in the Python interface in
	Epiphany 2.22.3, and possibly other versions, allows local users to
	execute arbitrary code via a Trojan horse Python file in the current
	working directory, related to a vulnerability in the PySys_SetArgv
	function (CVE-2008-5983).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5985</cvename>
	<cvename>CVE-2008-5983</cvename>
	</references>
	<dates>
	<discovery>2009-01-26</discovery>
	<entry>2009-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="f1892066-0e74-11de-92de-000bcdc1757a">
	<topic>apache -- Cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.9_2</lt></range>
	<range><gt>2.0.0</gt><lt>2.0.63_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939">
	<p>Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the
	mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c
	in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions,
	allows remote attackers to inject arbitrary web script or HTML via a
	wildcard in the last directory component in the pathname in an FTP
	URI.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2939</cvename>
	<url>http://www.rapid7.com/advisories/R7-0033.jsp</url>
	</references>
	<dates>
	<discovery>2008-07-25</discovery>
	<entry>2009-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="ea2411a4-08e8-11de-b88a-0022157515b2">
	<topic>pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability</topic>
	<affects>
	<package>
	<name>pngcrush</name>
	<range><lt>1.6.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33976/">
	<p>A vulnerability has been reported in Pngcrush, which
	can be exploited by malicious people to potentially
	compromise a user's system.</p>
	<p>The vulnerability is caused due to the use of vulnerable
	libpng code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33827</bid>
	<cvename>CVE-2009-0040</cvename>
	<url>http://secunia.com/advisories/33976</url>
	<url>http://xforce.iss.net/xforce/xfdb/48819</url>
	</references>
	<dates>
	<discovery>2009-02-19</discovery>
	<entry>2009-03-04</entry>
	</dates>
	</vuln>

	<vuln vid="5d433534-f41c-402e-ade5-e0a2259a7cb6">
	<topic>curl -- cURL/libcURL Location: Redirect URLs Security Bypass</topic>
	<affects>
	<package>
	<name>curl</name>
	<range><ge>5.11</ge><lt>7.19.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/34138/">
	<p>The security issue is caused due to cURL following HTTP Location:
	redirects to e.g. scp:// or file:// URLs which can be exploited
	by a malicious HTTP server to overwrite or disclose the content of
	arbitrary local files and potentially execute arbitrary commands via
	specially crafted redirect URLs.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0037</cvename>
	<url>http://secunia.com/advisories/34138/</url>
	</references>
	<dates>
	<discovery>2009-03-03</discovery>
	<entry>2009-03-04</entry>
	</dates>
	</vuln>

	<vuln vid="cf495fd4-fdcd-11dd-9a86-0050568452ac">
	<topic>Zend Framework -- Local File Inclusion vulnerability in Zend_View::render()</topic>
	<affects>
	<package>
	<name>ZendFramework</name>
	<range><lt>1.7.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthew Weier O'Phinney reports:</p>
	<blockquote cite="http://weierophinney.net/matthew/archives/206-Zend-Framework-1.7.5-Released-Important-Note-Regarding-Zend_View.html">
	<p>A potential Local File Inclusion (LFI) vulnerability exists in
	the Zend_View::render() method. If user input is used to
	specify the script path, then it is possible to trigger the
	LFI.</p>
	<p>Note that Zend Framework applications that never call the
	Zend_View::render() method with a user-supplied parameter are
	not affected by this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://framework.zend.com/issues/browse/ZF-5748</url>
	</references>
	<dates>
	<discovery>2009-02-11</discovery>
	<entry>2009-02-18</entry>
	</dates>
	</vuln>

	<vuln vid="25eb365c-fd11-11dd-8424-c213de35965d">
	<topic>dia -- remote command execution vulnerability</topic>
	<affects>
	<package>
	<name>dia</name>
	<range><lt>0.96.1_6,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Security Focus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33448/">
	<p>An attacker could exploit this issue by enticing an
	unsuspecting victim to execute the vulnerable
	application in a directory containing a malicious
	Python file. A successful exploit will allow arbitrary
	Python commands to run within the privileges of the currently
	logged-in user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33448</bid>
	<cvename>CVE-2008-5984</cvename>
	<url>http://secunia.com/advisories/33672</url>
	</references>
	<dates>
	<discovery>2009-01-26</discovery>
	<entry>2009-02-17</entry>
	</dates>
	</vuln>

	<vuln vid="5a021595-fba9-11dd-86f3-0030843d3802">
	<topic>pycrypto -- ARC2 module buffer overflow</topic>
	<affects>
	<package>
	<name>py-pycrypto</name>
	<range><lt>2.0.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dwayne C. Litzenberger reports:</p>
	<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html">
	<p>pycrypto is exposed to a buffer overflow issue because it fails to
	adequately verify user-supplied input. This issue resides in the ARC2
	module. This issue can be triggered with specially crafted ARC2 keys
	in excess of 128 bytes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html</url>
	</references>
	<dates>
	<discovery>2009-02-06</discovery>
	<entry>2009-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="bcee3989-d106-4f60-948f-835375634710">
	<topic>varnish -- Varnish HTTP Request Parsing Denial of Service</topic>
	<affects>
	<package>
	<name>varnish</name>
	<range><lt>2.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33712">
	<p>Varnish is prone to a remote denial-of-service
	vulnerability because the application fails to handle
	certain HTTP requests.</p>
	<p>Successfully exploiting this issue allows remote
	attackers to crash the affected application denying further
	service to legitimate users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33712</bid>
	<url>http://secunia.com/advisories/33852/</url>
	<url>http://varnish.projects.linpro.no/wiki/WikiStart</url>
	</references>
	<dates>
	<discovery>2008-10-17</discovery>
	<entry>2009-02-14</entry>
	<modified>2009-02-15</modified>
	</dates>
	</vuln>

	<vuln vid="78f5606b-f9d1-11dd-b79c-0030843d3802">
	<topic>tor -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.2.0.34</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.12-alpha</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33880/">
	<p>Some vulnerabilities have been reported in Tor, where one has an
	unknown impact and others can be exploited by malicious people to
	cause a DoS.</p>
	<p>An error when running Tor as a directory authority can be exploited
	to trigger the execution of an infinite loop.</p>
	<p>An unspecified error exists when running on Windows systems prior
	to Windows XP. No further information is currently available.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0936</cvename>
	<cvename>CVE-2009-0937</cvename>
	<cvename>CVE-2009-0938</cvename>
	<url>http://secunia.com/advisories/33880/</url>
	<url>http://archives.seul.org/or/announce/Feb-2009/msg00000.html</url>
	</references>
	<dates>
	<discovery>2009-02-10</discovery>
	<entry>2009-02-13</entry>
	<modified>2009-03-20</modified>
	</dates>
	</vuln>

	<vuln vid="8b491182-f842-11dd-94d9-0030843d3802">
	<topic>firefox -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.20_3,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.6,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.6</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.15</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.21</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
	<p>MFSA 2009-06: Directives to not cache pages ignored</p>
	<p>MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies</p>
	<p>MFSA 2009-04: Chrome privilege escalation via local .desktop
	files</p>
	<p>MFSA 2009-03: Local file stealing with SessionStore</p>
	<p>MFSA 2009-02: XSS using a chrome XBL method and window.eval</p>
	<p>MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0352</cvename>
	<cvename>CVE-2009-0353</cvename>
	<cvename>CVE-2009-0354</cvename>
	<cvename>CVE-2009-0355</cvename>
	<cvename>CVE-2009-0356</cvename>
	<cvename>CVE-2009-0357</cvename>
	<cvename>CVE-2009-0358</cvename>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-01.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-02.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-03.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-04.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-05.html</url>
	<url>http://www.mozilla.org/security/announce/2009/mfsa2009-06.html</url>
	<url>http://secunia.com/advisories/33799/</url>
	</references>
	<dates>
	<discovery>2009-02-04</discovery>
	<entry>2009-02-11</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="83574d5a-f828-11dd-9fdf-0050568452ac">
	<topic>codeigniter -- arbitrary script execution in the new Form Validation class</topic>
	<affects>
	<package>
	<name>codeigniter</name>
	<range><ge>1.7.0</ge><lt>1.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>znirkel reports:</p>
	<blockquote cite="http://secunia.com/advisories/33829/">
	<p>The eval() function in _reset_post_array crashes when posting
	certain data. By passing in carefully-crafted input data, the eval()
	function could also execute malicious PHP code.</p>
	<p>Note that CodeIgniter applications that either do not use the
	new Form Validation class or use the old Validation class are not
	affected by this vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://codeigniter.com/bug_tracker/bug/6068/</url>
	</references>
	<dates>
	<discovery>2008-11-28</discovery>
	<entry>2009-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="b07f3254-f83a-11dd-85a4-ea653f0746ab">
	<topic>pyblosxom -- atom flavor multiple XML injection vulnerabilities</topic>
	<affects>
	<package>
	<name>pyblosxom</name>
	<range><lt>1.5.r3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Security Focus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33676/">
	<p>PyBlosxom is prone to multiple XML-injection
	vulnerabilities because the application fails to
	properly sanitize user-supplied input before using it
	in dynamically generated content.</p>
	<p>Attacker-supplied XML and script code would run in the
	context of the affected browser, potentially allowing
	the attacker to steal cookie-based authentication credentials
	or to control how the site is rendered to the user. Other attacks
	are also possible.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33676</bid>
	</references>
	<dates>
	<discovery>2009-02-09</discovery>
	<entry>2009-02-11</entry>
	</dates>
	</vuln>

	<vuln vid="cc47fafe-f823-11dd-94d9-0030843d3802">
	<topic>typo3 -- cross-site scripting and information disclosure</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><lt>4.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33829/">
	<p>Some vulnerabilities have been reported in Typo3, which can be
	exploited by malicious people to conduct cross-site scripting attacks
	and disclose sensitive information.</p>
	<p>Input passed via unspecified fields to the backend user interface
	is not properly sanitised before being returned to the user. This can
	be exploited to execute arbitrary HTML and script code in a user's
	browser session in context of an affected site.</p>
	<p>An error in the "jumpUrl" mechanism can be exploited to read
	arbitrary files from local resources by disclosing a hash secret used
	to restrict file access.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0815</cvename>
	<cvename>CVE-2009-0816</cvename>
	<url>http://secunia.com/advisories/33829/</url>
	<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/</url>
	</references>
	<dates>
	<discovery>2009-02-10</discovery>
	<entry>2009-02-11</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="a89b76a7-f6bd-11dd-94d9-0030843d3802">
	<topic>amaya -- multiple buffer overflow vulnerabilities</topic>
	<affects>
	<package>
	<name>amaya</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32848/">
	<p>A boundary error when processing "div" HTML tags can be exploited
	to cause a stack-based buffer overflow via an overly long "id"
	parameter.</p>
	<p>A boundary error exists when processing overly long links. This can
	be exploited to cause a stack-based buffer overflow by tricking the
	user into e.g. editing a malicious link.</p>
	<p>A boundary error when processing e.g. a "bdo" HTML tag having an
	overly long "dir" attribute can be exploited to cause a stack-based
	buffer overflow.</p>
	<p>A boundary error when processing "input" HTML tags can be
	exploited to cause a stack-based buffer overflow via an overly long
	e.g. "type" attribute.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5282</cvename>
	<cvename>CVE-2009-0323</cvename>
	<url>http://secunia.com/advisories/32848/</url>
	<url>http://www.bmgsec.com.au/advisory/41/</url>
	<url>http://www.bmgsec.com.au/advisory/40/</url>
	<url>http://milw0rm.com/exploits/7467</url>
	<url>http://www.coresecurity.com/content/amaya-buffer-overflows</url>
	</references>
	<dates>
	<discovery>2008-11-25</discovery>
	<entry>2009-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="71597e3e-f6b8-11dd-94d9-0030843d3802">
	<topic>websvn -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>websvn</name>
	<range><lt>2.1.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32338/">
	<p>Some vulnerabilities have been reported in WebSVN, which can be
	exploited by malicious users to disclose sensitive information, and by
	malicious people to conduct cross-site scripting attacks and
	manipulate data.</p>
	<p>Input passed in the URL to index.php is not properly sanitised
	before being returned to the user. This can be exploited to execute
	arbitrary HTML and script code in a user's browser session in context
	of an affected site.</p>
	<p>Input passed to the "rev" parameter in rss.php is not properly
	sanitised before being used. This can be exploited to overwrite
	arbitrary files via directory traversal attacks.</p>
	<p>Access to restricted repositories is not properly enforced, which
	can be exploited to disclose potentially sensitive information by
	accessing the repository via "listing.php" and using the "compare with
	previous" and "show changed files" links.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5918</cvename>
	<cvename>CVE-2008-5919</cvename>
	<cvename>CVE-2009-0240</cvename>
	<url>http://secunia.com/advisories/32338/</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191</url>
	<url>http://www.gulftech.org/?node=research&article_id=00132-10202008</url>
	</references>
	<dates>
	<discovery>2008-10-23</discovery>
	<entry>2009-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="40774927-f6b4-11dd-94d9-0030843d3802">
	<topic>phplist -- local file inclusion vulnerability</topic>
	<affects>
	<package>
	<name>phplist</name>
	<range><lt>2.10.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33533/">
	<p>Input passed to the "_SERVER[ConfigFile]" parameter in
	admin/index.php is not properly verified before being used to include
	files. This can be exploited to include arbitrary files from local
	resources.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0422</cvename>
	<url>http://secunia.com/advisories/33533/</url>
	</references>
	<dates>
	<discovery>2009-01-15</discovery>
	<entry>2009-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="9c2460a4-f6b1-11dd-94d9-0030843d3802">
	<topic>squid -- remote denial of service vulnerability</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>2.7.1</ge><lt>2.7.6</lt></range>
	<range><ge>3.0.1</ge><lt>3.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid security advisory 2009:1 reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_1.txt">
	<p>Due to an internal error Squid is vulnerable to a denial
	of service attack when processing specially crafted requests.</p>
	<p>This problem allows any client to perform a denial of service
	attack on the Squid service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0478</cvename>
	<url>http://www.squid-cache.org/Advisories/SQUID-2009_1.txt</url>
	<url>http://secunia.com/advisories/33731/</url>
	</references>
	<dates>
	<discovery>2009-02-04</discovery>
	<entry>2009-02-09</entry>
	<modified>2009-02-10</modified>
	</dates>
	</vuln>

	<vuln vid="653606e9-f6ac-11dd-94d9-0030843d3802">
	<topic>typo3 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>typo3</name>
	<range><lt>4.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33617/">
	<p>Some vulnerabilities have been reported in Typo3, which can be
	exploited by malicious people to bypass certain security restrictions,
	conduct cross-site scripting and session fixation attacks, and
	compromise a vulnerable system.</p>
	<p>The "Install tool" system extension uses insufficiently random
	entropy sources to generate an encryption key, resulting in weak
	security.</p>
	<p>The authentication library does not properly invalidate supplied
	session tokens, which can be exploited to hijack a user's
	session.</p>
	<p>Certain unspecified input passed to the "Indexed Search Engine"
	system extension is not properly sanitised before being used to invoke
	commands. This can be exploited to inject and execute arbitrary shell
	commands.</p>
	<p>Input passed via the name and content of files to the "Indexed Search
	Engine" system extension is not properly sanitised before being returned
	to the user. This can be exploited to execute arbitrary HTML and script
	code in a user's browser session in context of an affected site.</p>
	<p>Certain unspecified input passed to the Workspace module is not
	properly sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a user's
	browser session in context of an affected site.</p>
	<p>Note: It is also reported that certain unspecified input passed to
	test scripts of the "ADOdb" system extension is not properly sanitised
	before being returned to the user. This can be exploited to execute
	arbitrary HTML and script code in a user's browser session in context
	of an affected website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0255</cvename>
	<cvename>CVE-2009-0256</cvename>
	<cvename>CVE-2009-0257</cvename>
	<cvename>CVE-2009-0258</cvename>
	<url>http://secunia.com/advisories/33617/</url>
	<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/</url>
	</references>
	<dates>
	<discovery>2009-02-07</discovery>
	<entry>2009-02-09</entry>
	<modified>2013-06-19</modified>
	</dates>
	</vuln>

	<vuln vid="13d6d997-f455-11dd-8516-001b77d09812">
	<topic>sudo -- certain authorized users could run commands as any user</topic>
	<affects>
	<package>
	<name>sudo</name>
	<range><ge>1.6.9</ge><lt>1.6.9.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd Miller reports:</p>
	<blockquote cite="http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html">
	<p>A bug was introduced in Sudo's group matching code in version
	1.6.9 when support for matching based on the supplemental group
	vector was added. This bug may allow certain users listed in
	the sudoers file to run a command as a different user than their
	access rule specifies.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33517</bid>
	<cvename>CVE-2009-0034</cvename>
	<mlist msgid="200902041802.n14I2llS024155@core.courtesan.com">http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html</mlist>
	</references>
	<dates>
	<discovery>2009-02-04</discovery>
	<entry>2009-02-06</entry>
	</dates>
	</vuln>

	<vuln vid="6d85dc62-f2bd-11dd-9f55-0030843d3802">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.15</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/node/358957">
	<p>The Content Translation module for Drupal 6.x enables users to make
	a translation of an existing item of content (a node). In that proces
	the existing node's content is copied into the new node's submission
	form.</p>
	<p>The module contains a flaw that allows a user with the 'translate
	content' permission to potentially bypass normal viewing access
	restrictions, for example allowing the user to see the content of
	unpublished nodes even if they do not have permission to view
	unpublished nodes.</p>
	<p>When user profile pictures are enabled, the default user profile
	validation function will be bypassed, possibly allowing invalid user
	names or e-mail addresses to be submitted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/358957</url>
	<url>http://secunia.com/advisories/33550/</url>
	<url>http://secunia.com/advisories/33500/</url>
	<url>http://secunia.com/advisories/33542/</url>
	</references>
	<dates>
	<discovery>2009-01-14</discovery>
	<entry>2009-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="4a99d61c-f23a-11dd-9f55-0030843d3802">
	<topic>perl -- Directory Permissions Race Condition</topic>
	<affects>
	<package>
	<name>perl</name>
	<range><ge>5.8.0</ge><lt>5.8.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/14531/">
	<p>Paul Szabo has reported a vulnerability in Perl File::Path::rmtree,
	which potentially can be exploited by malicious, local users to
	gain escalated privileges.</p>
	<p>The vulnerability is caused due to a race condition in the way
	File::Path::rmtree handles directory permissions when cleaning up
	directories. This can be exploited by replacing an existing sub
	directory in the directory tree with a symbolic link to an arbitrary
	file.</p>
	<p>Successful exploitation may allow changing permissions of arbitrary
	files, if root uses an application using the vulnerable code to delete
	files in a directory having a world-writable sub directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2005-0448</cvename>
	<url>http://www.ubuntulinux.org/usn/usn-94-1</url>
	<url>http://secunia.com/advisories/14531/</url>
	</references>
	<dates>
	<discovery>2005-03-09</discovery>
	<entry>2009-02-03</entry>
	</dates>
	</vuln>

	<vuln vid="6a523dba-eeab-11dd-ab4f-0030843d3802">
	<topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.8.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33593/">
	<p>Input passed to multiple parameters in action/AttachFile.py is not
	properly sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a user's
	browser session in the context of an affected site.</p>
	<p>Certain input passed to security/antispam.py is not properly
	sanitised before being returned to the user. This can be exploited to
	execute arbitrary HTML and script code in a user's browser session in
	the context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0260</cvename>
	<cvename>CVE-2009-0312</cvename>
	<url>http://secunia.com/advisories/33593/</url>
	<url>http://hg.moinmo.in/moin/1.8/file/c76d50dac855</url>
	<url>http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad</url>
	<url>http://moinmo.in/SecurityFixes#moin1.8.1</url>
	</references>
	<dates>
	<discovery>2009-01-21</discovery>
	<entry>2009-01-30</entry>
	</dates>
	</vuln>

	<vuln vid="b9077cc4-6d04-4bcb-a37a-9ceaebfdcc9e">
	<topic>ganglia -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>ganglia-monitor-core</name>
	<name>ganglia-monitor-webfrontend</name>
	<range><lt>3.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33506">
	<p>Spike Spiegel has discovered a vulnerability in Ganglia which
	can be exploited by malicious people to compromise a
	vulnerable system. The vulnerability is caused due to a
	boundary error within the process_path function in
	gmetad/server.c. This can be exploited to cause a stack-based
	buffer overflow by e.g. sending a specially crafted message to
	the gmetad service.</p>
	<p>The vulnerability is confirmed in version 3.1.1. Other
	versions may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0241</cvename>
	<url>http://secunia.com/advisories/33506</url>
	</references>
	<dates>
	<discovery>2009-01-26</discovery>
	<entry>2009-01-30</entry>
	<modified>2009-01-30</modified>
	</dates>
	</vuln>

	<vuln vid="100a9ed2-ee56-11dd-ab4f-0030843d3802">
	<topic>tor -- unspecified memory corruption vulnerability</topic>
	<affects>
	<package>
	<name>tor</name>
	<range><lt>0.2.0.33</lt></range>
	</package>
	<package>
	<name>tor-devel</name>
	<range><lt>0.2.1.11-alpha</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33635/">
	<p>A vulnerability with an unknown impact has been reported in Tor.</p>
	<p>The vulnerability is caused due to an unspecified error and can be
	exploited to trigger a heap corruption. No further information is
	currently available.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2009-0414</cvename>
	<url>http://secunia.com/advisories/33635/</url>
	<url>http://archives.seul.org/or/announce/Jan-2009/msg00000.html</url>
	</references>
	<dates>
	<discovery>2009-01-22</discovery>
	<entry>2009-01-29</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="2ffb1b0d-ecf5-11dd-abae-00219b0fc4d8">
	<topic>glpi -- SQL Injection</topic>
	<affects>
	<package>
	<name>glpi</name>
	<range><lt>0.71.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GLPI project reports:</p>
	<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en">
	<p>Input passed via unspecified parameters is not properly sanitised
	before being used in SQL queries. This can be exploited to
	manipulateSQL queries by injecting arbitrary SQL code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en</url>
	<url>https://mail.gna.org/public/glpi-news/2009-01/msg00002.html</url>
	<url>https://dev.indepnet.net/glpi/ticket/1224</url>
	<url>http://secunia.com/advisories/33680/</url>
	</references>
	<dates>
	<discovery>2009-01-25</discovery>
	<entry>2009-01-28</entry>
	</dates>
	</vuln>

	<vuln vid="c3aba586-ea77-11dd-9d1e-000bcdc1757a">
	<topic>openfire -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openfire</name>
	<range><lt>3.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Core Security Technologies reports:</p>
	<blockquote cite="http://www.coresecurity.com/content/openfire-multiple-vulnerabilities">
	<p>Multiple cross-site scripting vulnerabilities have been found
	which may lead to arbitrary remote code execution on the server
	running the application due to unauthorized upload of Java plugin
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32935</bid>
	<bid>32937</bid>
	<bid>32938</bid>
	<bid>32939</bid>
	<bid>32940</bid>
	<bid>32943</bid>
	<bid>32944</bid>
	<bid>32945</bid>
	<cvename>CVE-2009-0496</cvename>
	<cvename>CVE-2009-0497</cvename>
	<url>http://www.coresecurity.com/content/openfire-multiple-vulnerabilities</url>
	</references>
	<dates>
	<discovery>2009-01-08</discovery>
	<entry>2009-01-25</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="abcacb5a-e7f1-11dd-afcd-00e0815b8da8">
	<topic>ipset-tools -- Denial of Service Vulnerabilities</topic>
	<affects>
	<package>
	<name>ipsec-tools</name>
	<range><lt>0.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/30657/discuss">
	<p>IPsec-Tools is affected by multiple remote denial-of-service
	vulnerabilities because the software fails to properly handle
	certain network packets.</p>
	<p>A successful attack allows a remote attacker to crash the
	software, denying further service to legitimate users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>30657</bid>
	<cvename>CVE-2008-3651</cvename>
	<cvename>CVE-2008-3652</cvename>
	<mlist msgid="20080724084529.GA3768@zen.inc">http://marc.info/?l=ipsec-tools-devel&m=121688914101709&w=2</mlist>
	</references>
	<dates>
	<discovery>2008-07-28</discovery>
	<entry>2009-01-21</entry>
	</dates>
	</vuln>

	<vuln vid="4b68d917-e705-11dd-afcd-00e0815b8da8">
	<topic>Teamspeak Server -- Directory Traversal Vulnerability</topic>
	<affects>
	<package>
	<name>teamspeak_server</name>
	<range><le>2.0.23.17</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33256">
	<p>TeamSpeak is prone to a directory-traversal vulnerability because
	it fails to sufficiently sanitize user-supplied input data.
	Exploiting the issue may allow an attacker to obtain sensitive
	information that could aid in further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33256</bid>
	<url>http://www.securityfocus.com/bid/33256</url>
	</references>
	<dates>
	<discovery>2009-01-14</discovery>
	<entry>2009-01-20</entry>
	</dates>
	</vuln>

	<vuln vid="2bc960c4-e665-11dd-afcd-00e0815b8da8">
	<topic>optipng -- arbitrary code execution via crafted BMP image</topic>
	<affects>
	<package>
	<name>optipng</name>
	<range><lt>0.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32651">
	<p>A vulnerability has been reported in OptiPNG, which
	potentially can be exploited by malicious people to compromise
	a user's system.</p>
	<p>The vulnerability is caused due to a boundary error in
	the BMP reader and can be exploited to cause a buffer
	overflow by tricking a user into processing a specially
	crafted file.</p>
	<p>Successful exploitation may allow execution of arbitrary
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5101</cvename>
	<url>http://secunia.com/advisories/32651</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399</url>
	<url>http://optipng.sourceforge.net/</url>
	</references>
	<dates>
	<discovery>2008-11-11</discovery>
	<entry>2009-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="ecad44b9-e663-11dd-afcd-00e0815b8da8">
	<topic>git -- gitweb privilege escalation</topic>
	<affects>
	<package>
	<name>git</name>
	<range><lt>1.6.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Git maintainers report:</p>
	<blockquote cite="http://marc.info/?l=git&m=122975564100860&w=2">
	<p>gitweb has a possible local privilege escalation
	bug that allows a malicious repository owner to run a command
	of his choice by specifying diff.external configuration
	variable in his repository and running a crafted gitweb
	query.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32967</bid>
	<mlist msgid="7vhc4z1gys.fsf@gitster.siamese.dyndns.org">http://marc.info/?l=git&m=122975564100860&w=2</mlist>
	<url>http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.6.0.6.txt</url>
	</references>
	<dates>
	<discovery>2008-12-20</discovery>
	<entry>2009-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="0809ce7d-f672-4924-9b3b-7c74bc279b83">
	<topic>gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>gtar</name>
	<range><lt>1.19</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/26445/">
	<p>GNUs tar and cpio utilities are prone to a denial-of-service
	vulnerability because of insecure use of the alloca()
	function.</p>
	<p>Successfully exploiting this issue allows attackers
	to crash the affected utilities and possibly to execute
	code but this has not been confirmed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26445</bid>
	<cvename>CVE-2007-4476</cvename>
	<url>http://www.securityfocus.com/bid/26445/</url>
	</references>
	<dates>
	<discovery>2007-11-14</discovery>
	<entry>2009-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="5ccb1c14-e357-11dd-a765-0030843d3802">
	<topic>mplayer -- vulnerability in STR files processor</topic>
	<affects>
	<package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30994">
	<p>The vulnerability is caused due to a boundary error within the
	"str_read_packet()" function in libavformat/psxstr.c. This can be
	exploited to cause a heap-based buffer overflow via a specially
	crafted STR file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3162</cvename>
	<bid>30157</bid>
	<url>http://secunia.com/advisories/30994</url>
	<url>https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311</url>
	</references>
	<dates>
	<discovery>2008-07-09</discovery>
	<entry>2009-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="bc6a7e79-e111-11dd-afcd-00e0815b8da8">
	<topic>cgiwrap -- XSS Vulnerability</topic>
	<affects>
	<package>
	<name>cgiwrap</name>
	<range><lt>4.0_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30765">
	<p>A vulnerability has been reported in CGIWrap, which can be
	exploited by malicious people to conduct cross-site scripting
	attacks.</p>
	<p>The vulnerability is caused due to the application generating
	error messages without specifying a charset. This can be exploited
	to execute arbitrary HTML and script code in a user's browser
	session in context of an affected site.</p>
	<p>Successful exploitation may require that the victim uses Internet
	Explorer or a browser based on Internet Explorer components.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2852</cvename>
	<url>http://secunia.com/advisories/30765</url>
	<url>http://cgiwrap.sourceforge.net/changes.html</url>
	</references>
	<dates>
	<discovery>2008-06-19</discovery>
	<entry>2009-01-13</entry>
	</dates>
	</vuln>

	<vuln vid="d4a358d3-e09a-11dd-a765-0030843d3802">
	<topic>nagios -- web interface privilege escalation vulnerability</topic>
	<affects>
	<package>
	<name>nagios</name>
	<range><lt>3.0.5</lt></range>
	</package>
	<package>
	<name>nagios2</name>
	<range><lt>2.12_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>securityfocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/32156/discuss">
	<p>An attacker with low-level privileges may exploit this issue to
	bypass authorization and cause arbitrary commands to run within the
	context of the Nagios server. This may aid in further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5027</cvename>
	<bid>32156</bid>
	<url>http://secunia.com/advisories/33320</url>
	<url>http://www.ubuntu.com/usn/USN-698-1</url>
	<url>http://www.nagios.org/development/history/nagios-3x.php</url>
	</references>
	<dates>
	<discovery>2008-11-06</discovery>
	<entry>2009-01-12</entry>
	<modified>2009-01-15</modified>
	</dates>
	</vuln>

	<vuln vid="a02c9595-e018-11dd-a765-0030843d3802">
	<topic>pdfjam -- insecure temporary files</topic>
	<affects>
	<package>
	<name>pdfjam</name>
	<range><lt>1.20_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/33278">
	<p>Some security issues have been reported in PDFjam, which can be
	exploited by malicious, local users to perform certain actions with
	escalated privileges.</p>
	<p>The security issues are caused due to the "pdf90", "pdfjoin", and
	"pdfnup" scripts using temporary files in an insecure manner. This can
	be exploited to overwrite arbitrary files via symlink attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5743</cvename>
	<url>https://bugzilla.novell.com/show_bug.cgi?id=459031</url>
	<url>http://secunia.com/advisories/33278</url>
	</references>
	<dates>
	<discovery>2008-12-05</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="58997463-e012-11dd-a765-0030843d3802">
	<topic>verlihub -- insecure temporary file usage and arbitrary command execution</topic>
	<affects>
	<package>
	<name>verlihub</name>
	<range><lt>0.9.8.d.r2_2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>securityfocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/32889/discuss">
	<p>An attacker with local access could potentially exploit this issue
	to perform symbolic-link attacks, overwriting arbitrary files in the
	context of the affected application.</p>
	<p>Successfully mounting a symlink attack may allow the attacker to
	delete or corrupt sensitive files, which may result in a denial of
	service. Other attacks may also be possible.</p>
	</blockquote>
	<blockquote cite="http://www.securityfocus.com/bid/32420/discuss">
	<p>Verlihub is prone to a remote command-execution vulnerability
	because it fails to sufficiently validate user input.</p>
	<p>Successfully exploiting this issue would allow an attacker to
	execute arbitrary commands on an affected computer in the context of
	the affected application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5705</cvename>
	<cvename>CVE-2008-5706</cvename>
	<bid>32889</bid>
	<bid>32420</bid>
	<url>http://milw0rm.com/exploits/7183</url>
	</references>
	<dates>
	<discovery>2008-11-22</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="66a770b4-e008-11dd-a765-0030843d3802">
	<topic>mysql -- empty bit-string literal denial of service</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>5.0</ge><lt>5.0.66</lt></range>
	<range><ge>5.1</ge><lt>5.1.26</lt></range>
	<range><ge>6.0</ge><lt>6.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MySQL reports:</p>
	<blockquote cite="http://bugs.mysql.com/bug.php?id=35658">
	<p>The vulnerability is caused due to an error when processing an
	empty bit-string literal and can be exploited to crash the server via
	a specially crafted SQL statement.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3963</cvename>
	<url>http://bugs.mysql.com/bug.php?id=35658</url>
	<url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html</url>
	<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html</url>
	<url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
	<url>http://secunia.com/advisories/31769</url>
	</references>
	<dates>
	<discovery>2008-09-11</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="8c451386-dff3-11dd-a765-0030843d3802">
	<topic>mysql -- privilege escalation and overwrite of the system table information</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.24</lt></range>
	<range><ge>5.0</ge><lt>5.0.51</lt></range>
	<range><ge>5.1</ge><lt>5.1.23</lt></range>
	<range><ge>6.0</ge><lt>6.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MySQL reports:</p>
	<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
	<p>Using RENAME TABLE against a table with explicit DATA
	DIRECTORY and INDEX DIRECTORY options can be used to overwrite
	system table information by replacing the symbolic link
	points. the file to which the symlink points.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5969</cvename>
	<bid>26765</bid>
	<url>http://bugs.mysql.com/bug.php?id=32111</url>
	</references>
	<dates>
	<discovery>2007-11-14</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="240ac24c-dff3-11dd-a765-0030843d3802">
	<topic>mysql -- remote dos via malformed password packet</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.24</lt></range>
	<range><ge>5.0</ge><lt>5.0.44</lt></range>
	<range><ge>5.1</ge><lt>5.1.20</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MySQL reports:</p>
	<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
	<p>A malformed password packet in the connection protocol
	could cause the server to crash.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3780</cvename>
	<bid>25017</bid>
	<url>http://bugs.mysql.com/bug.php?id=28984</url>
	</references>
	<dates>
	<discovery>2007-07-15</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="bb4e9a44-dff2-11dd-a765-0030843d3802">
	<topic>mysql -- renaming of arbitrary tables by authenticated users</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.23</lt></range>
	<range><ge>5.0</ge><lt>5.0.42</lt></range>
	<range><ge>5.1</ge><lt>5.1.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MySQL reports:</p>
	<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-23.html">
	<p>The requirement of the DROP privilege for RENAME TABLE was not
	enforced.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2691</cvename>
	<bid>24016</bid>
	<url>http://bugs.mysql.com/bug.php?id=27515</url>
	</references>
	<dates>
	<discovery>2007-05-14</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="69a20ce4-dfee-11dd-a765-0030843d3802">
	<topic>imap-uw -- imap c-client buffer overflow</topic>
	<affects>
	<package>
	<name>imap-uw</name>
	<range><lt>2007e</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SANS reports:</p>
	<blockquote cite="http://www.washington.edu/imap/documentation/RELNOTES.html">
	<p>The University of Washington IMAP library is a library implementing
	the IMAP mail protocol. University of Washington IMAP is exposed to a
	buffer overflow issue that occurs due to a boundary error within the
	rfc822_output_char function in the c-client library. The University of
	Washington IMAP library versions prior to 2007e are affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5514</cvename>
	<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
	</references>
	<dates>
	<discovery>2008-12-16</discovery>
	<entry>2009-01-11</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="a6713190-dfea-11dd-a765-0030843d3802">
	<topic>imap-uw -- local buffer overflow vulnerabilities</topic>
	<affects>
	<package>
	<name>imap-uw</name>
	<range><lt>2007d</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SANS reports:</p>
	<blockquote cite="http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22">
	<p>University of Washington "tmail" and "dmail" are mail deliver
	agents. "tmail" and "dmail" are exposed to local buffer overflow
	issues because they fail to perform adequate boundary checks on
	user-supplied data.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5514</cvename>
	<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
	<url>http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22</url>
	</references>
	<dates>
	<discovery>2008-10-29</discovery>
	<entry>2009-01-11</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="bd730827-dfe0-11dd-a765-0030843d3802">
	<topic>libcdaudio -- remote buffer overflow and code execution</topic>
	<affects>
	<package>
	<name>libcdaudio</name>
	<range><lt>0.99.12p2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>securityfocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/32122/discuss">
	<p>The 'libcdaudio' library is prone to a remote heap code in the
	context of an application that uses the library. Failed attacks will
	cause denial-of-service conditions.</p>
	</blockquote>
	<blockquote cite="http://www.securityfocus.com/bid/12770/discuss">
	<p>A buffer-overflow in Grip occurs when the software processes a
	response to a CDDB query that has more than 16 matches.</p>
	<p>To exploit this issue, an attacker must be able to influence the
	response to a CDDB query, either by controlling a malicious CDDB
	server or through some other means. Successful exploits will allow
	arbitrary code to run.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5030</cvename>
	<cvename>CVE-2005-0706</cvename>
	<bid>32122</bid>
	<bid>12770</bid>
	</references>
	<dates>
	<discovery>2008-11-05</discovery>
	<entry>2009-01-11</entry>
	</dates>
	</vuln>

	<vuln vid="c702944a-db0f-11dd-aa56-000bcdf0a03b">
	<topic>FreeBSD -- netgraph / bluetooth privilege escalation</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_7</lt></range>
	<range><ge>6.4</ge><lt>6.4_1</lt></range>
	<range><ge>7.0</ge><lt>7.0_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Some function pointers for netgraph and bluetooth sockets are
	not properly initialized.</p>
	<h1>Impact:</h1>
	<p>A local user can cause the FreeBSD kernel to execute
	arbitrary code. This could be used by an attacker directly;
	or it could be used to gain root privilege or to escape from
	a jail.</p>
	<h1>Workaround:</h1>
	<p>No workaround is available, but systems without local
	untrusted users are not vulnerable. Furthermore, systems are
	not vulnerable if they have neither the ng_socket nor
	ng_bluetooth kernel modules loaded or compiled into the
	kernel.</p>
	<p>Systems with the security.jail.socket_unixiproute_only
	sysctl set to 1 (the default) are only vulnerable if they have
	local untrusted users outside of jails.</p>
	<p>If the command</p>
	<p><code># kldstat -v \| grep ng_</code></p>
	<p>produces no output, the system is not vulnerable.</p>
	</body>
	</description>
	<references>
	<freebsdsa>SA-08:13.protosw</freebsdsa>
	</references>
	<dates>
	<discovery>2008-12-23</discovery>
	<entry>2009-01-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="e9ecaceb-db0d-11dd-aa56-000bcdf0a03b">
	<topic>FreeBSD -- Cross-site request forgery in ftpd(8)</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_7</lt></range>
	<range><ge>6.4</ge><lt>6.4_1</lt></range>
	<range><ge>7.0</ge><lt>7.0_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The ftpd(8) server splits long commands into several
	requests. This may result in the server executing a command
	which is hidden inside another very long command.</p>
	<h1>Impact:</h1>
	<p>This could, with a specifically crafted command, be used in a
	cross-site request forgery attack.</p>
	<p>FreeBSD systems running ftpd(8) server could act as a point
	of privilege escalation in an attack against users using web
	browser to access trusted FTP sites.</p>
	<h1>Workaround:</h1>
	<p>No workaround is available, but systems not running FTP
	servers are not vulnerable. Systems not running the FreeBSD
	ftp(8) server are not affected, but users of other ftp
	daemons are advised to take care since several other ftp
	daemons are known to have related bugs.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4247</cvename>
	<freebsdsa>SA-08:12.ftpd</freebsdsa>
	</references>
	<dates>
	<discovery>2008-12-23</discovery>
	<entry>2009-01-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="6b8cadce-db0b-11dd-aa56-000bcdf0a03b">
	<topic>FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_5</lt></range>
	<range><ge>7.0</ge><lt>7.0_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>IPv6 routers may allow "on-link" IPv6 nodes to create and
	update the router's neighbor cache and forwarding
	information. A malicious IPv6 node sharing a common router
	but on a different physical segment from another node may be
	able to spoof Neighbor Discovery messages, allowing it to
	update router information for the victim node.</p>
	<h1>Impact:</h1>
	<p>An attacker on a different physical network connected to the
	same IPv6 router as another node could redirect IPv6 traffic
	intended for that node. This could lead to denial of service
	or improper access to private network traffic.</p>
	<h1>Workaround:</h1>
	<p>Firewall packet filters can be used to filter incoming
	Neighbor Solicitation messages but may interfere with normal
	IPv6 operation if not configured carefully.</p>
	<p>Reverse path forwarding checks could be used to make
	gateways, such as routers or firewalls, drop Neighbor
	Solicitation messages from nodes with unexpected source
	addresses on a particular interface.</p>
	<p>IPv6 router administrators are encouraged to read RFC 3756
	for further discussion of Neighbor Discovery security
	implications.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2476</cvename>
	<freebsdsa>SA-08:10.nd6</freebsdsa>
	</references>
	<dates>
	<discovery>2008-10-01</discovery>
	<entry>2009-01-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="5796858d-db0b-11dd-aa56-000bcdf0a03b">
	<topic>FreeBSD -- arc4random(9) predictable sequence vulnerability</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_6</lt></range>
	<range><ge>7.0</ge><lt>7.0_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When the arc4random(9) random number generator is
	initialized, there may be inadequate entropy to meet the
	needs of kernel systems which rely on arc4random(9); and it
	may take up to 5 minutes before arc4random(9) is reseeded
	with secure entropy from the Yarrow random number generator.</p>
	<h1>Impact:</h1>
	<p>All security-related kernel subsystems that rely on a
	quality random number generator are subject to a wide range of
	possible attacks for the 300 seconds after boot or until 64k
	of random data is consumed. The list includes:</p>
	<p>* GEOM ELI providers with onetime keys. When a provider is
	configured in a way so that it gets attached at the same time
	during boot (e.g. it uses the rc subsystem to initialize) it
	might be possible for an attacker to recover the encrypted
	data.</p>
	<p>* GEOM shsec providers. The GEOM shsec subsytem is used to
	split a shared secret between two providers so that it can be
	recovered when both of them are present. This is done by
	writing the random sequence to one of providers while
	appending the result of the random sequence on the other host
	to the original data. If the provider was created within the
	first 300 seconds after booting, it might be possible for an
	attacker to extract the original data with access to only one
	of the two providers between which the secret data is split.</p>
	<p>* System processes started early after boot may receive
	predictable IDs.</p>
	<p>* The 802.11 network stack uses arc4random(9) to generate
	initial vectors (IV) for WEP encryption when operating in
	client mode and WEP authentication challenges when operating
	in hostap mode, which may be insecure.</p>
	<p>* The IPv4, IPv6 and TCP/UDP protocol implementations rely
	on a quality random number generator to produce unpredictable
	IP packet identifiers, initial TCP sequence numbers and
	outgoing port numbers. During the first 300 seconds after
	booting, it may be easier for an attacker to execute IP
	session hijacking, OS fingerprinting, idle scanning, or in
	some cases DNS cache poisoning and blind TCP data injection
	attacks.</p>
	<p>* The kernel RPC code uses arc4random(9) to retrieve
	transaction identifiers, which might make RPC clients
	vulnerable to hijacking attacks.</p>
	<h1>Workaround:</h1>
	<p>No workaround is available for affected systems.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5162</cvename>
	<freebsdsa>SA-08.11.arc4random</freebsdsa>
	</references>
	<dates>
	<discovery>2008-11-24</discovery>
	<entry>2009-01-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="d5e1aac8-db0b-11dd-ae30-001cc0377035">
	<topic>xterm -- DECRQSS remote command execution vulnerability</topic>
	<affects>
	<package>
	<name>xterm</name>
	<range><lt>238</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/33060/discuss">
	<p>The xterm program is prone to a remote command-execution
	vulnerability because it fails to sufficiently validate user
	input.</p>
	<p>Successfully exploiting this issue would allow an attacker
	to execute arbitrary commands on an affected computer in the
	context of the affected application.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33060</bid>
	<cvename>CVE-2008-2383</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030</url>
	</references>
	<dates>
	<discovery>2008-12-28</discovery>
	<entry>2009-01-05</entry>
	<modified>2009-01-06</modified>
	</dates>
	</vuln>

	<vuln vid="58a3c266-db01-11dd-ae30-001cc0377035">
	<topic>php5-gd -- uninitialized memory information disclosure vulnerability</topic>
	<affects>
	<package>
	<name>php5-gd</name>
	<range><le>5.2.8</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to CVE-2008-5498 entry:</p>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498">
	<p>Array index error in the "imageRotate" function in PHP 5.2.8 and
	earlier allows context-dependent attackers to read the contents
	of arbitrary memory locations via a crafted value of the third
	argument (aka the "bgd_color" or "clrBack" argument) for an indexed
	image.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>33002</bid>
	<cvename>CVE-2008-5498</cvename>
	<url>http://www.securiteam.com/unixfocus/6G00Y0ANFU.html</url>
	</references>
	<dates>
	<discovery>2008-12-24</discovery>
	<entry>2009-01-05</entry>
	<modified>2009-02-04</modified>
	</dates>
	</vuln>

	<vuln vid="27d78386-d35f-11dd-b800-001b77d09812">
	<topic>awstats -- multiple XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>awstats</name>
	<range><lt>6.9,1</lt></range>
	</package>
	<package>
	<name>awstats-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31519">
	<p>Morgan Todd has discovered a vulnerability in AWStats,
	which can be exploited by malicious people to conduct
	cross-site scripting attacks.</p>
	<p>Input passed in the URL to awstats.pl is not properly
	sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a
	user's browser session in context of an affected site.</p>
	<p>Successful exploitation requires that the application is
	running as a CGI script.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3714</cvename>
	<cvename>CVE-2008-5080</cvename>
	<url>http://secunia.com/advisories/31519</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432</url>
	</references>
	<dates>
	<discovery>2008-03-12</discovery>
	<entry>2009-01-04</entry>
	</dates>
	</vuln>

	<vuln vid="13b0c8c8-bee0-11dd-a708-001fc66e7203">
	<topic>p5-File-Path -- rmtree allows creation of setuid files</topic>
	<affects>
	<package>
	<name>p5-File-Path</name>
	<range><lt>2.07_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Lieskovsky reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2008/11/28/1">
	<p>perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to
	address this)</p>
	<p>This vulnerability was fixed in 5.8.4-7 but re-introduced
	in 5.8.8-1. It's also present in File::Path 2.xx, up to and
	including 2.07 which has only a partial fix.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2005-0448</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2008/11/28/1</mlist>
	<mlist>http://www.gossamer-threads.com/lists/perl/porters/233699#233699</mlist>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905</url>
	</references>
	<dates>
	<discovery>2008-11-28</discovery>
	<entry>2009-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="0e1e3789-d87f-11dd-8ecd-00163e000016">
	<topic>vim -- multiple vulnerabilities in the netrw module</topic>
	<affects>
	<package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim-gtk2</name>
	<name>vim-gnome</name>
	<range><ge>7.0</ge><lt>7.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Minar reports:</p>
	<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v2.html">
	<p>Applying the ``D'' to a file with a crafted file name,
	or inside a directory with a crafted directory name, can
	lead to arbitrary code execution.</p>
	</blockquote>
	<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v5.html">
	<p>Lack of sanitization throughout Netrw can lead to arbitrary
	code execution upon opening a directory with a crafted
	name.</p>
	</blockquote>
	<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html">
	<p>The Vim Netrw Plugin shares the FTP user name and password
	across all FTP sessions. Every time Vim makes a new FTP
	connection, it sends the user name and password of the
	previous FTP session to the FTP server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3076</cvename>
	<mlist>http://www.openwall.com/lists/oss-security/2008/10/16/2</mlist>
	<url>http://www.rdancer.org/vulnerablevim-netrw.html</url>
	<url>http://www.rdancer.org/vulnerablevim-netrw.v2.html</url>
	<url>http://www.rdancer.org/vulnerablevim-netrw.v5.html</url>
	<url>http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html</url>
	</references>
	<dates>
	<discovery>2008-10-16</discovery>
	<entry>2009-01-02</entry>
	</dates>
	</vuln>

	<vuln vid="214e8e07-d369-11dd-b800-001b77d09812">
	<topic>vinagre -- format string vulnerability</topic>
	<affects>
	<package>
	<name>vinagre</name>
	<range><lt>0.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CORE Security Technologies reports:</p>
	<blockquote cite="http://www.coresecurity.com/content/vinagre-format-string">
	<p>A format string error has been found on the
	vinagre_utils_show_error() function that can be exploited via
	commands issued from a malicious server containing format
	string specifiers on the VNC name.</p>
	<p>In a web based attack scenario, the user would be required
	to connect to a malicious server. Successful exploitation
	would then allow the attacker to execute arbitrary code with
	the privileges of the Vinagre user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32682</bid>
	<cvename>CVE-2008-5660</cvename>
	<url>http://www.coresecurity.com/content/vinagre-format-string</url>
	<url>http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.news</url>
	</references>
	<dates>
	<discovery>2008-12-09</discovery>
	<entry>2008-12-31</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="f98dea27-d687-11dd-abd1-0050568452ac">
	<topic>twiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>twiki</name>
	<range><lt>4.2.4,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:</p>
	<blockquote cite="http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlerts#Security_Alerts_of_TWiki_4_2_x_P">
	<p>XSS vulnerability with URLPARAM variable</p>
	<p>SEARCH variable allows arbitrary shell command execution</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32668</bid>
	<bid>32669</bid>
	<cvename>CVE-2008-5304</cvename>
	<cvename>CVE-2008-5305</cvename>
	<url>http://secunia.com/advisories/33040</url>
	<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304</url>
	<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305</url>
	<url>http://www.securitytracker.com/alerts/2008/Dec/1021351.html</url>
	<url>http://www.securitytracker.com/alerts/2008/Dec/1021352.html</url>
	<url>https://www.it-isac.org/postings/cyber/alertdetail.php?id=4513</url>
	<url>http://xforce.iss.net/xforce/xfdb/45293</url>
	</references>
	<dates>
	<discovery>2008-12-05</discovery>
	<entry>2008-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="8f483746-d45d-11dd-84ec-001fc66e7203">
	<topic>roundcube -- remote execution of arbitrary code</topic>
	<affects>
	<package>
	<name>roundcube</name>
	<range><lt>0.2.b2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Entry for CVE-2008-5619 says:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619">
	<p>html2text.php in RoundCube Webmail (roundcubemail)
	0.2-1.alpha and 0.2-3.beta allows remote attackers to execute
	arbitrary code via crafted input that is processed by the
	preg_replace function with the eval switch.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5619</cvename>
	<url>http://trac.roundcube.net/ticket/1485618</url>
	</references>
	<dates>
	<discovery>2008-12-12</discovery>
	<entry>2008-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="738f8f9e-d661-11dd-a765-0030843d3802">
	<topic>mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.25</lt></range>
	<range><ge>5.0</ge><lt>5.0.75</lt></range>
	<range><ge>5.1</ge><lt>5.1.28</lt></range>
	<range><ge>6.0</ge><lt>6.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MySQL Team reports:</p>
	<blockquote cite="http://bugs.mysql.com/bug.php?id=32167">
	<p>Additional corrections were made for the symlink-related privilege
	problem originally addressed. The original fix did not correctly
	handle the data directory pathname if it contained symlinked
	directories in its path, and the check was made only at
	table-creation time, not at table-opening time later.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2079</cvename>
	<cvename>CVE-2008-4097</cvename>
	<cvename>CVE-2008-4098</cvename>
	<url>http://bugs.mysql.com/bug.php?id=32167</url>
	<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-25.html</url>
	<url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-75.html</url>
	<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-28.html</url>
	<url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25</url>
	</references>
	<dates>
	<discovery>2008-07-03</discovery>
	<entry>2008-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="7c5bd5b8-d652-11dd-a765-0030843d3802">
	<topic>mplayer -- twinvq processing buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A trapkit reports:</p>
	<blockquote cite="http://trapkit.de/advisories/TKADV2008-014.txt">
	<p>MPlayer contains a stack buffer overflow vulnerability while
	parsing malformed TwinVQ media files. The vulnerability may be
	exploited by a (remote) attacker to execute arbitrary code in
	the context of MPlayer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5616</cvename>
	<url>http://secunia.com/advisories/33136/</url>
	<url>http://trapkit.de/advisories/TKADV2008-014.txt</url>
	</references>
	<dates>
	<discovery>2008-12-14</discovery>
	<entry>2008-12-30</entry>
	</dates>
	</vuln>

	<vuln vid="0ac68e68-d32b-11dd-b540-d1288664c17e">
	<topic>ampache -- insecure temporary file usage</topic>
	<affects>
	<package>
	<name>ampache</name>
	<range><lt>3.4.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31657">
	<p>A security issue has been reported in Ampache, which can be
	exploited by malicious, local users to perform certain actions
	with escalated privileges.</p>
	<p>The security issue is caused due to the "gather-messages.sh"
	script handling temporary files in an insecure manner.
	This can be exploited via symlink attacks to overwrite arbitrary
	files with the privileges of the user running the script.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>30875</bid>
	<cvename>CVE-2008-3929</cvename>
	<url>http://secunia.com/advisories/31657</url>
	</references>
	<dates>
	<discovery>2008-12-24</discovery>
	<entry>2008-12-26</entry>
	</dates>
	</vuln>

	<vuln vid="225bc349-ce10-11dd-a721-0030843d3802">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Opera Team reports:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/963/">
	<p>Manipulating certain text-area contents can cause a buffer
	overflow, which may be exploited to execute arbitrary code.</p>
	<p>Certain HTML constructs can cause the resulting DOM to change
	unexpectedly, which triggers a crash. To inject code, additional
	techniques will have to be employed.</p>
	<p>Exceptionally long host names in file: URLs can cause a buffer
	overflow, which may be exploited to execute arbitrary code. Remote Web
	pages cannot refer to file: URLs, so successful exploitation involves
	tricking users into manually opening the exploit URL, or a local file
	that refers to it.</p>
	<p>When Opera is previewing a news feed, some scripted URLs are not
	correctly blocked. These can execute scripts which are able to
	subscribe the user to any feed URL that the attacker chooses, and can
	also view the contents of any feeds that the user is subscribed to.
	These may contain sensitive information.</p>
	<p>Built-in XSLT templates incorrectly handle escaped content and can
	cause it to be treated as markup. If a site accepts content from
	untrusted users, which it then displays using XSLT as escaped strings,
	this can allow scripted markup to be injected. The scripts will then
	be executed in the security context of that site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5178</cvename>
	<url>http://www.opera.com/support/kb/view/920/</url>
	<url>http://www.opera.com/support/kb/view/921/</url>
	<url>http://www.opera.com/support/kb/view/922/</url>
	<url>http://www.opera.com/support/kb/view/923/</url>
	<url>http://www.opera.com/support/kb/view/924/</url>
	<url>http://secunia.com/advisories/32752/</url>
	</references>
	<dates>
	<discovery>2008-11-18</discovery>
	<entry>2008-12-19</entry>
	</dates>
	</vuln>

	<vuln vid="61b07d71-ce0e-11dd-a721-0030843d3802">
	<topic>mediawiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><gt>1.6.0</gt><lt>1.6.11</lt></range>
	<range><gt>1.12.0</gt><lt>1.12.3</lt></range>
	<range><gt>1.13.0</gt><lt>1.13.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MediaWiki development team reports:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html">
	<p>Certain unspecified input is not properly sanitised before being
	returned to the user. This can be exploited to execute arbitrary HTML
	and script code in a user's browser session in context of an affected
	site.</p>
	<p>Certain unspecified input related to uploads is not properly
	sanitised before being used. This can be exploited to inject arbitrary
	HTML and script code, which will be executed in a user's browser
	session in context of an affected site when a malicious data is
	opened. Successful exploitation may require that uploads are enabled
	and the victim uses an Internet Explorer based browser.</p>
	<p>Certain SVG scripts are not properly sanitised before being used.
	This can be exploited to inject arbitrary HTML and script code, which
	will be executed in a user's browser session in context of an affected
	site when a malicious data is opened. Successful exploitation may require
	that SVG uploads are enabled and the victim uses a browser supporting SVG
	scripting.</p>
	<p>The application allows users to perform certain actions via HTTP
	requests without performing any validity checks to verify the
	requests. This can be exploited to perform certain operations when a
	logged in user visits a malicious site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5249</cvename>
	<cvename>CVE-2008-5250</cvename>
	<cvename>CVE-2008-5252</cvename>
	<url>http://secunia.com/advisories/33133/</url>
	<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html</url>
	</references>
	<dates>
	<discovery>2008-12-15</discovery>
	<entry>2008-12-19</entry>
	</dates>
	</vuln>

	<vuln vid="609c790e-ce0a-11dd-a721-0030843d3802">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.14</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/345441">
	<p>The update system is vulnerable to Cross site request forgeries.
	Malicious users may cause the superuser (user 1) to execute old
	updates that may damage the database.</p>
	<p>When an input format is deleted, not all existing content on a site
	is updated to reflect this deletion. Such content is then displayed
	unfiltered. This may lead to cross site scripting attacks when harmful
	tags are no longer stripped from 'malicious' content that was posted
	earlier.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-6533</cvename>
	<url>http://drupal.org/node/345441</url>
	<url>http://secunia.com/advisories/33112/</url>
	</references>
	<dates>
	<discovery>2008-12-11</discovery>
	<entry>2008-12-19</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="29f5bfc5-ce04-11dd-a721-0030843d3802">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.20,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.20</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.14</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	<p>MFSA 2008-69 XSS vulnerabilities in SessionStore</p>
	<p>MFSA 2008-68 XSS and JavaScript privilege escalation</p>
	<p>MFSA 2008-67 Escaped null characters ignored by CSS parser</p>
	<p>MFSA 2008-66 Errors parsing URLs with leading whitespace and
	control characters</p>
	<p>MFSA 2008-65 Cross-domain data theft via script redirect error
	message</p>
	<p>MFSA 2008-64 XMLHttpRequest 302 response disclosure</p>
	<p>MFSA 2008-62 Additional XSS attack vectors in feed preview</p>
	<p>MFSA 2008-61 Information stealing via loadBindingDocument</p>
	<p>MFSA 2008-60 Crashes with evidence of memory corruption
	(rv:1.9.0.5/1.8.1.19)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5500</cvename>
	<cvename>CVE-2008-5501</cvename>
	<cvename>CVE-2008-5502</cvename>
	<cvename>CVE-2008-5503</cvename>
	<cvename>CVE-2008-5504</cvename>
	<cvename>CVE-2008-5505</cvename>
	<cvename>CVE-2008-5506</cvename>
	<cvename>CVE-2008-5507</cvename>
	<cvename>CVE-2008-5508</cvename>
	<cvename>CVE-2008-5510</cvename>
	<cvename>CVE-2008-5511</cvename>
	<cvename>CVE-2008-5512</cvename>
	<cvename>CVE-2008-5513</cvename>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-60.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-61.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-62.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-63.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-64.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-65.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-66.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-67.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-68.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-69.html</url>
	</references>
	<dates>
	<discovery>2008-12-17</discovery>
	<entry>2008-12-19</entry>
	</dates>
	</vuln>

	<vuln vid="54f72962-c7ba-11dd-a721-0030843d3802">
	<topic>phpmyadmin -- cross-site request forgery vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.4</lt></range>
	</package>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>3.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin Team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php">
	<p>A logged-in user can be subject of SQL injection through cross
	site request forgery. Several scripts in phpMyAdmin are
	vulnerable and the attack can be made through table parameter.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5621</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php</url>
	<url>http://www.milw0rm.com/exploits/7382</url>
	<url>http://secunia.com/advisories/33076/</url>
	</references>
	<dates>
	<discovery>2008-12-09</discovery>
	<entry>2008-12-11</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="1f9e2376-c52f-11dd-8cbc-00163e000016">
	<topic>php5 -- potential magic_quotes_gpc vulnerability</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP Developers reports:</p>
	<blockquote cite="http://www.php.net/archive/2008.php#id2008-12-07-1">
	<p>Due to a security bug found in the PHP 5.2.7 release, it has been
	removed from distribution. The bug affects configurations where
	magic_quotes_gpc is enabled, because it remains off even when set to
	on.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5844</cvename>
	<url>http://www.php.net/archive/2008.php#id2008-12-07-1</url>
	</references>
	<dates>
	<discovery>2008-12-07</discovery>
	<entry>2008-12-08</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="baece347-c489-11dd-a721-0030843d3802">
	<topic>wireshark -- SMTP Processing Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>1.0.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32840/">
	<p>A vulnerability has been reported in Wireshark, which can be
	exploited by malicious people to cause a DoS.</p>
	<p>The vulnerability is caused due to an error in the SMTP dissector
	and can be exploited to trigger the execution of an infinite loop via
	a large SMTP packet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5285</cvename>
	<url>http://secunia.com/advisories/32840/</url>
	<url>http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html</url>
	</references>
	<dates>
	<discovery>2008-11-24</discovery>
	<entry>2008-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="27d01223-c457-11dd-a721-0030843d3802">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32964/">
	<p>Some vulnerabilities have been reported in PHP, where some have an
	unknown impact and others can potentially be exploited by malicious
	people to cause a DoS (Denial of Service) or compromise a vulnerable
	system.</p>
	<p>An input validation error exists within the
	"ZipArchive::extractTo()" function when extracting ZIP archives.
	This can be exploited to extract files to arbitrary locations
	outside the specified directory via directory traversal sequences in
	a specially crafted ZIP archive.</p>
	<p>An error in the included PCRE library can be exploited to cause a
	buffer overflow.</p>
	<p>The problem is that the "BG(page_uid)" and "BG(page_gid)" variables
	are not initialized. No further information is currently
	available.</p>
	<p>The problem is that the "php_value" order is incorrect for Apache
	configurations. No further information is currently available.</p>
	<p>An error in the GD library can be exploited to cause a crash via a
	specially crafted font file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2371</cvename>
	<cvename>CVE-2008-2829</cvename>
	<cvename>CVE-2008-3658</cvename>
	<cvename>CVE-2008-3659</cvename>
	<cvename>CVE-2008-3660</cvename>
	<url>http://www.php.net/ChangeLog-5.php#5.2.7</url>
	<url>http://www.sektioneins.de/advisories/SE-2008-06.txt</url>
	<url>http://secunia.com/advisories/30916/</url>
	<url>http://secunia.com/advisories/31409/</url>
	<url>http://secunia.com/advisories/32964/</url>
	</references>
	<dates>
	<discovery>2008-12-04</discovery>
	<entry>2008-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="44ee8160-c453-11dd-a721-0030843d3802">
	<topic>mgetty+sendfax -- symlink attack via insecure temporary files</topic>
	<affects>
	<package>
	<name>mgetty+sendfax</name>
	<range><lt>1.1.35_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403">
	<p>Faxspool in mgetty 1.1.36 allows local users to overwrite
	arbitrary files via a symlink attack on a /tmp/faxsp.####
	temporary file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4936</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403</url>
	<url>https://bugs.gentoo.org/show_bug.cgi?id=235806</url>
	</references>
	<dates>
	<discovery>2008-08-24</discovery>
	<entry>2008-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="3efc106e-c451-11dd-a721-0030843d3802">
	<topic>dovecot-managesieve -- Script Name Directory Traversal Vulnerability</topic>
	<affects>
	<package>
	<name>dovecot-managesieve</name>
	<range><lt>0.10.4</lt></range>
	<range><ge>0.11.0</ge><lt>0.11.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/Advisories/32768/">
	<p>The security issue is caused due to an input validation error when
	processing script names. This can be exploited to read or modify
	arbitrary files having ".sieve" extensions via directory traversal
	attacks, with the privileges of the attacker's user id.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5301</cvename>
	<url>http://www.vupen.com/english/advisories/2008/3190</url>
	<url>http://secunia.com/Advisories/32768/</url>
	<url>http://dovecot.org/list/dovecot/2008-November/035259.html</url>
	</references>
	<dates>
	<discovery>2008-11-18</discovery>
	<entry>2008-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="578f6322-c450-11dd-a721-0030843d3802">
	<topic>habari -- Cross-Site Scripting Vulnerability</topic>
	<affects>
	<package>
	<name>habari</name>
	<range><lt>0.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32311/">
	<p>Input passed via the "habari_username" parameter when logging in is
	not properly sanitised before being returned to the user. This can
	be exploited to execute arbitrary HTML and script code in a user's
	browser session in context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4601</cvename>
	<url>http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt</url>
	<url>http://secunia.com/advisories/32311/</url>
	</references>
	<dates>
	<discovery>2008-10-17</discovery>
	<entry>2008-12-07</entry>
	</dates>
	</vuln>

	<vuln vid="acf80afa-c3ef-11dd-a721-0030843d3802">
	<topic>vlc -- arbitrary code execution in the RealMedia processor</topic>
	<affects>
	<package>
	<name>vlc-devel</name>
	<range><lt>0.9.8a</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tobias Klein from TrapKit reports:</p>
	<blockquote cite="http://www.trapkit.de/advisories/TKADV2008-013.txt">
	<p>The VLC media player contains an integer overflow vulnerability
	while parsing malformed RealMedia (.rm) files. The vulnerability
	leads to a heap overflow that can be exploited by a (remote)
	attacker to execute arbitrary code in the context of VLC media
	player.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32545</bid>
	<cvename>CVE-2008-5276</cvename>
	<url>http://www.trapkit.de/advisories/TKADV2008-013.txt</url>
	<url>http://www.videolan.org/security/sa0811.html</url>
	</references>
	<dates>
	<discovery>2008-11-30</discovery>
	<entry>2008-12-06</entry>
	<modified>2008-12-07</modified>
	</dates>
	</vuln>

	<vuln vid="af2745c0-c3e0-11dd-a721-0030843d3802">
	<topic>mantis -- php code execution vulnerability</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>1.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32314/">
	<p>EgiX has discovered a vulnerability in Mantis, which can be
	exploited by malicious users to compromise a vulnerable system.</p>
	<p>Input passed to the "sort" parameter in manage_proj_page.php is not
	properly sanitised before being used in a "create_function()" call.
	This can be exploited to execute arbitrary PHP code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4687</cvename>
	<url>http://secunia.com/advisories/32314/</url>
	</references>
	<dates>
	<discovery>2008-10-17</discovery>
	<entry>2008-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="29255141-c3df-11dd-a721-0030843d3802">
	<topic>mantis -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>1.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30270/">
	<p>Some vulnerabilities have been reported in Mantis, which can be
	exploited by malicious users to compromise a vulnerable system and
	malicious people to conduct cross-site scripting and request forgery
	attacks.</p>
	<p>Input passed to the "filter_target" parameter in
	return_dynamic_filters.php is not properly sanitised before being
	returned to a user. This can be exploited to execute arbitrary HTML
	and script code in a user's browser session in context of an affected
	site.</p>
	<p>A vulnerability is caused due to the application allowing users to
	perform certain actions via HTTP requests without performing any
	validity checks to verify the request. This can be exploited to e.g.
	add a new user with administrative privileges by enticing a logged-in
	administrator to visit a malicious site.</p>
	<p>Input passed to the "value" parameter in adm_config_set.php is not
	properly sanitised before being used in an "eval()" statement. This
	can be exploited to e.g. execute arbitrary PHP commands via a
	specially crafted request.</p>
	<p>Input passed to the "language" parameter in account_prefs_update.php
	is not properly verified before being used to include files. This
	can be exploited to include arbitrary files from local
	resources.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2276</cvename>
	<cvename>CVE-2008-3331</cvename>
	<cvename>CVE-2008-3332</cvename>
	<cvename>CVE-2008-3333</cvename>
	<url>http://secunia.com/advisories/30270/</url>
	</references>
	<dates>
	<discovery>2008-05-15</discovery>
	<entry>2008-12-06</entry>
	</dates>
	</vuln>

	<vuln vid="d1ce8a4f-c235-11dd-8cbc-00163e000016">
	<topic>squirrelmail -- Cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>squirrelmail</name>
	<range><lt>1.4.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squirrelmail team reports:</p>
	<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311">
	<p>An issue was fixed that allowed an attacker to send specially-
	crafted hyperlinks in a message that could execute cross-site
	scripting (XSS) when the user viewed the message in SquirrelMail.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2379</cvename>
	<url>http://secunia.com/Advisories/32143/</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311</url>
	</references>
	<dates>
	<discovery>2008-12-03</discovery>
	<entry>2008-12-04</entry>
	</dates>
	</vuln>

	<vuln vid="842bafdd-be2f-11dd-a578-0030843d3802">
	<topic>openoffice -- arbitrary code execution vulnerabilities</topic>
	<affects>
	<package>
	<name>openoffice.org-2</name>
	<name>openoffice.org-2-RC</name>
	<name>openoffice.org-2-devel</name>
	<range><ge>2.4</ge><lt>2.4.2</lt></range>
	<range><ge>2.4.20040402</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenOffice Team reports:</p>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2237.html">
	<p>A security vulnerability with the way OpenOffice 2.x process WMF
	files may allow a remote unprivileged user who provides a
	StarOffice/StarSuite document that is opened by a local user to
	execute arbitrary commands on the system with the privileges of the
	user running StarOffice/StarSuite. No working exploit is known right
	now.</p>
	</blockquote>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2238.html">
	<p>A security vulnerability with the way OpenOffice 2.x process EMF
	files may allow a remote unprivileged user who provides a
	StarOffice/StarSuite document that is opened by a local user to
	execute arbitrary commands on the system with the privileges of the
	user running StarOffice/StarSuite. No working exploit is known right
	now.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2237</cvename>
	<cvename>CVE-2008-2238</cvename>
	<url>http://www.openoffice.org/security/cves/CVE-2008-2237.html</url>
	<url>http://www.openoffice.org/security/cves/CVE-2008-2238.html</url>
	</references>
	<dates>
	<discovery>2008-10-29</discovery>
	<entry>2008-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="622bc638-be27-11dd-a578-0030843d3802">
	<topic>wordpress -- header rss feed script insertion vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>wordpress-mu</name>
	<range><lt>2.6.5</lt></range>
	</package>
	<package>
	<name>zh-wordpress</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32882/">
	<p>Input passed via the HTTP "Host" header is not properly sanitised
	before being used. This can be exploited to execute arbitrary HTML and
	script code in a user's browser session in context of an affected site
	if malicious data is viewed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5278</cvename>
	<url>http://secunia.com/advisories/32882/</url>
	<url>http://wordpress.org/development/2008/11/wordpress-265/</url>
	</references>
	<dates>
	<discovery>2008-11-26</discovery>
	<entry>2008-11-29</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="1583640d-be20-11dd-a578-0030843d3802">
	<topic>samba -- potential leakage of arbitrary memory contents</topic>
	<affects>
	<package>
	<name>samba</name>
	<name>samba3</name>
	<name>ja-samba</name>
	<range><ge>3.0.29,1</ge><lt>3.0.32_2,1</lt></range>
	</package>
	<package>
	<name>samba32-devel</name>
	<range><lt>3.2.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba Team reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2008-4314.html">
	<p>Samba 3.0.29 and beyond contain a change to deal with gcc 4
	optimizations. Part of the change modified range checking for
	client-generated offsets of secondary trans, trans2 and nttrans
	requests. These requests are used to transfer arbitrary amounts
	of memory from clients to servers and back using small SMB
	requests and contain two offsets: One offset (A) pointing into
	the PDU sent by the client and one (B) to direct the transferred
	contents into the buffer built on the server side. While the range
	checking for offset (B) is correct, a cut and paste error lets offset
	(A) pass completely unchecked against overflow.</p>
	<p>The buffers passed into trans, trans2 and nttrans undergo higher-level
	processing like DCE/RPC requests or listing directories. The missing
	bounds check means that a malicious client can make the server do this
	higher-level processing on arbitrary memory contents of the smbd process
	handling the request. It is unknown if that can be abused to pass arbitrary
	memory contents back to the client, but an important barrier is missing from
	the affected Samba versions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4314</cvename>
	<url>http://www.samba.org/samba/security/CVE-2008-4314.html</url>
	<url>http://secunia.com/advisories/32813/</url>
	</references>
	<dates>
	<discovery>2008-11-27</discovery>
	<entry>2008-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="37940643-be1b-11dd-a578-0030843d3802">
	<topic>hplip -- hpssd Denial of Service</topic>
	<affects>
	<package>
	<name>hplip</name>
	<range><lt>2.8.2_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31470">
	<p>A security issue has been reported in hplip, which can be
	exploited by malicious, local users to cause a DoS.</p>
	<p>The security issue is caused due to an error within hpssd.py when
	parsing certain requests. This can be exploited to crash the service
	by sending specially crafted requests to the default port 2207/TCP.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2940</cvename>
	<cvename>CVE-2008-2941</cvename>
	<bid>30683</bid>
	<url>https://rhn.redhat.com/errata/RHSA-2008-0818.html</url>
	<url>http://secunia.com/advisories/31470</url>
	</references>
	<dates>
	<discovery>2008-08-14</discovery>
	<entry>2008-11-29</entry>
	</dates>
	</vuln>

	<vuln vid="87106b67-be13-11dd-a578-0030843d3802">
	<topic>cups -- potential buffer overflow in PNG reading code</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>1.3.9_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CUPS reports:</p>
	<blockquote cite="http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt">
	<p>The PNG image reading code did not validate the
	image size properly, leading to a potential buffer overflow
	(STR #2974)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5286</cvename>
	<url>http://www.cups.org/str.php?L2974</url>
	<url>http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt</url>
	<url>http://www.openwall.com/lists/oss-security/2008/11/25/2</url>
	</references>
	<dates>
	<discovery>2008-10-17</discovery>
	<entry>2008-11-29</entry>
	<modified>2008-12-25</modified>
	</dates>
	</vuln>

	<vuln vid="910486d5-ba4d-11dd-8f23-0019666436c2">
	<topic>imlib2 -- XPM processing buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>imlib2</name>
	<name>imlib2-nox11</name>
	<range><lt>1.4.1.000_1,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/Advisories/32796/">
	<p>A vulnerability has been discovered in imlib2, which can
	be exploited by malicious people to potentially compromise
	an application using the library.</p>
	<p>The vulnerability is caused due to a pointer arithmetic
	error within the "load()" function provided by the XPM
	loader. This can be exploited to cause a heap-based buffer
	overflow via a specially crafted XPM file.</p>
	<p>Successful exploitation may allow execution of arbitrary
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32371</bid>
	<cvename>CVE-2008-5187</cvename>
	<url>http://secunia.com/Advisories/32796/</url>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15</url>
	<url>http://bugzilla.enlightenment.org/show_bug.cgi?id=547</url>
	</references>
	<dates>
	<discovery>2008-11-20</discovery>
	<entry>2008-11-24</entry>
	</dates>
	</vuln>

	<vuln vid="4d4caee0-b939-11dd-a578-0030843d3802">
	<topic>streamripper -- multiple buffer overflows</topic>
	<affects>
	<package>
	<name>streamripper</name>
	<range><lt>1.64.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2008-50/">
	<p>A boundary error exists within http_parse_sc_header() in lib/http.c
	when parsing an overly long HTTP header starting with "Zwitterion v".</p>
	<p>A boundary error exists within http_get_pls() in lib/http.c when
	parsing a specially crafted pls playlist containing an overly long
	entry.</p>
	<p>A boundary error exists within http_get_m3u() in lib/http.c when
	parsing a specially crafted m3u playlist containing an overly long
	"File" entry.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4829</cvename>
	<url>http://secunia.com/secunia_research/2008-50/</url>
	<url>http://streamripper.cvs.sourceforge.net/viewvc/streamripper/sripper_1x/CHANGES?revision=1.196</url>
	</references>
	<dates>
	<discovery>2008-11-05</discovery>
	<entry>2008-11-23</entry>
	</dates>
	</vuln>

	<vuln vid="00d6040a-b8e0-11dd-a578-0030843d3802">
	<topic>mantis -- session hijacking vulnerability</topic>
	<affects>
	<package>
	<name>mantis</name>
	<range><lt>1.1.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The mantis Team reports:</p>
	<blockquote cite="http://www.mantisbt.org/bugs/changelog_page.php?version_id=97">
	<p>When configuring a web application to use only ssl (e. g. by
	forwarding all http-requests to https), a user would expect that
	sniffing and hijacking the session is impossible.
	Though, for this to be secure, one needs to set the session cookie to
	have the secure flag. Else the cookie will be transferred through http
	if the victim's browser does a single http-request on the same domain.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3102</cvename>
	<url>http://www.mantisbt.org/bugs/view.php?id=9524</url>
	<url>http://www.mantisbt.org/bugs/view.php?id=9533</url>
	<url>http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/</url>
	<url>http://int21.de/cve/CVE-2008-3102-mantis.html</url>
	</references>
	<dates>
	<discovery>2008-10-14</discovery>
	<entry>2008-11-22</entry>
	</dates>
	</vuln>

	<vuln vid="75c24c1d-b688-11dd-88fd-001c2514716c">
	<topic>dovecot -- ACL plugin bypass vulnerabilities</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<range><lt>1.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timo Sirainen reports in dovecot 1.1.4 release notes:</p>
	<blockquote cite="http://www.dovecot.org/list/dovecot-news/2008-October/000085.html">
	<p>ACL plugin fixes: Negative rights were actually treated
	as positive rights. 'k' right didn't prevent creating
	parent/child/child mailbox. ACL groups weren't working.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31587</bid>
	<cvename>CVE-2008-4577</cvename>
	<cvename>CVE-2008-4578</cvename>
	</references>
	<dates>
	<discovery>2008-10-05</discovery>
	<entry>2008-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="f1e0164e-b67b-11dd-a55e-00163e000016">
	<topic>libxml2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.6.32_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/Advisories/32773/">
	<p>Two vulnerabilities have been reported in Libxml2, which can be
	exploited by malicious people to cause a DoS (Denial of Service) or
	to potentially compromise an application using the library.</p>
	<p>1) An integer overflow error in the "xmlSAX2Characters()" function
	can be exploited to trigger a memory corruption via a specially</p>
	<p>Successful exploitation may allow execution of arbitrary code, but
	requires e.g. that the user is tricked into processing an overly
	large XML file (2GB or more).</p>
	<p>2) An integer overflow error in the "xmlBufferResize()" function
	can be exploited to trigger the execution of an infinite loop.
	The vulnerabilities are reported in version 2.7.2.</p>
	<p>Other versions may also be affected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4225</cvename>
	<cvename>CVE-2008-4226</cvename>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=470466</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=470480</url>
	<url>http://secunia.com/Advisories/32773/</url>
	</references>
	<dates>
	<discovery>2008-11-18</discovery>
	<entry>2008-11-19</entry>
	</dates>
	</vuln>

	<vuln vid="937adf01-b64a-11dd-a55e-00163e000016">
	<topic>openfire -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>openfire</name>
	<range><lt>3.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andreas Kurtz reports:</p>
	<blockquote cite="http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt">
	<p>The jabber server Openfire (<= version 3.6.0a) contains several
	serious vulnerabilities. Depending on the particular runtime
	environment these issues can potentially even be used by an
	attacker to execute code on operating system level.</p>
	<ol>
	<li>Authentication bypass - This vulnerability provides an attacker
	full access to all functions in the admin webinterface without
	providing any user credentials. The Tomcat filter which is
	responsible for authentication could be completely
	circumvented.</li>
	<li>SQL injection - It is possible to pass SQL statements to the
	backend database through a SQL injection vulnerability. Depending
	on the particular runtime environment and database permissions it
	is even possible to write files to disk and execute code on
	operating system level.</li>
	<li>Multiple Cross-Site Scripting - Permits arbitrary insertion
	of HTML- and JavaScript code in login.jsp. An attacker could
	also manipulate a parameter to specify a destination to which a
	user will be forwarded to after successful authentication.</li>
	</ol>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-6510</cvename>
	<cvename>CVE-2008-6511</cvename>
	<cvename>CVE-2008-6508</cvename>
	<cvename>CVE-2009-1595</cvename>
	<cvename>CVE-2008-1728</cvename>
	<cvename>CVE-2008-6509</cvename>
	<url>http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt</url>
	<url>http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html</url>
	<url>http://secunia.com/Advisories/32478/</url>
	</references>
	<dates>
	<discovery>2008-11-07</discovery>
	<entry>2008-11-19</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="75f2382e-b586-11dd-95f9-00e0815b8da8">
	<topic>syslog-ng2 -- startup directory leakage in the chroot environment</topic>
	<affects>
	<package>
	<name>syslog-ng2</name>
	<range><lt>2.0.9_2</lt></range>
	</package>
	<package>
	<name>syslog-ng</name>
	<range><le>1.6.12_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Grandel reports:</p>
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791">
	<p>I have not had the time to analyze all of syslog-ng code.
	But by reading the code section near the chroot call and looking
	at strace results I believe that syslog-ng does not chdir to the
	chroot jail's location before chrooting into it.</p>
	<p>This opens up ways to work around the chroot jail.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5110</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791</url>
	<url>http://www.openwall.com/lists/oss-security/2008/11/17/3</url>
	</references>
	<dates>
	<discovery>2008-11-15</discovery>
	<entry>2008-11-18</entry>
	<modified>2009-07-01</modified>
	</dates>
	</vuln>

	<vuln vid="a1126054-b57c-11dd-8892-0017319806e7">
	<topic>enscript -- arbitrary code execution vulnerability</topic>
	<affects>
	<package>
	<name>enscript-a4</name>
	<name>enscript-letter</name>
	<name>enscript-letterdj</name>
	<range><lt>1.6.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Harnhammar of Secunia Research reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863">
	<p>Stack-based buffer overflow in the read_special_escape function
	in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e
	(aka special escapes processing) option is enabled, allows
	user-assisted remote attackers to execute arbitrary code via a
	crafted ASCII file, related to the setfilename command.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3863</cvename>
	<cvename>CVE-2008-4306</cvename>
	<url>http://secunia.com/secunia_research/2008-41/</url>
	</references>
	<dates>
	<discovery>2008-10-22</discovery>
	<entry>2008-11-18</entry>
	</dates>
	</vuln>

	<vuln vid="45298931-b3bf-11dd-80f8-001cc0377035">
	<topic>gnutls -- X.509 certificate chain validation vulnerability</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><lt>2.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/32232/discuss">
	<p>GnuTLS is prone to a security-bypass vulnerability because the
	application fails to properly validate chained X.509 certificates.
	Successfully exploiting this issue allows attackers to perform
	man-in-the-middle attacks by impersonating trusted servers.
	Unsuspecting users may be under a false sense of security that can
	aid attackers in launching further attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>32232</bid>
	<cvename>CVE-2008-4989</cvename>
	<url>http://www.gnu.org/software/gnutls/security.html</url>
	<mlist msgid="4918143A.3050103@gmx.net">http://lists.gnu.org/archive/html/gnutls-devel/2008-11/msg00017.html</mlist>
	</references>
	<dates>
	<discovery>2008-11-10</discovery>
	<entry>2008-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="daf045d7-b211-11dd-a987-000c29ca8953">
	<topic>net-snmp -- DoS for SNMP agent via crafted GETBULK request</topic>
	<affects>
	<package>
	<name>net-snmp</name>
	<range><gt>5.4</gt><lt>5.4.2.1</lt></range>
	<range><gt>5.3</gt><lt>5.3.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wes Hardaker reports through sourceforge.net forum:</p>
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=882903">
	<p>SECURITY ISSUE: A bug in the getbulk handling code could
	let anyone with even minimal access crash the agent. If you
	have open access to your snmp agents (bad bad bad; stop doing
	that!) or if you don't trust everyone that does have access to
	your agents you should updated immediately to prevent
	potential denial of service attacks.</p>
	</blockquote>
	<p>Description at cve.mitre.org additionally clarifies:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309">
	<p>Integer overflow in the netsnmp_create_subtree_cache
	function in agent/snmp_agent.c in net-snmp 5.4 before
	5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows
	remote attackers to cause a denial of service (crash) via
	a crafted SNMP GETBULK request, which triggers a heap-based
	buffer overflow, related to the number of responses or
	repeats.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4309</cvename>
	<url>http://sourceforge.net/forum/forum.php?forum_id=882903</url>
	<url>http://www.openwall.com/lists/oss-security/2008/10/31/1</url>
	<url>http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272</url>
	</references>
	<dates>
	<discovery>2008-10-12</discovery>
	<entry>2008-11-14</entry>
	<modified>2009-03-23</modified>
	</dates>
	</vuln>

	<vuln vid="f29fea8f-b19f-11dd-a55e-00163e000016">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.18,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.4,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.18</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.13</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	<p>MFSA 2008-58 Parsing error in E4X default namespace</p>
	<p>MFSA 2008-57 -moz-binding property bypasses security checks on
	codebase principals</p>
	<p>MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin
	violation</p>
	<p>MFSA 2008-55 Crash and remote code execution in
	nsFrameManager</p>
	<p>MFSA 2008-54 Buffer overflow in http-index-format parser</p>
	<p>MFSA 2008-53 XSS and JavaScript privilege escalation via session
	restore</p>
	<p>MFSA 2008-52 Crashes with evidence of memory corruption
	(rv:1.9.0.4/1.8.1.18)</p>
	<p>MFSA 2008-51 file: URIs inherit chrome privileges when opened
	from chrome</p>
	<p>MFSA 2008-50 Crash and remote code execution via __proto__
	tampering</p>
	<p>MFSA 2008-49 Arbitrary code execution via Flash Player dynamic
	module unloading</p>
	<p>MFSA 2008-48 Image stealing via canvas and HTTP redirect</p>
	<p>MFSA 2008-47 Information stealing via local shortcut files</p>
	<p>MFSA 2008-46 Heap overflow when canceling newsgroup message</p>
	<p>MFSA 2008-44 resource: traversal vulnerabilities</p>
	<p>MFSA 2008-43 BOM characters stripped from JavaScript before
	execution</p>
	<p>MFSA 2008-42 Crashes with evidence of memory corruption
	(rv:1.9.0.2/1.8.1.17)</p>
	<p>MFSA 2008-41 Privilege escalation via XPCnativeWrapper
	pollution</p>
	<p>MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin
	violation</p>
	<p>MFSA 2008-37 UTF-8 URL stack buffer overflow</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0017</cvename>
	<cvename>CVE-2008-4582</cvename>
	<cvename>CVE-2008-5012</cvename>
	<cvename>CVE-2008-5013</cvename>
	<cvename>CVE-2008-5014</cvename>
	<cvename>CVE-2008-5015</cvename>
	<cvename>CVE-2008-5016</cvename>
	<cvename>CVE-2008-5017</cvename>
	<cvename>CVE-2008-5018</cvename>
	<cvename>CVE-2008-5019</cvename>
	<cvename>CVE-2008-5021</cvename>
	<cvename>CVE-2008-5022</cvename>
	<cvename>CVE-2008-5023</cvename>
	<cvename>CVE-2008-5024</cvename>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-47.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-48.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-49.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-50.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-51.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-52.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-53.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-54.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-55.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-56.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-57.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-58.html</url>
	</references>
	<dates>
	<discovery>2008-11-13</discovery>
	<entry>2008-11-13</entry>
	<modified>2008-11-23</modified>
	</dates>
	</vuln>

	<vuln vid="445ed958-b0d9-11dd-a55e-00163e000016">
	<topic>faad2 -- heap overflow vulnerability</topic>
	<affects>
	<package>
	<name>faad2</name>
	<range><lt>2.6.1_1,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4201">
	<p>Heap-based buffer overflow in the decodeMP4file function
	(frontend/main.c) in FAAD2 2.6.1 and earlier allows remote
	attackers to cause a denial of service (crash) and possibly
	execute arbitrary code via a crafted MPEG-4 (MP4) file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4201</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899</url>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200811-03.xml</url>
	</references>
	<dates>
	<discovery>2008-09-16</discovery>
	<entry>2008-11-12</entry>
	<modified>2008-11-13</modified>
	</dates>
	</vuln>

	<vuln vid="66657bd5-ac92-11dd-b541-001f3b19d541">
	<topic>emacs -- run-python vulnerability</topic>
	<affects>
	<package>
	<name>emacs</name>
	<range><ge>22</ge><le>22.2_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Emacs developers report:</p>
	<blockquote cite="http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html">
	<p>The Emacs command `run-python' launches an interactive
	Python interpreter. After the Python process starts up,
	Emacs automatically sends it the line:</p>
	<p>import emacs</p>
	<p>which normally imports a script named emacs.py which is
	distributed with Emacs. This script, which is typically
	located in a write-protected installation directory with
	other Emacs program files, defines various functions to help
	the Python process communicate with Emacs.</p>
	<p>The vulnerability arises because Python, by default,
	prepends '' to the module search path, so modules are looked
	for in the current directory. If the current directory is
	world-writable, an attacker may insert malicious code by
	adding a fake Python module named emacs.py into that
	directory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3949</cvename>
	<url>http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html</url>
	</references>
	<dates>
	<discovery>2008-09-05</discovery>
	<entry>2008-11-07</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="24b64fb0-af1d-11dd-8a16-001b1116b350">
	<topic>clamav -- off-by-one heap overflow in VBA project parser</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.94.1</lt></range>
	</package>
	<package>
	<name>clamav-devel</name>
	<range><lt>20081105</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Advisory from Moritz Jodeit, November 8th, 2008:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/498169/30/0/threaded">
	<p>ClamAV contains an off-by-one heap overflow vulnerability
	in the code responsible for parsing VBA project files.
	Successful exploitation could allow an attacker to execute
	arbitrary code with the privileges of the `clamd' process by
	sending an email with a prepared attachment.</p>
	<p>A VBA project file embedded inside an OLE2 office document
	send as an attachment can trigger the off-by-one.</p>
	</blockquote>
	<p>Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:</p>
	<blockquote cite="http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog">
	<p>libclamav/vba_extract.c: get_unicode_name off-by-one,
	bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.securityfocus.com/archive/1/498169/30/0/threaded</url>
	<url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
	<cvename>CVE-2008-5050</cvename>
	</references>
	<dates>
	<discovery>2008-11-08</discovery>
	<entry>2008-11-10</entry>
	</dates>
	</vuln>

	<vuln vid="c89a3ebb-ae07-11dd-b4b2-001f3c8eabeb">
	<topic>trac -- potential DOS vulnerability</topic>
	<affects>
	<package>
	<name>trac</name>
	<range><lt>0.11.2</lt></range>
	</package>
	<package>
	<name>ja-trac</name>
	<range><lt>0.11.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Trac development team reports:</p>
	<blockquote cite="http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d">
	<p>0.11.2 is a new stable maintenance release. It contains
	several security fixes and everyone is recommended to
	upgrade their installations.</p>
	<p>Bug fixes:</p>
	<p>Fixes potential DOS vulnerability with certain wiki markup.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d</url>
	</references>
	<dates>
	<discovery>2008-11-08</discovery>
	<entry>2008-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="4b09378e-addb-11dd-a578-0030843d3802">
	<topic>vlc -- cue processing stack overflow</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>0.8.6.i_2,2</lt></range>
	</package>
	<package>
	<name>vlc-devel</name>
	<range><lt>0.9.6,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The VLC Team reports:</p>
	<blockquote cite="http://www.videolan.org/security/sa0810.html">
	<p>The VLC media player contains a stack overflow vulnerability
	while parsing malformed cue files. The vulnerability may be
	exploited by a (remote) attacker to execute arbitrary code in
	the context of VLC media player.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-5032</cvename>
	<cvename>CVE-2008-5036</cvename>
	<url>http://www.videolan.org/security/sa0810.html</url>
	<url>http://www.trapkit.de/advisories/TKADV2008-012.txt</url>
	</references>
	<dates>
	<discovery>2008-11-05</discovery>
	<entry>2008-11-08</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="0e30e802-a9db-11dd-93a2-000bcdf0a03b">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.62</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/view/906/">
	<p>When certain parameters are passed to Opera's History
	Search, they can cause content not to be correctly
	sanitized. This can allow scripts to be injected into the
	History Search results page. Such scripts can then run with
	elevated privileges and interact with Opera's configuration,
	allowing them to execute arbitrary code.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/907/">
	<p>The links panel shows links in all frames on the current
	page, including links with JavaScript URLs. When a page is
	held in a frame, the script is incorrectly executed on the
	outermost page, not the page where the URL was located.
	This can be used to execute scripts in the context of an
	unrelated frame, which allows cross-site scripting.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4794</cvename>
	<url>http://www.opera.com/support/search/view/906/</url>
	<url>http://www.opera.com/support/search/view/907/</url>
	</references>
	<dates>
	<discovery>2008-11-03</discovery>
	<entry>2008-11-03</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="07bb3bd2-a920-11dd-8503-0211060005df">
	<topic>qemu -- Heap overflow in Cirrus emulation</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.1_10</lt></range>
	<range><ge>0.9.1s.20080101*</ge><lt>0.9.1s.20080620_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Aurelien Jarno reports:</p>
	<blockquote cite="http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html">
	<p>CVE-2008-4539: fix a heap overflow in Cirrus emulation</p>
	<p>The code in hw/cirrus_vga.c has changed a lot between
	CVE-2007-1320 has been announced and the patch has been applied.
	As a consequence it has wrongly applied and QEMU is still
	vulnerable to this bug if using VNC.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4539</cvename>
	<mlist msgid="E1Kw4kF-0001Mx-KA@cvs.savannah.gnu.org">http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html</mlist>
	</references>
	<dates>
	<discovery>2008-11-01</discovery>
	<entry>2008-11-02</entry>
	</dates>
	</vuln>

	<vuln vid="85b0bbc8-a7a5-11dd-8283-001c2514716c">
	<topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><gt>3.0</gt><lt>3.0.1.1</lt></range>
	<range><lt>2.11.9.3</lt></range>
	</package>
	<package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/31928">
	<p>phpMyAdmin is prone to a cross-site scripting vulnerability
	because it fails to sufficiently sanitize user-supplied data.</p>
	<p>An attacker may leverage this issue to execute arbitrary
	script code in the browser of an unsuspecting user in the
	context of the affected site. This may allow the attacker
	to steal cookie-based authentication credentials and to
	launch other attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31928</bid>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-9</url>
	</references>
	<dates>
	<discovery>2008-10-30</discovery>
	<entry>2008-10-31</entry>
	<modified>2008-10-31</modified>
	</dates>
	</vuln>

	<vuln vid="f5c4d7f7-9f4b-11dd-bab1-001999392805">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.61</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/view/903/">
	<p>Certain constructs are not escaped correctly by Opera's
	History Search results. These can be used to inject scripts
	into the page, which can then be used to look through the user's
	browsing history, including the contents of the pages they have
	visited. These may contain sensitive information.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/904/">
	<p>If a link that uses a JavaScript URL triggers Opera's Fast
	Forward feature, when the user activates Fast Forward, the
	script should run on the current page. When a page is held in a
	frame, the script is incorrectly executed on the outermost page,
	not the page where the URL was located. This can be used to
	execute scripts in the context of an unrelated frame, which
	allows cross-site scripting.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/905/">
	<p>When Opera is previewing a news feed, some scripts are not
	correctly blocked. These scripts are able to subscribe the user
	to any feed URL that the attacker chooses, and can also view
	the contents of any feeds that the user is subscribed to.
	These may contain sensitive information.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4697</cvename>
	<cvename>CVE-2008-4698</cvename>
	<cvename>CVE-2008-4725</cvename>
	<url>http://www.opera.com/support/search/view/903/</url>
	<url>http://www.opera.com/support/search/view/904/</url>
	<url>http://www.opera.com/support/search/view/905/</url>
	</references>
	<dates>
	<discovery>2008-10-17</discovery>
	<entry>2008-10-28</entry>
	<modified>2010-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="2ddbfd29-a455-11dd-a55e-00163e000016">
	<topic>libspf2 -- Buffer overflow</topic>
	<affects>
	<package>
	<name>libspf2</name>
	<range><lt>1.2.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2469">
	<p>Heap-based buffer overflow in the SPF_dns_resolv_lookup function
	in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers
	to execute arbitrary code via a long DNS TXT record with a modified
	length field.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31881</bid>
	<cvename>CVE-2008-2469</cvename>
	</references>
	<dates>
	<discovery>2008-10-21</discovery>
	<entry>2008-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="55616fda-a2d0-11dd-a9f9-0030843d3802">
	<topic>openx -- sql injection vulnerability</topic>
	<affects>
	<package>
	<name>openx</name>
	<range><lt>2.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32114/">
	<p>OpenX can be exploited by malicious people to conduct SQL injection
	attacks.</p>
	<p>Input passed to the "bannerid" parameter in www/delivery/ac.php is
	not properly sanitised before being used in SQL queries. This can be
	exploited to manipulate SQL queries by injecting arbitrary SQL
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/32114/</url>
	<url>http://blog.openx.org/10/openx-security-update/</url>
	</references>
	<dates>
	<discovery>2008-10-03</discovery>
	<entry>2008-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="9d3020e4-a2c4-11dd-a9f9-0030843d3802">
	<topic>flyspray -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>flyspray</name>
	<range><lt>0.9.9.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Flyspray Project reports:</p>
	<blockquote cite="http://www.flyspray.org/fsa:2">
	<p>Flyspray is affected by a Cross Site scripting Vulnerability
	due to an error escaping PHP's $_SERVER['QUERY_STRING']
	superglobal, that can be maliciously used to inject
	arbitrary code into the savesearch() javascript function.</p>
	<p>There is an XSS problem in the history tab, the application
	fails to sanitize the "details" parameter correctly, leading
	to the possibility of arbitrary code injection into the
	getHistory() javascript function.</p>
	</blockquote>
	<blockquote cite="http://www.flyspray.org/fsa:3">
	<p>Flyspray is affected by a Cross Site scripting Vulnerability
	due missing escaping of SQL error messages. By including HTML
	code in a query and at the same time causing it to fail by
	submitting invalid data, an XSS hole can be exploited.</p>
	<p>There is an XSS problem in the task history attached to
	comments, since the application fails to sanitize the
	old_value and new_value database fields for changed task
	summaries.</p>
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/29215">
	<p>Input passed via the "item_summary" parameter to
	"index.php?do=details" is not properly sanitised before being
	returned to the user. This can be exploited to execute arbitrary
	HTML and script code in a user's browser session in context of
	an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6461</cvename>
	<cvename>CVE-2008-1165</cvename>
	<cvename>CVE-2008-1166</cvename>
	<url>http://secunia.com/advisories/29215</url>
	</references>
	<dates>
	<discovery>2008-02-24</discovery>
	<entry>2008-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="3a4a3e9c-a1fe-11dd-81be-001c2514716c">
	<topic>wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>wordpress-mu</name>
	<range><lt>2.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Wordpress development team reports:</p>
	<blockquote cite="http://wordpress.org/development/2008/10/wordpress-263/">
	<p>A <a href="http://secunia.com/Advisories/32361/">vulnerability</a>
	in the <a href="http://sourceforge.net/projects/snoopy/">Snoopy</a>
	library was announced today. WordPress uses Snoopy to fetch the feeds
	shown in the Dashboard. Although this seems to be a low risk
	vulnerability for WordPress users, we wanted to get an update out
	immediately.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31887</bid>
	<url>http://secunia.com/Advisories/32361/</url>
	<url>http://wordpress.org/development/2008/10/wordpress-263/</url>
	</references>
	<dates>
	<discovery>2008-10-23</discovery>
	<entry>2008-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="706c9eef-a077-11dd-b413-001372fd0af2">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.12</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/324824">
	<p>On a server configured for IP-based virtual hosts, Drupal may be
	caused to include and execute specifically named files outside
	of its root directory. This bug affects both Drupal 5 and
	Drupal 6.</p>
	<p>The title of book pages is not always properly escaped, enabling
	users with the "create book content" permission or the
	permission to edit any node in the book hierarchy to insert
	arbitrary HTML and script code into pages. Such a Cross site
	scripting attack may lead to the attacker gaining administrator
	access. This bug affects Drupal 6.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-6170</cvename>
	<url>http://drupal.org/node/324824</url>
	</references>
	<dates>
	<discovery>2008-10-22</discovery>
	<entry>2008-10-22</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="06eac338-9ddf-11dd-813f-000e35248ad7">
	<topic>libxine -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xine team reports:</p>
	<blockquote cite="http://www.xinehq.de/index.php/news">
	<p>A new xine-lib version is now available. This release contains
	some security fixes, notably a DoS via corrupted Ogg files
	(CVE-2008-3231), some related fixes, and fixes for a few possible
	buffer overflows.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3231</cvename>
	<url>http://www.xinehq.de/index.php/news</url>
	<url>http://xforce.iss.net/xforce/xfdb/44040</url>
	</references>
	<dates>
	<discovery>2008-07-13</discovery>
	<entry>2008-10-19</entry>
	</dates>
	</vuln>

	<vuln vid="78f456fd-9c87-11dd-a55e-00163e000016">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><le>9.0r124_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb08-18.html">
	<p>Potential vulnerabilities have been identified in Adobe Flash
	Player 9.0.124.0 and earlier that could allow an attacker who
	successfully exploits these potential vulnerabilities to bypass
	Flash Player security controls. Adobe recommends users update
	to the most current version of Flash Player available for their
	platform.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6243</cvename>
	<cvename>CVE-2008-3873</cvename>
	<cvename>CVE-2007-4324</cvename>
	<cvename>CVE-2008-4401</cvename>
	<cvename>CVE-2008-4503</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb08-18.html</url>
	</references>
	<dates>
	<discovery>2008-10-15</discovery>
	<entry>2008-10-17</entry>
	</dates>
	</vuln>

	<vuln vid="d71da236-9a94-11dd-8f42-001c2514716c">
	<topic>libxml2 -- two vulnerabilities</topic>
	<affects>
	<package>
	<name>libxml2</name>
	<range><lt>2.6.32_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31558/">
	<p>Two vulnerabilities have been reported in Libxml2, which can be
	exploited by malicious people to cause a DoS (Denial of Service)
	or potentially compromise an application using the library.</p>
	<p>1) A recursion error exists when processing certain XML content.
	This can be exploited to e.g. exhaust all available memory and CPU
	resources by tricking an application using Libxml2 into processing
	specially crafted XML documents.</p>
	<p>2) A boundary error in the processing of long XML entity names
	in parser.c can be exploited to cause a heap-based buffer overflow
	when specially crafted XML content is parsed.</p>
	<p>Successful exploitation may allow execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3281</cvename>
	<cvename>CVE-2008-3529</cvename>
	</references>
	<dates>
	<discovery>2008-08-22</discovery>
	<entry>2008-10-15</entry>
	<modified>2008-10-20</modified>
	</dates>
	</vuln>

	<vuln vid="12efc567-9879-11dd-a5e7-0030843d3802">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.11</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/318706">
	<p>A logic error in the core upload module validation allowed
	unprivileged users to attach files to content. Users can view files
	attached to content which they do not otherwise have access to.
	If the core upload module is not enabled, your site will not be
	affected.</p>
	<p>A deficiency in the user module allowed users who had been blocked
	by access rules to continue logging into the site under certain
	conditions. If you do not use the 'access rules' functionality in core,
	your site will not be affected.</p>
	<p>The BlogAPI module does not implement correct validation for
	certain content fields, allowing for values to be set for fields which
	would otherwise be inaccessible on an internal Drupal form. We have
	hardened these checks in BlogAPI module for this release, but the
	security team would like to re-iterate that the 'Administer content
	with BlogAPI' permission should only be given to trusted users.
	If the core BlogAPI module is not enabled, your site will not be
	affected.</p>
	<p>A weakness in the node module API allowed for node validation to be
	bypassed in certain circumstances for contributed modules implementing
	the API. Additional checks have been added to ensure that validation
	is performed in all cases. This vulnerability only affects sites using
	one of a very small number of contributed modules, all of which will
	continue to work correctly with the improved API. None of them were
	found vulnerable, so our correction is a preventative measure.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4791</cvename>
	<cvename>CVE-2008-4792</cvename>
	<cvename>CVE-2008-4793</cvename>
	<url>http://drupal.org/node/318706</url>
	<url>http://secunia.com/advisories/32200/</url>
	<url>http://secunia.com/advisories/32201/</url>
	<url>http://secunia.com/advisories/32198/</url>
	</references>
	<dates>
	<discovery>2008-10-08</discovery>
	<entry>2008-10-12</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="ce29ce1d-971a-11dd-ab7e-001c2514716c">
	<topic>cups -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>1.3.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The release note of cups 1.3.9 reports:</p>
	<blockquote cite="http://cups.org/articles.php?L575">
	<p>It contains the following fixes:</p>
	<ul>
	<li>SECURITY: The HP-GL/2 filter did not range check
	pen numbers (STR #2911)</li>
	<li>SECURITY: The SGI image file reader did not range
	check 16-bit run lengths (STR #2918)</li>
	<li>SECURITY: The text filter did not range check cpi,
	lpi, or column values (STR #2919)</li>
	</ul>
	</blockquote>
	<p>Exploitation of this vulnerability results in the execution
	of arbitrary code with the privileges of the affected service.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3639</cvename>
	<cvename>CVE-2008-3640</cvename>
	<cvename>CVE-2008-3641</cvename>
	</references>
	<dates>
	<discovery>2008-10-09</discovery>
	<entry>2008-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="fb84d5dd-9528-11dd-9a00-001999392805">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.60</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/view/901/">
	<p>If a malicious page redirects Opera to a specially crafted
	address (URL), it can cause Opera to crash. Given sufficient
	address content, the crash could cause execution of code
	controlled by the attacking page.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/902/">
	<p>Once a Java applet has been cached, if a page can predict the
	cache path for that applet, it can load the applet from the
	cache, causing it to run in the context of the local machine.
	This allows it to read other cache files on the computer or
	perform other normally more restrictive actions. These files
	could contain sensitive information, which could then be sent
	to the attacker.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4695</cvename>
	<cvename>CVE-2008-4694</cvename>
	<url>http://www.opera.com/support/search/view/901/</url>
	<url>http://www.opera.com/support/search/view/902/</url>
	</references>
	<dates>
	<discovery>2008-10-04</discovery>
	<entry>2008-10-10</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="4775c807-8f30-11dd-821f-001cc0377035">
	<topic>mysql -- command line client input validation vulnerability</topic>
	<affects>
	<package>
	<name>mysql-client</name>
	<range><gt>5.1</gt><lt>5.1.28_1</lt></range>
	<range><gt>5.0</gt><lt>5.0.67_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thomas Henlich reports:</p>
	<blockquote cite="http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/">
	<p>The mysql command-line client does not quote HTML special
	characters like < in its output. This allows an attacker who
	is able to write data into a table to hide or modify records in
	the output, and to inject potentially dangerous code, e. g.
	Javascript to perform cross-site scripting or cross-site request
	forgery attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31486</bid>
	<url>http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/</url>
	</references>
	<dates>
	<discovery>2007-04-17</discovery>
	<entry>2008-10-01</entry>
	<modified>2008-10-10</modified>
	</dates>
	</vuln>

	<vuln vid="724e6f93-8f2a-11dd-821f-001cc0377035">
	<topic>mplayer -- multiple integer overflows</topic>
	<affects>
	<package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The oCERT team reports:</p>
	<blockquote cite="http://www.ocert.org/advisories/ocert-2008-013.html">
	<p>The MPlayer multimedia player suffers from a vulnerability which
	could result in arbitrary code execution and at the least, in
	unexpected process termination. Three integer underflows located
	in the Real demuxer code can be used to exploit a heap overflow,
	a specific video file can be crafted in order to make the
	stream_read function reading or writing arbitrary amounts of
	memory.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3827</cvename>
	<url>http://www.ocert.org/advisories/ocert-2008-013.html</url>
	</references>
	<dates>
	<discovery>2008-09-30</discovery>
	<entry>2008-10-01</entry>
	<modified>2008-10-02</modified>
	</dates>
	</vuln>

	<vuln vid="fb911e31-8ceb-11dd-bb29-000c6e274733">
	<topic>lighttpd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.19_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Lighttpd seurity annoucement:</p>
	<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt">
	<p>lighttpd 1.4.19, and possibly other versions before 1.5.0, does
	not decode the url before matching against rewrite and redirect
	patterns, which allows attackers to bypass rewrites rules. this
	can be a security problem in certain configurations if these rules
	are used to hide certain urls.</p>
	</blockquote>
	<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt">
	<p>lighttpd 1.4.19, and possibly other versions before 1.5.0, does
	not lowercase the filename after generating it from the url in
	mod_userdir on case insensitive (file)systems.</p>
	<p>As other modules are case sensitive, this may lead to information
	disclosure; for example if one configured php to handle files
	ending on ".php", an attacker will get the php source with
	http://example.com/~user/file.PHP</p>
	</blockquote>
	<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt">
	<p>lighttpd 1.4.19 does not always release a header if it triggered
	a 400 (Bad Request) due to a duplicate header.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31434</bid>
	<cvename>CVE-2008-4298</cvename>
	<cvename>CVE-2008-4359</cvename>
	<cvename>CVE-2008-4360</cvename>
	<url>http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt</url>
	<url>http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt</url>
	<url>http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt</url>
	</references>
	<dates>
	<discovery>2008-09-26</discovery>
	<entry>2008-09-27</entry>
	<modified>2009-02-22</modified>
	</dates>
	</vuln>

	<vuln vid="24ec781b-8c11-11dd-9923-0016d325a0ed">
	<topic>bitlbee -- account recreation security issues</topic>
	<affects>
	<package>
	<name>bitlbee</name>
	<range><lt>1.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31633/">
	<p>Some security issues have been reported in BitlBee, which can
	be exploited by malicious people to bypass certain security
	restrictions and hijack accounts.</p>
	<p>The security issues are caused due to unspecified errors, which
	can be exploited to overwrite existing accounts.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3920</cvename>
	<cvename>CVE-2008-3969</cvename>
	<url>http://secunia.com/advisories/31633/</url>
	</references>
	<dates>
	<discovery>2008-08-27</discovery>
	<entry>2008-09-26</entry>
	<modified>2008-10-03</modified>
	</dates>
	</vuln>

	<vuln vid="2273879e-8a2f-11dd-a6fe-0030843d3802">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.17,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.2,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.17</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.12</lt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.17</lt></range>
	</package>
	<package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>2.0</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	<p>MFSA 2008-37<br/>UTF-8 URL stack buffer overflow</p>
	<p>MFSA 2008-38<br/>nsXMLDocument::OnChannelRedirect() same-origin
	violation</p>
	<p>MFSA 2008-39<br/>Privilege escalation using feed preview page and
	XSS flaw</p>
	<p>MFSA 2008-40<br/>Forced mouse drag</p>
	<p>MFSA 2008-41<br/>Privilege escalation via XPCnativeWrapper
	pollution</p>
	<p>MFSA 2008-42<br/>Crashes with evidence of memory corruption
	(rv:1.9.0.2/1.8.1.17)</p>
	<p>MFSA 2008-43<br/>BOM characters stripped from JavaScript before
	execution</p>
	<p>MFSA 2008-44<br/>resource: traversal vulnerabilities</p>
	<p>MFSA 2008-45<br/>XBM image uninitialized memory reading</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0016</cvename>
	<cvename>CVE-2008-3835</cvename>
	<cvename>CVE-2008-3836</cvename>
	<cvename>CVE-2008-3837</cvename>
	<cvename>CVE-2008-4058</cvename>
	<cvename>CVE-2008-4059</cvename>
	<cvename>CVE-2008-4060</cvename>
	<cvename>CVE-2008-4061</cvename>
	<cvename>CVE-2008-4062</cvename>
	<cvename>CVE-2008-4063</cvename>
	<cvename>CVE-2008-4064</cvename>
	<cvename>CVE-2008-4065</cvename>
	<cvename>CVE-2008-4067</cvename>
	<cvename>CVE-2008-4068</cvename>
	<cvename>CVE-2008-4069</cvename>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-37.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-38.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-39.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-40.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-41.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-42.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-43.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-44.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-45.html</url>
	</references>
	<dates>
	<discovery>2008-09-24</discovery>
	<entry>2008-09-24</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="a0afb4b9-89a1-11dd-a65b-00163e000016">
	<topic>squirrelmail -- Session hijacking vulnerability</topic>
	<affects>
	<package>
	<name>squirrelmail</name>
	<range><le>1.4.15_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanno Boeck reports:</p>
	<blockquote cite="http://seclists.org/bugtraq/2008/Sep/0239.html">
	<p>When configuring a web application to use only ssl (e.g. by
	forwarding all http-requests to https), a user would expect that
	sniffing and hijacking the session is impossible.</p>
	<p>Though, for this to be secure, one needs to set the session
	cookie to have the secure flag. Otherwise the cookie will be
	transferred through HTTP if the victim's browser does a single
	HTTP request on the same domain.</p>
	<p>Squirrelmail does not set that flag. It is fixed in the 1.5
	test versions, but current 1.4.15 is vulnerable.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31321</bid>
	<cvename>CVE-2008-3663</cvename>
	<mlist>http://seclists.org/bugtraq/2008/Sep/0239.html</mlist>
	</references>
	<dates>
	<discovery>2008-08-12</discovery>
	<entry>2008-09-23</entry>
	</dates>
	</vuln>

	<vuln vid="0f51f2c9-8956-11dd-a6fe-0030843d3802">
	<topic>proftpd -- Long Command Processing Vulnerability</topic>
	<affects>
	<package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.2rc2</lt></range>
	</package>
	<package>
	<name>proftpd-devel</name>
	<range><lt>1.3.20080922</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31930/">
	<p>The vulnerability is caused due to the application truncating an
	overly long FTP command, and improperly interpreting the remainder
	string as a new FTP command. This can be exploited to execute
	arbitrary FTP commands with the privileges of another user by e.g.
	tricking the user into following malicious link.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4242</cvename>
	<cvename>CVE-2008-4247</cvename>
	<url>http://secunia.com/advisories/31930/</url>
	<url>http://bugs.proftpd.org/show_bug.cgi?id=3115</url>
	</references>
	<dates>
	<discovery>2008-09-22</discovery>
	<entry>2008-09-23</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="150e4548-8950-11dd-a6fe-0030843d3802">
	<topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/Advisories/31974/">
	<p>An error exists in the "PMA_escapeJsString()" function in
	libraries/js_escape.lib.php, which can be exploited to bypass
	certain filters and execute arbitrary HTML and script code in a
	user's browser session in context of an affected site when e.g.
	Microsoft Internet Explorer is used.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/Advisories/31974/</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8</url>
	</references>
	<dates>
	<discovery>2008-09-23</discovery>
	<entry>2008-09-23</entry>
	<modified>2008-10-03</modified>
	</dates>
	</vuln>

	<vuln vid="fc9e73b2-8685-11dd-bb64-0030843d3802">
	<topic>gallery -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gallery</name>
	<range><lt>1.5.9</lt></range>
	</package>
	<package>
	<name>gallery2</name>
	<range><lt>2.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31912/">
	<p>An error in the handing of ZIP archives with symbolic links can be
	exploited to disclose the contents of arbitrary files.</p>
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/31858/">
	<p>Input from uploaded Flash animations is not properly sanitised
	before being used. This can be exploited to insert arbitrary HTML and
	script code, which is executed in a user's browser session in context
	of an affected site when the malicious data is viewed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/31912/</url>
	<url>http://secunia.com/advisories/31858/</url>
	</references>
	<dates>
	<discovery>2008-09-18</discovery>
	<entry>2008-09-19</entry>
	<modified>2008-10-03</modified>
	</dates>
	</vuln>

	<vuln vid="74bf1594-8493-11dd-bb64-0030843d3802">
	<topic>phpmyadmin -- Code execution vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7">
	<p>The server_databases.php script was vulnerable to an attack coming
	from a user who is already logged-on to phpMyAdmin, where he can
	execute shell code (if the PHP configuration permits commands like
	exec).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4096</cvename>
	<url>http://secunia.com/Advisories/31884/</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7</url>
	</references>
	<dates>
	<discovery>2008-09-15</discovery>
	<entry>2008-09-17</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="9227dcaf-827f-11dd-9cd7-0050568452ac">
	<topic>twiki -- Arbitrary code execution in session files</topic>
	<affects>
	<package>
	<name>twiki</name>
	<range><lt>4.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Th1nk3r reports:</p>
	<blockquote cite="http://www.milw0rm.com/exploits/6269">
	<p>The version of TWiki installed on the remote host allows access to
	the 'configure' script and fails to sanitize the 'image' parameter
	of that script of directory traversal sequences before returning the
	file contents when the 'action' parameter is set to 'image'. An
	unauthenticated attacker can leverage this issue to view arbitrary
	files on the remote host subject to the privileges of the web server
	user id. .</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3195</cvename>
	<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195</url>
	<url>http://www.kb.cert.org/vuls/id/362012</url>
	<url>https://inspectit.accessitgroup.com/threats/details.cgi?id=34031</url>
	<url>http://www.nessus.org/plugins/index.php?view=single&id=34031</url>
	</references>
	<dates>
	<discovery>2008-08-05</discovery>
	<entry>2008-09-14</entry>
	</dates>
	</vuln>

	<vuln vid="755fa519-80a9-11dd-8de5-0030843d3802">
	<topic>neon -- NULL pointer dereference in Digest domain support</topic>
	<affects>
	<package>
	<name>neon28</name>
	<range><lt>0.28.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joe Orton reports:</p>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2008/08/15/4">
	<p>A NULL pointer deference in the Digest authentication support in
	neon versions 0.28.0 through 0.28.2 inclusive allows a malicious
	server to crash a client application, resulting in possible denial
	of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>30710</bid>
	<cvename>CVE-2008-3746</cvename>
	<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571</url>
	<url>http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html</url>
	</references>
	<dates>
	<discovery>2008-08-15</discovery>
	<entry>2008-09-12</entry>
	</dates>
	</vuln>

	<vuln vid="da5c4072-8082-11dd-9c8c-001c2514716c">
	<topic>clamav -- CHM Processing Denial of Service</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.94</lt></range>
	</package>
	<package>
	<name>clamav-devel</name>
	<range><lt>20080902</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanno Boeck reports:</p>
	<blockquote cite="http://int21.de/cve/CVE-2008-1389-clamav-chd.html">
	<p>A fuzzing test showed weakness in the chm parser of
	clamav, which can possibly be exploited. The clamav
	team has disabled the chm module in older versions
	though freshclam updates and has released 0.94 with
	a fixed parser.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1389</cvename>
	<url>https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089</url>
	</references>
	<dates>
	<discovery>2008-07-09</discovery>
	<entry>2008-09-12</entry>
	</dates>
	</vuln>

	<vuln vid="7d239578-7ff2-11dd-8de5-0030843d3802">
	<topic>horde -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>horde-base</name>
	<range><lt>3.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31842/">
	<p>Some vulnerabilities have been reported in various Horde products,
	which can be exploited by malicious people to conduct script insertion
	attacks</p>
	<p>Input via MIME attachment linking is not properly sanitised in the
	MIME library before being used. This can be exploited to execute
	arbitrary HTML and script code in a user's browser session if e.g. a
	malicious email is viewed.</p>
	<p>Certain unspecified input in HTML messages is not properly
	sanitised before being used. This can be exploited to execute
	arbitrary HTML and script in a user's browser session if e.g. a
	malicious HTML email is viewed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3823</cvename>
	<cvename>CVE-2008-3824</cvename>
	<mlist>http://lists.horde.org/archives/announce/2008/000429.html</mlist>
	<url>http://secunia.com/advisories/31842/</url>
	</references>
	<dates>
	<discovery>2008-09-10</discovery>
	<entry>2008-09-11</entry>
	<modified>2008-10-03</modified>
	</dates>
	</vuln>

	<vuln vid="0dccaa28-7f3c-11dd-8de5-0030843d3802">
	<topic>python -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>python24</name>
	<range><lt>2.4.5_2</lt></range>
	</package>
	<package>
	<name>python25</name>
	<range><lt>2.5.2_3</lt></range>
	</package>
	<package>
	<name>python23</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31305">
	<p>Some vulnerabilities have been reported in Python, where some have
	unknown impact and others can potentially be exploited by malicious
	people to cause a DoS (Denial of Service) or to compromise a
	vulnerable system.</p>
	<p>Various integer overflow errors exist in core modules e.g.
	stringobject, unicodeobject, bufferobject, longobject, tupleobject,
	stropmodule, gcmodule, mmapmodule.</p>
	<p>An integer overflow in the hashlib module can lead to an unreliable
	cryptographic digest results.</p>
	<p>Integer overflow errors in the processing of unicode strings can be
	exploited to cause buffer overflows on 32-bit systems.</p>
	<p>An integer overflow exists in the PyOS_vsnprintf() function on
	architectures that do not have a "vsnprintf()" function.</p>
	<p>An integer underflow error in the PyOS_vsnprintf() function when
	passing zero-length strings can lead to memory corruption.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2315</cvename>
	<cvename>CVE-2008-2316</cvename>
	<cvename>CVE-2008-3142</cvename>
	<cvename>CVE-2008-3144</cvename>
	<url>http://bugs.python.org/issue2620</url>
	<url>http://bugs.python.org/issue2588</url>
	<url>http://bugs.python.org/issue2589</url>
	<url>http://secunia.com/advisories/31305</url>
	<mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072276.html</mlist>
	<mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072174.html</mlist>
	<mlist>http://mail.python.org/pipermail/python-checkins/2008-June/070481.html</mlist>
	</references>
	<dates>
	<discovery>2008-08-04</discovery>
	<entry>2008-09-10</entry>
	</dates>
	</vuln>

	<vuln vid="388d9ee4-7f22-11dd-a66a-0019666436c2">
	<topic>mysql -- MyISAM table privileges security bypass vulnerability</topic>
	<affects>
	<package>
	<name>mysql-server</name>
	<range><ge>6.0</ge><lt>6.0.5</lt></range>
	<range><ge>5.1</ge><lt>5.1.24</lt></range>
	<range><ge>5.0</ge><lt>5.0.67</lt></range>
	<range><ge>4.1</ge><lt>4.1.22_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/29106/discuss">
	<p>MySQL is prone to a security-bypass vulnerability.
	An attacker can exploit this issue to overwrite existing
	table files in the MySQL data directory, bypassing certain
	security restrictions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>29106</bid>
	<cvename>CVE-2008-2079</cvename>
	</references>
	<dates>
	<discovery>2008-05-05</discovery>
	<entry>2008-09-10</entry>
	<modified>2008-10-10</modified>
	</dates>
	</vuln>

	<vuln vid="8e8b8b94-7f1d-11dd-a66a-0019666436c2">
	<topic>rubygem-rails -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>2.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jonathan Weiss reports, that it is possible
	to perform an SQL injection in Rails applications
	via not correctly sanitized :limit and :offset
	parameters. It is possible to change arbitrary
	values in affected tables or gain access to the
	sensitive data.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4094</cvename>
	<url>http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1</url>
	</references>
	<dates>
	<discovery>2008-09-08</discovery>
	<entry>2008-09-10</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="884fced7-7f1c-11dd-a66a-0019666436c2">
	<topic>wordpress -- remote privilege escalation</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>wordpress-mu</name>
	<range><lt>2.6.2</lt></range>
	</package>
	<package>
	<name>zh-wordpress</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Wordpress development team reports:</p>
	<blockquote cite="http://wordpress.org/development/2008/09/wordpress-262/">
	<p>With open registration enabled, it is possible in WordPress
	versions 2.6.1 and earlier to craft a username such that it
	will allow resetting another users password to a randomly
	generated password. The randomly generated password is not
	disclosed to the attacker, so this problem by itself is annoying
	but not a security exploit. However, this attack coupled with a
	weakness in the random number seeding in mt_rand() could be used
	to predict the randomly generated password.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>31068</bid>
	<cvename>CVE-2008-4107</cvename>
	<url>http://wordpress.org/development/2008/09/wordpress-262/</url>
	</references>
	<dates>
	<discovery>2008-09-08</discovery>
	<entry>2008-10-22</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="2f794295-7b69-11dd-80ba-000bcdf0a03b">
	<topic>FreeBSD -- Remote kernel panics on IPv6 connections</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>In case of an incoming ICMPv6 'Packet Too Big Message', there
	is an insufficient check on the proposed new MTU for a path to
	the destination.</p>
	<h1>Impact:</h1>
	<p>When the kernel is configured to process IPv6 packets and has
	active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet
	Too Big Message' could cause the TCP stack of the kernel to
	panic.</p>
	<h1>Workaround:</h1>
	<p>Systems without INET6 / IPv6 support are not vulnerable and
	neither are systems which do not listen on any IPv6 TCP sockets
	and have no active IPv6 connections.</p>
	<p>Filter ICMPv6 'Packet Too Big Messages' using a firewall, but
	this will at the same time break PMTU support for IPv6
	connections.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3530</cvename>
	<freebsdsa>SA-08:09.icmp6</freebsdsa>
	</references>
	<dates>
	<discovery>2008-09-03</discovery>
	<entry>2008-09-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="7dbb7197-7b68-11dd-80ba-000bcdf0a03b">
	<topic>FreeBSD -- nmount(2) local arbitrary code execution</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Various user defined input such as mount points, devices, and
	mount options are prepared and passed as arguments to
	nmount(2) into the kernel. Under certain error conditions,
	user defined data will be copied into a stack allocated buffer
	stored in the kernel without sufficient bounds checking.</p>
	<h1>Impact:</h1>
	<p>If the system is configured to allow unprivileged users to
	mount file systems, it is possible for a local adversary to
	exploit this vulnerability and execute code in the context of
	the kernel.</p>
	<h1>Workaround:</h1>
	<p>It is possible to work around this issue by allowing only
	privileged users to mount file systems by running the
	following sysctl(8) command:</p>
	<pre># sysctl vfs.usermount=0</pre>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3531</cvename>
	<freebsdsa>SA-08:08.nmount</freebsdsa>
	</references>
	<dates>
	<discovery>2008-09-03</discovery>
	<entry>2008-09-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="6d4e4759-7b67-11dd-80ba-000bcdf0a03b">
	<topic>FreeBSD -- amd64 swapgs local privilege escalation</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>If a General Protection Fault happens on a FreeBSD/amd64
	system while it is returning from an interrupt, trap or
	system call, the swapgs CPU instruction may be called one
	extra time when it should not resulting in userland and
	kernel state being mixed.</p>
	<h1>Impact:</h1>
	<p>A local attacker can by causing a General Protection Fault
	while the kernel is returning from an interrupt, trap or
	system call while manipulating stack frames and, run
	arbitrary code with kernel privileges.</p>
	<p>The vulnerability can be used to gain kernel / supervisor
	privilege. This can for example be used by normal users to
	gain root privileges, to break out of jails, or bypass
	Mandatory Access Control (MAC) restrictions.</p>
	<h1>Workaround:</h1>
	<p>No workaround is available, but only systems running the 64
	bit FreeBSD/amd64 kernels are vulnerable.</p>
	<p>Systems with 64 bit capable CPUs, but running the 32 bit
	FreeBSD/i386 kernel are not vulnerable.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3890</cvename>
	<freebsdsa>SA-08:07.amd64</freebsdsa>
	</references>
	<dates>
	<discovery>2008-09-03</discovery>
	<entry>2008-09-05</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="73ec1008-72f0-11dd-874b-0030843d3802">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.52</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Opera Team reports:</p>
	<blockquote cite="http://www.opera.com/support/search/view/893/">
	<p>Scripts are able to change the addresses of framed pages that
	come from the same site. Due to a flaw in the way that Opera checks
	what frames can be changed, a site can change the address of frames
	on other sites inside any window that it has opened. This allows
	sites to open pages from other sites, and display misleading
	information on them.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/894/">
	<p>Custom shortcut and menu commands can be used to activate external
	applications. In some cases, the parameters passed to these
	applications are not prepared correctly, and may be created from
	uninitialized memory. These may be misinterpreted as additional
	parameters, and depending on the application, this could allow
	execution of arbitrary code.</p>
	<p>Successful exploitation requires convincing the user to modify
	their shortcuts or menu files appropriately, pointing to an
	appropriate target application, then to activate that shortcut at
	an appropriate time. To inject code, additional means will have to
	be employed.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/895/">
	<p>When insecure pages load content from secure sites into a frame,
	they can cause Opera to incorrectly report the insecure site as
	being secure. The padlock icon will incorrectly be shown, and the
	security information dialog will state that the connection is
	secure, but without any certificate information.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/896/">
	<p>As a security precaution, Opera does not allow Web pages to
	link to files on the user's local disk. However, a flaw exists
	that allows Web pages to link to feed source files on the
	user's computer. Suitable detection of JavaScript events and
	appropriate manipulation can unreliably allow a script to
	detect the difference between successful and unsuccessful
	subscriptions to these files, to allow it to discover if the
	file exists or not. In most cases the attempt will fail.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/897/">
	<p>It has been reported that when a user subscribes to a news
	feed using the feed subscription button, the page address
	can be changed. This causes the address field not to update
	correctly. Although this can mean that misleading
	information can be displayed in the address field, it can
	only leave the attacking page's address in the address bar,
	not a trusted third party address.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4195</cvename>
	<cvename>CVE-2008-4197</cvename>
	<cvename>CVE-2008-4198</cvename>
	<cvename>CVE-2008-4200</cvename>
	<url>http://www.opera.com/support/search/view/893/</url>
	<url>http://www.opera.com/support/search/view/894/</url>
	<url>http://www.opera.com/support/search/view/895/</url>
	<url>http://www.opera.com/support/search/view/896/</url>
	<url>http://www.opera.com/support/search/view/897/</url>
	</references>
	<dates>
	<discovery>2008-08-20</discovery>
	<entry>2008-08-25</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="d864a0a7-6f27-11dd-acfe-00104b9e1a4a">
	<topic>gnutls -- "gnutls_handshake()" Denial of Service</topic>
	<affects>
	<package>
	<name>gnutls</name>
	<range><ge>2.3.5</ge><lt>2.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/31505/">
	<p>A vulnerability has been reported in GnuTLS, which can
	potentially be exploited by malicious people to cause a DoS
	(Denial of Service).</p>
	<p>The vulnerability is caused due to a use-after-free error when an
	application calls "gnutls_handshake()" for an already valid session
	and can potentially be exploited, e.g. during re-handshakes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2377</cvename>
	<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947</url>
	<url>http://secunia.com/advisories/31505/</url>
	</references>
	<dates>
	<discovery>2008-08-15</discovery>
	<entry>2008-08-21</entry>
	</dates>
	</vuln>

	<vuln vid="8514b6e7-6f0f-11dd-b3db-001c2514716c">
	<topic>joomla -- flaw in the reset token validation</topic>
	<affects>
	<package>
	<name>joomla15</name>
	<range><lt>1.5.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joomla project reports:</p>
	<blockquote cite="http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html">
	<p>A flaw in the reset token validation mechanism allows
	for non-validating tokens to be forged. This will allow
	an unauthenticated, unauthorized user to reset the password
	of the first enabled user (lowest id). Typically, this is
	an administrator user. Note, that changing the first users
	username may lessen the impact of this exploit (since the
	person who changed the password does not know the login
	associated with the new password). However, the only way
	to completely rectify the issue is to upgrade to 1.5.6
	(or patch the /components/com_user/models/reset.php file).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3681</cvename>
	</references>
	<dates>
	<discovery>2008-08-14</discovery>
	<entry>2008-08-20</entry>
	<modified>2008-08-20</modified>
	</dates>
	</vuln>

	<vuln vid="c4f31e16-6e33-11dd-8eb7-0011098ad87f">
	<topic>cdf3 -- Buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>cdf3</name>
	<range><lt>3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NASA Goddard Space Flight Center reports:</p>
	<blockquote cite="http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html">
	<p>The libraries for the scientific data file format, Common Data
	Format (CDF) version 3.2 and earlier, have the potential for a
	buffer overflow vulnerability when reading specially-crafted
	(invalid) CDF files. If successful, this could trigger execution
	of arbitrary code within the context of the CDF-reading program
	that could be exploited to compromise a system, or otherwise
	crash the program. While it's unlikely that you would open CDFs
	from untrusted sources, we recommend everyone upgrade to the
	latest CDF libraries on their systems, including the IDL and
	Matlab plugins. Most worrisome is any service that enables the
	general public to submit CDF files for processing.</p>
	<p>The vulnerability is in the CDF library routines not properly
	checking the length tags on a CDF file before copying data to a
	stack buffer. Exploitation requires the user to explicitly open
	a specially-crafted file. CDF users should not open files from
	untrusted third parties until the patch is applied (and continue
	then to exercise normal caution for files from untrusted third
	parties).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2080</cvename>
	<url>http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html</url>
	</references>
	<dates>
	<discovery>2008-05-15</discovery>
	<entry>2008-08-19</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="070b5b22-6d74-11dd-aa18-0030843d3802">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.10</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/295053">
	<p>A bug in the output filter employed by Drupal makes it possible
	for malicious users to insert script code into pages (cross site
	scripting or XSS). A bug in the private filesystem trusts the MIME
	type sent by the browser, enabling malicious users with the ability
	to upload files to execute cross site scripting attacks.</p>
	<p>The BlogAPI module does not validate the extension of uploaded
	files, enabling users with the "administer content with blog api"
	permission to upload harmful files. This bug affects both Drupal
	5.x and 6.x.</p>
	<p>Drupal forms contain a token to protect against cross site
	request forgeries (CSRF). The token may not be validated properly
	for cached forms and forms containing AHAH elements. This bug
	affects Drupal 6.x.</p>
	<p>User access rules can be added or deleted upon accessing a
	properly formatted URL, making such modifications vulnerable to
	cross site request forgeries (CSRF). This may lead to unintended
	addition or deletion of an access rule when a sufficiently
	privileged user visits a page or site created by a malicious
	person. This bug affects both Drupal 5.x and 6.x.</p>
	<p>The Upload module in Drupal 6 contains privilege escalation
	vulnerabilities for users with the "upload files" permission. This
	can lead to users being able to edit nodes which they are normally
	not allowed to, delete any file to which the webserver has
	sufficient rights, and download attachments of nodes to which they
	have no access. Harmful files may also be uploaded via cross site
	request forgeries (CSRF). These bugs affect Drupal 6.x.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3740</cvename>
	<cvename>CVE-2008-3741</cvename>
	<cvename>CVE-2008-3742</cvename>
	<cvename>CVE-2008-3743</cvename>
	<cvename>CVE-2008-3744</cvename>
	<cvename>CVE-2008-3745</cvename>
	<url>http://secunia.com/advisories/31462/</url>
	</references>
	<dates>
	<discovery>2008-08-13</discovery>
	<entry>2008-08-18</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="c329712a-6b5b-11dd-9d79-001fc61c2a55">
	<topic>ruby -- multiple vulnerabilities in safe level</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.287,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
	<p>Several vulnerabilities in safe level have been discovereds:.</p>
	<ul>
	<li>untrace_var is permitted at safe level 4;</li>
	<li>$PROGRAM_NAME may be modified at safe level 4;</li>
	<li>insecure methods may be called at safe level 1-3;</li>
	<li>syslog operations are permitted at safe level 4;</li>
	<li>dl doesn't check taintness, so it could allow attackers
	to call dangerous functions.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3655</cvename>
	<cvename>CVE-2008-3656</cvename>
	<cvename>CVE-2008-3905</cvename>
	<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
	</references>
	<dates>
	<discovery>2008-08-08</discovery>
	<entry>2008-08-16</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="f7ba20aa-6b5a-11dd-9d79-001fc61c2a55">
	<topic>ruby -- DoS vulnerability in WEBrick</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
	<p>WEBrick::HTTP::DefaultFileHandler is faulty of exponential time
	taking requests due to a backtracking regular expression in
	WEBrick::HTTPUtils.split_header_value.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3655</cvename>
	<cvename>CVE-2008-3656</cvename>
	<cvename>CVE-2008-3905</cvename>
	<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
	</references>
	<dates>
	<discovery>2008-08-08</discovery>
	<entry>2008-08-16</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="959d384d-6b59-11dd-9d79-001fc61c2a55">
	<topic>ruby -- DNS spoofing vulnerability</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
	<p>resolv.rb allow remote attackers to spoof DNS answers. This risk
	can be reduced by randomness of DNS transaction IDs and source
	ports.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1447</cvename>
	<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
	</references>
	<dates>
	<discovery>2008-08-08</discovery>
	<entry>2008-08-16</entry>
	<modified>2009-02-09</modified>
	</dates>
	</vuln>

	<vuln vid="1d96305d-6ae6-11dd-91d5-000c29d47fd7">
	<topic>Bugzilla -- Directory Traversal in importxml.pl</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.22.1</ge><lt>2.22.4</lt></range>
	<range><ge>3.*</ge><lt>3.0.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/2.22.4/">
	<p>When importing bugs using importxml.pl, the --attach_path
	option can be specified, pointing to the directory where
	attachments to import are stored. If the XML file being
	read by importxml.pl contains a malicious</p>
	<pre>../relative_path/to/local_file</pre>
	<p>node, the script follows this relative path and attaches the
	local file pointed by it to the bug, making the file public.
	The security fix makes sure the relative path is always
	ignored.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-4437</cvename>
	<url>https://bugzilla.mozilla.org/show_bug.cgi?id=437169</url>
	</references>
	<dates>
	<discovery>2008-06-03</discovery>
	<entry>2008-08-15</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="c61ca9cb-64c3-11dd-954d-006097bcc5f4">
	<topic>openvpn-devel -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>openvpn-devel</name>
	<range><ge>2.1.b14</ge><lt>2.1.r9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/index.php/documentation/change-log/changelog-21.html">
	<p>Security Fix - affects non-Windows OpenVPN clients running
	OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
	vulnerable nor are any versions of the OpenVPN server
	vulnerable).</p>
	<p>An OpenVPN client connecting to a malicious or compromised server
	could potentially receive an "lladdr" or "iproute" configuration
	directive from the server which could cause arbitrary code execution
	on the client. A successful attack requires that (a) the client has
	agreed to allow the server to push configuration directives to it by
	including "pull" or the macro "client" in its configuration file,
	(b) the client succesfully authenticates the server, (c) the server
	is malicious or has been compromised and is under the control of the
	attacker, and (d) the client is running a non-Windows OS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3459</cvename>
	<url>http://openvpn.net/index.php/documentation/change-log/changelog-21.html</url>
	</references>
	<dates>
	<discovery>2008-07-31</discovery>
	<entry>2008-08-07</entry>
	</dates>
	</vuln>

	<vuln vid="35e54755-54e4-11dd-ad8b-0030843d3802">
	<topic>phpmyadmin -- cross site request forgery vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5">
	<p>A logged-in user, if abused into clicking a crafted link or loading
	an attack page, would create a database he did not intend to, or would
	change his connection character set.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5</url>
	<url>http://secunia.com/advisories/31115/</url>
	</references>
	<dates>
	<discovery>2008-07-15</discovery>
	<entry>2008-07-18</entry>
	<modified>2008-09-17</modified>
	</dates>
	</vuln>

	<vuln vid="ecedde1c-5128-11dd-a4e1-0030843d3802">
	<topic>drupal -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.8</lt></range>
	</package>
	<package>
	<name>drupal6</name>
	<range><lt>6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/280571">
	<p>Free tagging taxonomy terms can be used to insert arbitrary script
	and HTML code (cross site scripting or XSS) on node preview pages. A
	successful exploit requires that the victim selects a term containing
	script code and chooses to preview the node. This issue affects Drupal
	6.x only. Some values from OpenID providers are output without being
	properly escaped, allowing malicious providers to insert arbitrary script
	and HTML code (XSS) into user pages. This issue affects Drupal 6.x only.
	filter_xss_admin() has been hardened to prevent use of the object HTML
	tag in administrator input.</p>
	<p>Translated strings (5.x, 6.x) and OpenID identities (6.x) are
	immediately deleted upon accessing a properly formatted URL, making
	such deletion vulnerable to cross site request forgeries (CSRF). This
	may lead to unintended deletion of translated strings or OpenID
	identities when a sufficiently privileged user visits a page or site
	created by a malicious person.</p>
	<p>When contributed modules such as Workflow NG terminate the current
	request during a login event, user module is not able to regenerate
	the user's session. This may lead to a session fixation attack, when a
	malicious user is able to control another users' initial session ID.
	As the session is not regenerated, the malicious user may use the
	'fixed' session ID after the victim authenticates and will have the
	same access. This issue affects both Drupal 5 and Drupal 6.</p>
	<p>Schema API uses an inappropriate placeholder for 'numeric' fields
	enabling SQL injection when user-supplied data is used for such
	fields.This issue affects Drupal 6 only.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-3218</cvename>
	<cvename>CVE-2008-3221</cvename>
	<url>http://drupal.org/node/280571</url>
	<url>http://secunia.com/advisories/31028/</url>
	</references>
	<dates>
	<discovery>2008-07-09</discovery>
	<entry>2008-07-13</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="655ee1ec-511b-11dd-80ba-000bcdf0a03b">
	<topic>FreeBSD -- DNS cache poisoning</topic>
	<affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_3</lt></range>
	<range><ge>7.0</ge><lt>7.0_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The BIND DNS implementation does not randomize the UDP source
	port when doing remote queries, and the query id alone does
	not provide adequate randomization.</p>
	<h1>Impact:</h1>
	<p>The lack of source port randomization reduces the amount of
	data the attacker needs to guess in order to successfully
	execute a DNS cache poisoning attack. This allows the
	attacker to influence or control the results of DNS queries
	being returned to users from target systems.</p>
	<h1>Workaround:</h1>
	<p>Limiting the group of machines that can do recursive queries
	on the DNS server will make it more difficult, but not
	impossible, for this vulnerability to be exploited.</p>
	<p>To limit the machines able to perform recursive queries, add an ACL in
	named.conf and limit recursion like the following:</p>
	<pre>acl example-acl {</pre>
	<pre> 192.0.2.0/24;</pre>
	<pre>};</pre>
	<pre>options {</pre>
	<pre> recursion yes;</pre>
	<pre> allow-recursion { example-acl; };</pre>
	<pre>};</pre>
	</body>
	</description>
	<references>
	<certvu>800113</certvu>
	<cvename>CVE-2008-1447</cvename>
	<freebsdsa>SA-08:06.bind</freebsdsa>
	</references>
	<dates>
	<discovery>2008-07-08</discovery>
	<entry>2008-07-13</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="bc20510f-4dd4-11dd-93e7-0211d880e350">
	<topic>poppler -- uninitialized pointer</topic>
	<affects>
	<package>
	<name>poppler</name>
	<range><lt>0.8.4_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Felipe Andres Manzano reports:</p>
	<blockquote cite="http://milw0rm.com/exploits/6032">
	<p>The libpoppler pdf rendering library, can free
	uninitialized pointers, leading to arbitrary code
	execution. This vulnerability results from memory
	management bugs in the Page class constructor/destructor.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2950</cvename>
	<url>http://milw0rm.com/exploits/6032</url>
	</references>
	<dates>
	<discovery>2008-07-07</discovery>
	<entry>2008-07-09</entry>
	</dates>
	</vuln>

	<vuln vid="f5c58fc1-49c0-11dd-b0ba-00163e000016">
	<topic>py-pylons -- Path traversal bug</topic>
	<affects>
	<package>
	<name>py24-pylons</name>
	<range><lt>0.9.6.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pylons team reports:</p>
	<blockquote cite="http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2">
	<p>The error.py controller uses paste.fileapp to serve the static
	resources to the browser. The default error.py controller uses
	os.path.join to combine the id from Routes with the media path.
	Routes prior to 1.8 double unquoted the PATH_INFO, resulting in
	FileApp returning files from the filesystem that can be outside
	of the intended media path directory.</p>
	<p>An attacker can craft URL's which utilize the double escaping
	to pass in a name to the error.py controller which contains a
	leading slash thus escaping the intended media path and serving
	files from any location on the filesystem that the Pylons
	application has access to.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2</url>
	</references>
	<dates>
	<discovery>2008-05-28</discovery>
	<entry>2008-07-04</entry>
	</dates>
	</vuln>

	<vuln vid="4fb43b2f-46a9-11dd-9d38-00163e000016">
	<topic>FreeType 2 -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>freetype2</name>
	<range><lt>2.3.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30600">
	<ul>
	<li>An integer overflow error exists in the processing of PFB font
	files. This can be exploited to cause a heap-based buffer overflow
	via a PFB file containing a specially crafted "Private" dictionary
	table.</li>
	<li>An error in the processing of PFB font files can be exploited
	to trigger the "free()" of memory areas that are not allocated on
	the heap.</li>
	<li>An off-by-one error exists in the processing of PFB font files.
	This can be exploited to cause a one-byte heap-based buffer
	overflow via a specially crafted PFB file.</li>
	<li>An off-by-one error exists in the implementation of the "SHC"
	instruction while processing TTF files. This can be exploited to
	cause a one-byte heap-based buffer overflow via a specially crafted
	TTF file.</li>
	</ul>
	<p>Successful exploitation of the vulnerabilities may allow execution
	of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>29637</bid>
	<bid>29639</bid>
	<bid>29640</bid>
	<bid>29641</bid>
	<cvename>CVE-2008-1806</cvename>
	<cvename>CVE-2008-1807</cvename>
	<cvename>CVE-2008-1808</cvename>
	<url>http://secunia.com/advisories/30600</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=605780</url>
	</references>
	<dates>
	<discovery>2008-06-10</discovery>
	<entry>2008-07-03</entry>
	</dates>
	</vuln>

	<vuln vid="1e8e63c0-478a-11dd-a88d-000ea69a5213">
	<topic>fetchmail -- potential crash in -v -v verbose mode (revised patch)</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><lt>6.3.8_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
	<p>2008-06-24 1.2 also fixed issue in report_complete (reported by
	Petr Uzel)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2711</cvename>
	<url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
	</references>
	<dates>
	<discovery>2008-06-24</discovery>
	<entry>2008-07-01</entry>
	</dates>
	</vuln>

	<vuln vid="e285a1f4-4568-11dd-ae96-0030843d3802">
	<topic>phpmyadmin -- Cross Site Scripting Vulnerabilities</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia report:</p>
	<blockquote cite="http://secunia.com/advisories/30813/">
	<p>Some vulnerabilities have been reported in phpMyAdmin, which can be
	exploited by malicious people to conduct cross-site scripting
	attacks.</p>
	<p>Input passed via unspecified parameters to files in /libraries is not
	properly sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a user's
	browser session in context of an affected site.</p>
	<p>Successful exploitation requires that "register_globals" is enabled
	and support for ".htaccess" files is disabled.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2960</cvename>
	<url>http://secunia.com/advisories/30813/</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4</url>
	</references>
	<dates>
	<discovery>2008-06-23</discovery>
	<entry>2008-06-28</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="c84dc9ad-41f7-11dd-a4f9-00163e000016">
	<topic>apache -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache HTTP server project reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
	<p>The following potential security flaws are addressed:</p>
	<ul>
	<li>CVE-2008-2364: mod_proxy_http: Better handling of excessive
	interim responses from origin server to prevent potential denial of
	service and high memory usage. Reported by Ryujiro Shibuya.</li>
	<li>CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against
	the balancer-manager interface</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6420</cvename>
	<cvename>CVE-2008-2364</cvename>
	<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
	</references>
	<dates>
	<discovery>2008-06-14</discovery>
	<entry>2008-06-24</entry>
	</dates>
	</vuln>

	<vuln vid="ee6fa2bd-406a-11dd-936a-0015af872849">
	<topic>php -- input validation error in safe_mode</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.6_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to Maksymilian Arciemowicz research,
	it is possible to bypass security restrictions
	of <code>safe_mode</code> in various
	functions via directory traversal vulnerability. The attacker
	can use this attack to gain access to sensitive
	information. Functions utilizing
	<code>expand_filepath()</code> may be affected.</p>
	<p>It should be noted that this vulnerability is not
	considered to be serious by the FreeBSD Security Team,
	since <code>safe_mode</code> and <code>open_basedir</code>
	are insecure by design and should not be relied upon.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2665</cvename>
	<cvename>CVE-2008-2666</cvename>
	<bid>29797</bid>
	<url>http://securityreason.com/achievement_securityalert/54</url>
	</references>
	<dates>
	<discovery>2008-06-17</discovery>
	<entry>2008-06-22</entry>
	<modified>2008-09-04</modified>
	</dates>
	</vuln>

	<vuln vid="30866e6c-3c6d-11dd-98c9-00163e000016">
	<topic>vim -- Vim Shell Command Injection Vulnerabilities</topic>
	<affects>
	<package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim-ruby</name>
	<name>vim6</name>
	<name>vim6-ruby</name>
	<range><gt>6</gt><le>6.4.10</le></range>
	<range><gt>7</gt><lt>7.1.315</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rdancer.org reports:</p>
	<blockquote cite="http://www.rdancer.org/vulnerablevim.html">
	<p>Improper quoting in some parts of Vim written in the Vim Script
	can lead to arbitrary code execution upon opening a crafted
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2712</cvename>
	<url>http://www.rdancer.org/vulnerablevim.html</url>
	</references>
	<dates>
	<discovery>2008-06-16</discovery>
	<entry>2008-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="53802164-3f7e-11dd-90ea-0019666436c2">
	<topic>ruby -- multiple integer and buffer overflow vulnerabilities</topic>
	<affects>
	<package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.111_3,1</lt></range>
	</package>
	<package>
	<name>ruby_static</name>
	<range><ge>1.8.*,1</ge></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/">
	<p>Multiple vulnerabilities in Ruby may lead to a denial of service
	(DoS) condition or allow execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2726</cvename>
	<url>http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/</url>
	</references>
	<dates>
	<discovery>2008-06-19</discovery>
	<entry>2008-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="168190df-3e9a-11dd-87bc-000ea69a5213">
	<topic>fetchmail -- potential crash in -v -v verbose mode</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><lt>6.3.8_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
	<p>Gunter Nau reported fetchmail crashing on some messages; further
	debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic
	dug up that this happened when fetchmail was trying to print, in
	-v -v verbose level, headers exceeding 2048 bytes. In this
	situation, fetchmail would resize the buffer and fill in further
	parts of the message, but forget to reinitialize its va_list
	typed source pointer, thus reading data from a garbage address found
	on the stack at addresses above the function arguments the caller
	passed in; usually that would be the caller's stack frame.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2711</cvename>
	<url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
	</references>
	<dates>
	<discovery>2008-06-13</discovery>
	<entry>2008-06-20</entry>
	</dates>
	</vuln>

	<vuln vid="800e8bd5-3acb-11dd-8842-001302a18722">
	<topic>xorg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><lt>1.4.2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthieu Herrb of X.Org reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-June/036026.html">
	<p>Several vulnerabilities have been found in the server-side code
	of some extensions in the X Window System. Improper validation of
	client-provided data can cause data corruption.</p>
	<p>Exploiting these overflows will crash the X server or,
	under certain circumstances allow the execution of arbitray machine
	code.</p>
	<p>When the X server is running with root privileges (which is the case
	for the Xorg server and for most kdrive based servers), these
	vulnerabilities can thus also be used to raise privileges.</p>
	<p>All these vulnerabilities, to be exploited successfully, require either
	an already established connection to a running X server (and normally
	running X servers are only accepting authenticated connections), or a
	shell access with a valid user on the machine where the vulnerable
	server is installed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1377</cvename>
	<cvename>CVE-2008-1379</cvename>
	<cvename>CVE-2008-2360</cvename>
	<cvename>CVE-2008-2361</cvename>
	<cvename>CVE-2008-2362</cvename>
	<url>http://lists.freedesktop.org/archives/xorg/2008-June/036026.html</url>
	<url>http://secunia.com/advisories/30627/</url>
	</references>
	<dates>
	<discovery>2008-06-11</discovery>
	<entry>2008-06-15</entry>
	</dates>
	</vuln>

	<vuln vid="c4ba95b2-39ce-11dd-98c9-00163e000016">
	<topic>moinmoin -- superuser privilege escalation</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MoinMoin team reports:</p>
	<blockquote cite="http://hg.moinmo.in/moin/1.6/rev/f405012e67af">
	<p>A check in the userform processing was not working as expected and
	could be abused for ACL and superuser privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1937</cvename>
	<url>http://hg.moinmo.in/moin/1.6/rev/f405012e67af</url>
	</references>
	<dates>
	<discovery>2008-04-20</discovery>
	<entry>2008-06-14</entry>
	<modified>2008-06-15</modified>
	</dates>
	</vuln>

	<vuln vid="022baf71-38e6-11dd-8d34-00e0815b8da8">
	<topic>Courier Authentication Library -- SQL Injection</topic>
	<affects>
	<package>
	<name>courier-authlib</name>
	<range><lt>0.60.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30591/">
	<p>A vulnerability has been reported in the Courier Authentication
	Library, which can be exploited by malicious people to conduct SQL
	injection attacks.</p>
	<p>Input passed via e.g. the username to the library is not properly
	sanitised before being used in SQL queries. This can be exploited to
	manipulate SQL queries by injecting arbitrary SQL code and e.g.
	potentially bypass authentication.</p>
	<p>Successful exploitation requires that a MySQL database is used for
	authentication and that a Non-Latin character set is selected.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/30591/</url>
	</references>
	<dates>
	<discovery>2008-06-10</discovery>
	<entry>2008-06-13</entry>
	</dates>
	</vuln>

	<vuln vid="90db9983-2f53-11dd-a0d8-0016d325a0ed">
	<topic>ikiwiki -- cleartext passwords</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>2.48</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ikiwiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index32h2">
	<p>Until version 2.48, ikiwiki stored passwords in cleartext in
	the userdb. That risks exposing all users' passwords if the file
	is somehow exposed. To pre-emtively guard against that, current
	versions of ikiwiki store password hashes (using Eksblowfish).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://ikiwiki.info/security/#index32h2</url>
	</references>
	<dates>
	<discovery>2008-05-30</discovery>
	<entry>2008-06-01</entry>
	</dates>
	</vuln>

	<vuln vid="09066828-2ef1-11dd-a0d8-0016d325a0ed">
	<topic>ikiwiki -- empty password security hole</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><ge>1.34</ge><lt>2.47_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ikiwiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index33h2">
	<p>This hole allowed ikiwiki to accept logins using empty
	passwords to openid accounts that didn't use a password.</p>
	<p>Upgrading to a non-vulnerable ikiwiki version immediatly is
	recommended if your wiki allows both password and openid
	logins.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0169</cvename>
	<url>http://ikiwiki.info/security/#index33h2</url>
	</references>
	<dates>
	<discovery>2008-05-30</discovery>
	<entry>2008-05-31</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="04c6187d-2d8f-11dd-98c9-00163e000016">
	<topic>linux-flashplugin -- unspecified remote code execution vulnerability</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r124</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Product Security Incident Response Team reports:</p>
	<blockquote cite="http://blogs.adobe.com/psirt/">
	<p>An exploit appears to be taking advantage of a known
	vulnerability, reported by Mark Dowd of the ISS X-Force and wushi
	of team509, that was resolved in Flash Player 9.0.124.0
	(CVE-2007-0071). This exploit does NOT appear to include a new,
	unpatched vulnerability as has been reported elsewhere - customers
	with Flash Player 9.0.124.0 should not be vulnerable to this
	exploit.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>29386</bid>
	<cvename>CVE-2007-0071</cvename>
	<url>http://blogs.adobe.com/psirt/</url>
	</references>
	<dates>
	<discovery>2008-05-27</discovery>
	<entry>2008-05-30</entry>
	</dates>
	</vuln>

	<vuln vid="fbd7aa81-2cc1-11dd-8cfb-00e0815b8da8">
	<topic>Nagios -- Cross Site Scripting Vulnerability</topic>
	<affects>
	<package>
	<name>nagios</name>
	<range><lt>2.12</lt></range>
	<range><gt>3.*</gt><lt>3.0.2</lt></range>
	</package>
	<package>
	<name>nagios-devel</name>
	<range><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30283">
	<p>A vulnerability has been reported in Nagios, which can be
	exploited by malicious people to conduct cross-site scripting
	attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>29140</bid>
	<cvename>CVE-2007-5803</cvename>
	<url>http://secunia.com/advisories/30283</url>
	</references>
	<dates>
	<discovery>2008-05-20</discovery>
	<entry>2008-05-28</entry>
	<modified>2008-09-08</modified>
	</dates>
	</vuln>

	<vuln vid="555ac165-2bee-11dd-bbdc-00e0815b8da8">
	<topic>spamdyke -- open relay</topic>
	<affects>
	<package>
	<name>spamdyke</name>
	<range><lt>3.1.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Spamdyke Team reports:</p>
	<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
	<p>Fixed smtp_filter() to reject the DATA command if no valid
	recipients have been specified. Otherwise, a specific scenario could
	result in every spamdyke installation being used as an open relay.
	If the remote server connects and gives one or more recipients that
	are rejected (for relaying or blacklisting), then gives the DATA
	command, spamdyke will ignore all other commands, assuming that
	message data is being transmitted. However, because all of the
	recipients were rejected, qmail will reject the DATA command. From
	that point on, the remote server can give as many recipients as it
	likes and spamdyke will ignore them all -- they will not be filtered
	at all. After that, the remote server can give the DATA command and
	send the actual message data. Because spamdyke is controlling
	relaying, the RELAYCLIENT environment variable is set and qmail won't
	check for relaying either. Thanks to Mirko Buffoni for reporting
	this one.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2784</cvename>
	<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
	</references>
	<dates>
	<discovery>2008-05-21</discovery>
	<entry>2008-05-27</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="402ae710-26a2-11dd-ae05-825f4c35000a">
	<topic>peercast -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>peercast</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nico Golde discovered that PeerCast, a P2P audio and
	video streaming server, is vulnerable to a buffer overflow
	in the HTTP Basic Authentication code, allowing a remote
	attacker to crash PeerCast or execure arbitrary code.</p>
	</body>
	</description>
	<references>
	<bid>28986</bid>
	<cvename>CVE-2008-2040</cvename>
	<url>http://secunia.com/advisories/30020</url>
	</references>
	<dates>
	<discovery>2008-05-20</discovery>
	<entry>2008-05-21</entry>
	</dates>
	</vuln>

	<vuln vid="f5a76faf-244c-11dd-b143-0211d880e350">
	<topic>libvorbis -- various security issues</topic>
	<affects>
	<package>
	<name>libvorbis</name>
	<range><lt>1.2.0_2,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Red Hat reports:</p>
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2008-0270.html">
	<p>Will Drewry of the Google Security Team reported several
	flaws in the way libvorbis processed audio data. An
	attacker could create a carefully crafted [Vorbis] audio file
	in such a way that it could cause an application linked
	with libvorbis to crash, or execute arbitrary code when
	it was opened.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1419</cvename>
	<cvename>CVE-2008-1420</cvename>
	<cvename>CVE-2008-1423</cvename>
	<url>https://rhn.redhat.com/errata/RHSA-2008-0270.html</url>
	</references>
	<dates>
	<discovery>2008-05-14</discovery>
	<entry>2008-05-17</entry>
	</dates>
	</vuln>

	<vuln vid="f49ba347-2190-11dd-907c-001c2514716c">
	<topic>django -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<range><lt>0.96.2</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<range><lt>20080511</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django project reports:</p>
	<blockquote cite="http://www.djangoproject.com/weblog/2008/may/14/security/">
	<p>The Django administration application will, when accessed by
	a user who is not sufficiently authenticated, display a login
	form and ask the user to provide the necessary credentials
	before displaying the requested page. This form will be submitted
	to the URL the user attempted to access, by supplying the current
	request path as the value of the form's "action" attribute.</p>
	<p>The value of the request path was not being escaped, creating an
	opportunity for a cross-site scripting (XSS) attack by leading a
	user to a URL which contained URL-encoded HTML and/or JavaScript
	in the request path.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2302</cvename>
	<url>http://www.djangoproject.com/weblog/2008/may/14/security/</url>
	</references>
	<dates>
	<discovery>2008-05-10</discovery>
	<entry>2008-05-14</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="633716fa-1f8f-11dd-b143-0211d880e350">
	<topic>vorbis-tools -- Speex header processing vulnerability</topic>
	<affects>
	<package>
	<name>vorbis-tools</name>
	<range><lt>1.2.0_2,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29882/">
	<p>A vulnerability has been reported in vorbis-tools,
	which can potentially be exploited by malicious people
	to compromise a user's system.</p>
	<p>The vulnerability is caused due to an input validation
	error when processing Speex headers, which can be
	exploited via a specially crafted Speex stream containing
	a negative "modeID" field in the header.</p>
	<p>Successful exploitation may allow execution of arbitrary
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1686</cvename>
	<url>http://secunia.com/advisories/29882/</url>
	</references>
	<dates>
	<discovery>2008-04-18</discovery>
	<entry>2008-05-11</entry>
	</dates>
	</vuln>

	<vuln vid="8950ac62-1d30-11dd-9388-0211060005df">
	<topic>qemu -- "drive_init()" Disk Format Security Bypass</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.1_6</lt></range>
	<range><ge>0.9.1s.20070101*</ge><lt>0.9.1s.20080302_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/30111/">
	<p>A vulnerability has been reported in QEMU, which can be exploited
	by malicious, local users to bypass certain security
	restrictions.</p>
	<p>The vulnerability is caused due to the "drive_init()" function
	in vl.c determining the format of a disk from data contained in
	the disk's header. This can be exploited by a malicious user in
	a guest system to e.g. read arbitrary files on the host by
	writing a fake header to a raw formatted disk image.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-2004</cvename>
	<url>http://secunia.com/advisories/30111/</url>
	<mlist>http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html</mlist>
	</references>
	<dates>
	<discovery>2008-04-28</discovery>
	<entry>2008-05-08</entry>
	</dates>
	</vuln>

	<vuln vid="5ef12755-1c6c-11dd-851d-0016d325a0ed">
	<topic>swfdec -- exposure of sensitive information</topic>
	<affects>
	<package>
	<name>swfdec</name>
	<range><lt>0.6.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29915">
	<p>A vulnerability has been reported in swfdec, which can be
	exploited by malicious people to disclose sensitive
	information.</p>
	<p>The vulnerability is caused due to swfdec not properly
	restricting untrusted sandboxes from reading local files,
	which can be exploited to disclose the content of arbitrary
	local files by e.g. tricking a user into visiting a malicious
	website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1834</cvename>
	<url>http://secunia.com/advisories/29915</url>
	</references>
	<dates>
	<discovery>2008-04-09</discovery>
	<entry>2008-05-07</entry>
	</dates>
	</vuln>

	<vuln vid="86a4d810-1884-11dd-a914-0016179b2dd5">
	<topic>mt-daapd -- integer overflow</topic>
	<affects>
	<package>
	<name>mt-daapd</name>
	<range><lt>0.2.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>FrSIRT reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2008/1303">
	<p>A vulnerability has been identified in mt-daapd which could be exploited
	by remote attackers to cause a denial of service or compromise an
	affected system. This issue is caused by a buffer overflow error in the
	ws_getpostvars() function when processing a negative Content-Length:
	header value, which could be exploited by remote unauthenticated
	attackers to crash an affected application or execute arbitrary
	code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1771</cvename>
	<url>http://secunia.com/advisories/29917</url>
	<url>http://www.frsirt.com/english/advisories/2008/1303</url>
	</references>
	<dates>
	<discovery>2008-04-21</discovery>
	<entry>2008-05-02</entry>
	</dates>
	</vuln>

	<vuln vid="b1bcab7d-1880-11dd-a914-0016179b2dd5">
	<topic>sdl_image -- buffer overflow vulnerabilities</topic>
	<affects>
	<package>
	<name>sdl_image</name>
	<range><lt>1.2.6_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/28640">
	<p>Two vulnerabilities have been reported in SDL_image, which can be
	exploited by malicious people to cause a Denial of Service or potentially
	compromise an application using the library.</p>
	<p>A boundary error within the LWZReadByte() function in IMG_gif.c can
	be exploited to trigger the overflow of a static buffer via a
	specially crafted GIF file.</p>
	<p>A boundary error within the "IMG_LoadLBM_RW()" function in IMG_lbm.c
	can be exploited to cause a heap-based buffer overflow via a specially
	crafted IFF ILBM file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6697</cvename>
	<cvename>CVE-2008-0544</cvename>
	<url>http://secunia.com/advisories/28640</url>
	</references>
	<dates>
	<discovery>2008-01-24</discovery>
	<entry>2008-05-02</entry>
	</dates>
	</vuln>

	<vuln vid="30394651-13e1-11dd-bab7-0016179b2dd5">
	<topic>gnupg -- memory corruption vulnerability</topic>
	<affects>
	<package>
	<name>gnupg</name>
	<range><ge>1.0.0</ge><lt>1.4.9</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29568">
	<p>A vulnerability has been reported in GnuPG, which can potentially
	be exploited to compromise a vulnerable system.</p>
	<p>The vulnerability is caused due to an error when importing keys
	with duplicated IDs. This can be exploited to cause a memory
	corruption when importing keys via --refresh-keys or --import.</p>
	<p>Successful exploitation potentially allows execution of arbitrary
	code, but has not been proven yet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28487</bid>
	<cvename>CVE-2008-1530</cvename>
	<url>http://www.ocert.org/advisories/ocert-2008-1.html</url>
	<url>http://secunia.com/advisories/29568</url>
	<url>https://bugs.g10code.com/gnupg/issue894</url>
	</references>
	<dates>
	<discovery>2008-03-19</discovery>
	<entry>2008-04-26</entry>
	<modified>2008-04-29</modified>
	</dates>
	</vuln>

	<vuln vid="44c8694a-12f9-11dd-9b26-001c2514716c">
	<topic>extman -- password bypass vulnerability</topic>
	<affects>
	<package>
	<name>extman</name>
	<range><ge>0.2.4</ge><lt>0.2.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Extmail team reports:</p>
	<blockquote cite="http://www.extmail.org/forum/thread-7260-1-1.html">
	<p>Emergency update #4 fixes a serious security vulnerability.</p>
	</blockquote>
	<p>Successful exploit of this vulnerability would allow attacker to
	change user's password without knowing it by using specifically
	crafted HTTP request.</p>
	</body>
	</description>
	<references>
	<url>http://www.extmail.org/forum/thread-7260-1-1.html</url>
	</references>
	<dates>
	<discovery>2008-04-01</discovery>
	<entry>2008-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="f47f2746-12c5-11dd-bab7-0016179b2dd5">
	<topic>mailman -- script insertion vulnerability</topic>
	<affects>
	<package>
	<name>ja-mailman</name>
	<name>mailman</name>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/28794">
	<p>A vulnerability has been reported in Mailman, which can be
	exploited by malicious users to conduct script insertion
	attacks.</p>
	<p>Certain input when editing the list templates and the list info
	attribute is not properly sanitised before being stored. This can be
	exploited to insert arbitrary HTML and script code, which is
	executed in a user's browser session in context of an affected site
	when the malicious website is accessed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0564</cvename>
	<bid>27630</bid>
	<url>http://www.ubuntu.com/usn/usn-586-1</url>
	<url>http://secunia.com/advisories/28794</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=593924</url>
	</references>
	<dates>
	<discovery>2008-02-05</discovery>
	<entry>2008-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="86c05550-12c1-11dd-bab7-0016179b2dd5">
	<topic>mksh -- TTY attachment privilege escalation</topic>
	<affects>
	<package>
	<name>mksh</name>
	<range><lt>R33d</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29803/">
	<p>The vulnerability is caused due to an error when attaching to a TTY
	via the -T command line switch. This can be exploited to execute
	arbitrary commands with the privileges of the user running mksh via
	characters previously written to the attached virtual console.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1845</cvename>
	<url>http://secunia.com/advisories/29803/</url>
	<url>http://www.mirbsd.org/mksh.htm#clog</url>
	</references>
	<dates>
	<discovery>2008-04-14</discovery>
	<entry>2008-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="9c133aa0-12bd-11dd-bab7-0016179b2dd5">
	<topic>serendipity -- multiple cross site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>serendipity</name>
	<range><lt>1.3.1</lt></range>
	</package>
	<package>
	<name>serendipity-devel</name>
	<range><lt>200804242342</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hanno Boeck reports:</p>
	<blockquote cite="http://int21.de/cve/CVE-2008-1386-s9y.html">
	<p>The installer of serendipity 1.3 has various Cross Site Scripting
	issues. This is considered low priority, as attack scenarios are
	very unlikely.</p>
	<p>Various path fields are not escaped properly, thus filling them
	with javascript code will lead to XSS. MySQL error messages are not
	escaped, thus the database host field can also be filled with
	javascript.</p>
	</blockquote>
	<blockquote cite="http://int21.de/cve/CVE-2008-1385-s9y.html">
	<p>In the referrer plugin of the blog application serendipity,
	the referrer string is not escaped, thus leading to a permanent
	XSS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28885</bid>
	<cvename>CVE-2008-1385</cvename>
	<cvename>CVE-2008-1386</cvename>
	<url>http://int21.de/cve/CVE-2008-1385-s9y.html</url>
	<url>http://int21.de/cve/CVE-2008-1386-s9y.html</url>
	<url>http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html</url>
	</references>
	<dates>
	<discovery>2008-04-22</discovery>
	<entry>2008-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="67bd39ba-12b5-11dd-bab7-0016179b2dd5">
	<topic>firefox -- javascript garbage collector vulnerability</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.14,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.14</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.10</lt></range>
	</package>
	<package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.1.2</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/2008/mfsa2008-20.html">
	<p>Fixes for security problems in the JavaScript engine described in
	MFSA 2008-15 introduced a stability problem, where some users
	experienced crashes during JavaScript garbage collection. This is
	being fixed primarily to address stability concerns. We have no
	demonstration that this particular crash is exploitable but are
	issuing this advisory because some crashes of this type have been
	shown to be exploitable in the past.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1237</cvename>
	<cvename>CVE-2008-1380</cvename>
	<bid>28818</bid>
	<url>http://secunia.com/advisories/29787</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-20.html</url>
	</references>
	<dates>
	<discovery>2008-04-16</discovery>
	<entry>2008-04-25</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="57c705d6-12ae-11dd-bab7-0016179b2dd5">
	<topic>png -- unknown chunk processing uninitialized memory access</topic>
	<affects>
	<package>
	<name>png</name>
	<range><lt>1.2.27</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://.com/advisories/29792">
	<p>Tavis Ormandy has reported a vulnerability in libpng, which can be
	exploited by malicious people to cause a Denial of Service, disclose
	potentially sensitive information, or potentially compromise an
	application using the library.</p>
	<p>The vulnerability is caused due to the improper handling of PNG
	chunks unknown to the library. This can be exploited to trigger the
	use of uninitialized memory in e.g. a free() call via unknown PNG
	chunks having a length of zero.</p>
	<p>Successful exploitation may allow execution of arbitrary code, but
	requires that the application calls the png_set_read_user_chunk_fn()
	function or the png_set_keep_unknown_chunks() function under
	specific conditions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1382</cvename>
	<bid>28770</bid>
	<url>http://secunia.com/advisories/29792</url>
	<url>http://libpng.sourceforge.net/Advisory-1.2.26.txt</url>
	</references>
	<dates>
	<discovery>2008-04-12</discovery>
	<entry>2008-04-25</entry>
	<modified>2008-04-29</modified>
	</dates>
	</vuln>

	<vuln vid="b84a992a-12ab-11dd-bab7-0016179b2dd5">
	<topic>openfire -- unspecified denial of service</topic>
	<affects>
	<package>
	<name>openfire</name>
	<range><lt>3.5.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29751">
	<p>A vulnerability has been reported in Openfire, which can be
	exploited by malicious people to cause a Denial of Service.</p>
	<p>The vulnerability is caused due to an unspecified error and can be
	exploited to cause a Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1728</cvename>
	<bid>28722</bid>
	<url>http://secunia.com/advisories/29751</url>
	<url>http://www.igniterealtime.org/issues/browse/JM-1289</url>
	</references>
	<dates>
	<discovery>2008-04-10</discovery>
	<entry>2008-04-25</entry>
	</dates>
	</vuln>

	<vuln vid="f6377f08-12a7-11dd-bab7-0016179b2dd5">
	<topic>php -- integer overflow vulnerability</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/28392/discuss">
	<p>Integer overflow in PHP 5.2.5 and earlier allows context-dependent
	attackers to cause a denial of service and possibly have unspecified
	other impact via a printf format parameter with a large width
	specifier, related to the php_sprintf_appendstring function in
	formatted_print.c and probably other functions for formatted strings
	(aka *printf functions).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1384</cvename>
	<bid>28392</bid>
	<url>http://securityreason.com/achievement_securityalert/52</url>
	</references>
	<dates>
	<discovery>2008-03-21</discovery>
	<entry>2008-04-25</entry>
	<modified>2008-05-02</modified>
	</dates>
	</vuln>

	<vuln vid="ec41c3e2-129c-11dd-bab7-0016179b2dd5">
	<topic>python -- Integer Signedness Error in zlib Module</topic>
	<affects>
	<package>
	<name>python23</name>
	<range><lt>2.3.6_1</lt></range>
	</package>
	<package>
	<name>python24</name>
	<range><lt>2.4.5_1</lt></range>
	</package>
	<package>
	<name>python25</name>
	<range><lt>2.5.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Justin Ferguson reports:</p>
	<blockquote cite="http://bugs.python.org/issue2586">
	<p>Integer signedness error in the zlib extension module in Python
	2.5.2 and earlier allows remote attackers to execute arbitrary code
	via a negative signed integer, which triggers insufficient memory
	allocation and a buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1721</cvename>
	<bid>28715</bid>
	<url>http://securityreason.com/securityalert/3802</url>
	<url>http://bugs.python.org/issue2586</url>
	</references>
	<dates>
	<discovery>2008-04-10</discovery>
	<entry>2008-04-25</entry>
	<modified>2008-04-28</modified>
	</dates>
	</vuln>

	<vuln vid="51436b4c-1250-11dd-bab7-0016179b2dd5">
	<topic>postgresql -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<range><ge>7.3</ge><lt>7.3.21</lt></range>
	<range><ge>7.4</ge><lt>7.4.19</lt></range>
	<range><ge>8.0</ge><lt>8.0.15</lt></range>
	<range><ge>8.1</ge><lt>8.1.11</lt></range>
	<range><ge>8.2</ge><lt>8.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL developers report:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6600">
	<p>PostgreSQL allows users to create indexes on the results of
	user-defined functions, known as "expression indexes". This provided
	two vulnerabilities to privilege escalation: (1) index functions
	were executed as the superuser and not the table owner during VACUUM
	and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION
	were permitted within index functions. Both of these holes have now
	been closed.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4772">
	<p>PostgreSQL allowed malicious users to initiate a denial-of-service
	by passing certain regular expressions in SQL queries. First, users
	could create infinite loops using some specific regular expressions.
	Second, certain complex regular expressions could consume excessive
	amounts of memory. Third, out-of-range backref numbers could be used
	to crash the backend.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=">
	<p>DBLink functions combined with local trust or ident authentication
	could be used by a malicious user to gain superuser privileges. This
	issue has been fixed, and does not affect users who have not
	installed DBLink (an optional module), or who are using password
	authentication for local access. This same problem was addressed in
	the previous release cycle, but that patch failed to close all forms
	of the loophole.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6600</cvename>
	<cvename>CVE-2007-4772</cvename>
	<cvename>CVE-2007-6067</cvename>
	<cvename>CVE-2007-4769</cvename>
	<cvename>CVE-2007-6601</cvename>
	<bid>27163</bid>
	<url>http://www.postgresql.org/about/news.905</url>
	</references>
	<dates>
	<discovery>2008-01-06</discovery>
	<entry>2008-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="fe971a0f-1246-11dd-bab7-0016179b2dd5">
	<topic>phpmyadmin -- Shared Host Information Disclosure</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement report:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3">
	<p>It is possible to read the contents of any file that the web
	server's user can access. The exact mechanism to achieve this won't
	be disclosed. If a user can upload on the same host where
	phpMyAdmin is running a PHP script that can read files with the
	rights of the web server's user, the current advisory does not
	describe an additional threat.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1924</cvename>
	<url>http://secunia.com/advisories/29944/</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
	</references>
	<dates>
	<discovery>2008-04-23</discovery>
	<entry>2008-04-24</entry>
	<modified>2008-09-17</modified>
	</dates>
	</vuln>

	<vuln vid="6eb1dc51-1244-11dd-bab7-0016179b2dd5">
	<topic>phpmyadmin -- Username/Password Session File Information Disclosure</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.5.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement report:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2">
	<p>phpMyAdmin saves sensitive information like the MySQL username and
	password and the Blowfish secret key in session data, which might be
	unprotected on a shared host.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1567</cvename>
	<url>http://secunia.com/advisories/29613/</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
	</references>
	<dates>
	<discovery>2008-03-31</discovery>
	<entry>2008-04-24</entry>
	<modified>2008-09-17</modified>
	</dates>
	</vuln>

	<vuln vid="7a7c5853-10a3-11dd-8eb8-00163e000016">
	<topic>libxine -- array index vulnerability</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xine Team reports:</p>
	<blockquote cite="http://www.xinehq.de/index.php/news">
	<p>A new xine-lib version is now available. This release contains a
	security fix (an unchecked array index that could allows remote
	attackers to execute arbitrary code via a header structure
	containing a negative offset, which is used to dereference a
	function pointer.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1686</cvename>
	<url>http://www.xinehq.de/index.php/news</url>
	</references>
	<dates>
	<discovery>2008-04-06</discovery>
	<entry>2008-04-24</entry>
	</dates>
	</vuln>

	<vuln vid="589d8053-0b03-11dd-b4ef-00e07dc4ec84">
	<topic>clamav -- Multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.93</lt></range>
	</package>
	<package>
	<name>clamav-devel</name>
	<range><lt>20080415</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29000">
	<p>Some vulnerabilities have been reported in ClamAV, which can be
	exploited by malicious people to cause a DoS (Denial of Service)
	or to compromise a vulnerable system.</p>
	<p>1) A boundary error exists within the "cli_scanpe()" function in
	libclamav/pe.c. This can be exploited to cause a heap-based buffer
	overflow via a specially crafted "Upack" executable.</p>
	<p>Successful exploitation allows execution of arbitrary code.</p>
	<p>2) A boundary error within the processing of PeSpin packed
	executables in libclamav/spin.c can be exploited to cause a
	heap-based buffer overflow.</p>
	<p>Successful exploitation may allow execution of arbitrary code.</p>
	<p>3) An unspecified error in the processing of ARJ files can be
	exploited to hang ClamAV.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1100</cvename>
	<cvename>CVE-2008-1387</cvename>
	<url>http://secunia.com/advisories/29000</url>
	</references>
	<dates>
	<discovery>2008-04-15</discovery>
	<entry>2008-04-15</entry>
	</dates>
	</vuln>

	<vuln vid="1ac77649-0908-11dd-974d-000fea2763ce">
	<topic>lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.19_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/29649">
	<p>A vulnerability has been reported in lighttpd, which can be
	exploited by malicious people to cause a DoS (Denial of
	Service).</p>
	<p>The vulnerability is caused due to lighttpd not properly clearing
	the OpenSSL error queue. This can be exploited to close concurrent
	SSL connections of lighttpd by terminating one SSL connection.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28489</bid>
	<cvename>CVE-2008-1531</cvename>
	<url>http://secunia.com/advisories/29649</url>
	<url>http://trac.lighttpd.net/trac/ticket/285</url>
	</references>
	<dates>
	<discovery>2008-04-02</discovery>
	<entry>2008-04-13</entry>
	</dates>
	</vuln>

	<vuln vid="8d2c0ce1-08b6-11dd-94b4-0016d325a0ed">
	<topic>ikiwiki -- cross site request forging</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>2.42</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ikiwiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index31h2">
	<p>Cross Site Request Forging could be used to construct a link
	that would change a logged-in user's password or other preferences
	if they clicked on the link. It could also be used to construct a
	link that would cause a wiki page to be modified by a logged-in
	user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0165</cvename>
	<url>http://ikiwiki.info/security/#index31h2</url>
	</references>
	<dates>
	<discovery>2008-04-10</discovery>
	<entry>2008-04-13</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="072a53e0-0397-11dd-bd06-0017319806e7">
	<topic>postfix-policyd-weight -- working directory symlink vulnerability</topic>
	<affects>
	<package>
	<name>postfix-policyd-weight</name>
	<range><lt>0.1.14.17</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>postfix-policyd-weight does not check for symlink for its working
	directory. If the working directory is not already setup by the
	super root, an unprivileged user can link it to another directories
	in the system. This results in ownership/permission changes on the
	target directory.</p>
	</body>
	</description>
	<references>
	<bid>28480</bid>
	<mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/815</mlist>
	<mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/823</mlist>
	</references>
	<dates>
	<discovery>2008-03-24</discovery>
	<entry>2008-04-06</entry>
	</dates>
	</vuln>

	<vuln vid="b21790a5-02fb-11dd-bd06-0017319806e7">
	<topic>powerdns-recursor -- DNS cache poisoning</topic>
	<affects>
	<package>
	<name>powerdns-recursor</name>
	<range><lt>3.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>If the system random number generator can be predicted by its
	past output, then an attacker may spoof Recursor to accept mallicious
	data. This leads to DNS cache poisoning and client redirection.</p>
	</body>
	</description>
	<references>
	<url>http://doc.powerdns.com/security-policy.html</url>
	</references>
	<dates>
	<discovery>2008-03-31</discovery>
	<entry>2008-04-05</entry>
	</dates>
	</vuln>

	<vuln vid="fb672330-02db-11dd-bd06-0017319806e7">
	<topic>suphp -- multiple local privilege escalation vulnerabilities</topic>
	<affects>
	<package>
	<name>suphp</name>
	<range><lt>0.6.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple local privilege escalation are found in the symlink
	verification code. An attacker may use it to run a PHP script with
	the victim's privilege. This attack is a little harder when suphp
	operates in paranoid mode. For suphp that runs in owner mode
	which is the default in ports, immediate upgrade to latest
	version is advised.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1614</cvename>
	<bid>28568</bid>
	<url>http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html</url>
	</references>
	<dates>
	<discovery>2008-03-30</discovery>
	<entry>2008-04-05</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="ad4a00fa-0157-11dd-8bd3-001372ae3ab9">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<range><lt>9.27.20080331</lt></range>
	</package>
	<package>
	<name>linux-opera</name>
	<range><lt>9.27.20080331</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Software reports of multiple security issues in Opera.
	All of them can lead to arbitrary code execution. Details are
	as the following:</p>
	<ul>
	<li><a href="http://www.opera.com/support/search/view/881/">Newsfeed
	prompt can cause Opera to execute arbitrary code</a></li>
	<li><a href="http://www.opera.com/support/search/view/882/">Resized
	canvas patterns can cause Opera to execute arbitrary code</a></li>
	</ul>
	</body>
	</description>
	<references>
	<bid>28585</bid>
	<cvename>CVE-2008-1761</cvename>
	<cvename>CVE-2008-1762</cvename>
	<url>http://www.opera.com/support/search/view/881/</url>
	<url>http://www.opera.com/support/search/view/882/</url>
	</references>
	<dates>
	<discovery>2008-04-03</discovery>
	<entry>2008-04-05</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="12b336c6-fe36-11dc-b09c-001c2514716c">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.13,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.13</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.9</lt></range>
	</package>
	<package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.1.1</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports of multiple security issues
	in Firefox, Seamonkey, and Thunderbird. Several of these
	issues can probably be used to run arbitrary code with the
	privilege of the user running the program.</p>
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	<ul>
	<li><a href="/security/announce/2008/mfsa2008-19.html">MFSA 2008-19</a>
	XUL popup spoofing variant (cross-tab popups)</li>
	<li><a href="/security/announce/2008/mfsa2008-18.html">MFSA 2008-18</a>
	Java socket connection to any local port via LiveConnect</li>
	<li><a href="/security/announce/2008/mfsa2008-17.html">MFSA 2008-17</a>
	Privacy issue with SSL Client Authentication</li>
	<li><a href="/security/announce/2008/mfsa2008-16.html">MFSA 2008-16</a>
	HTTP Referrer spoofing with malformed URLs</li>
	<li><a href="/security/announce/2008/mfsa2008-15.html">MFSA 2008-15</a>
	Crashes with evidence of memory corruption (rv:1.8.1.13)</li>
	<li><a href="/security/announce/2008/mfsa2008-14.html">MFSA 2008-14</a>
	JavaScript privilege escalation and arbitrary code execution</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28448</bid>
	<cvename>CVE-2008-1241</cvename>
	<cvename>CVE-2008-1240</cvename>
	<cvename>CVE-2007-4879</cvename>
	<cvename>CVE-2008-1238</cvename>
	<cvename>CVE-2008-1236</cvename>
	<cvename>CVE-2008-1237</cvename>
	<cvename>CVE-2008-1233</cvename>
	<cvename>CVE-2008-1234</cvename>
	<cvename>CVE-2008-1235</cvename>
	</references>
	<dates>
	<discovery>2008-03-26</discovery>
	<entry>2008-03-30</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="ff304c35-fb5b-11dc-91c1-00e0815b8da8">
	<topic>silc -- pkcs_decode buffer overflow</topic>
	<affects>
	<package>
	<name>silc-irssi-client</name>
	<name>silc-client</name>
	<range><lt>1.1.4</lt></range>
	</package>
	<package>
	<name>silc-server</name>
	<range><lt>1.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Core Security Technologies reports:</p>
	<blockquote cite="http://www.coresecurity.com/?action=item&id=2206">
	<p>A remote buffer overflow vulnerability found in a library
	used by both the SILC server and client to process
	packets containing cryptographic material may allow an
	un-authenticated client to executearbitrary code on the
	server with the privileges of the user account running the
	server, or a malicious SILC server to compromise client
	systems and execute arbitrary code with the privileges of
	the user account running the SILC client program.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28373</bid>
	<url>http://www.coresecurity.com/?action=item&id=2206</url>
	</references>
	<dates>
	<discovery>2008-03-25</discovery>
	<entry>2008-03-26</entry>
	</dates>
	</vuln>

	<vuln vid="063399fc-f6d6-11dc-bcee-001c2514716c">
	<topic>bzip2 -- crash with certain malformed archive files</topic>
	<affects>
	<package>
	<name>bzip2</name>
	<range><lt>1.0.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/28286/">
	<p>The 'bzip2' application is prone to a remote file-handling
	vulnerability because the application fails to properly
	handle malformed files.</p>
	<p>Exploit attempts likely result in application crashes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28286</bid>
	<cvename>CVE-2008-1372</cvename>
	<url>https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html</url>
	<url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/</url>
	</references>
	<dates>
	<discovery>2008-03-18</discovery>
	<entry>2008-03-20</entry>
	</dates>
	</vuln>

	<vuln vid="9cfbca7f-efb7-11dc-be01-0211060005df">
	<topic>qemu -- unchecked block read/write vulnerability</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.1_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ian Jackson reports on the debian-security mailinglist:</p>
	<blockquote cite="http://lists.debian.org/debian-security/2008/02/msg00064.html">
	<p>When a block device read or write request is made by the guest,
	nothing checks that the request is within the range supported by
	the backend, but the code in the backend typically assumes that
	the request is sensible.</p>
	<p>Depending on the backend, this can allow the guest to read
	and write arbitrary memory locations in qemu, and possibly gain
	control over the qemu process, escaping from the
	emulation/virtualisation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0928</cvename>
	<url>http://secunia.com/advisories/29172</url>
	<url>http://secunia.com/advisories/29081</url>
	<mlist msgid="18362.62578.44273.779731@mariner.uk.xensource.com">http://lists.debian.org/debian-security/2008/02/msg00064.html</mlist>
	</references>
	<dates>
	<discovery>2008-02-19</discovery>
	<entry>2008-03-11</entry>
	</dates>
	</vuln>

	<vuln vid="b39bdc06-ee42-11dc-8678-00a0cce0781e">
	<topic>dovecot -- security hole in blocking passdbs</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<range><lt>1.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dovecot reports:</p>
	<blockquote cite="http://dovecot.org/list/dovecot-news/2008-March/000065.html">
	<p>Security hole in blocking passdbs (MySQL always. PAM, passwd
	and shadow if blocking=yes) where user could specify extra
	fields in the password. The main problem here is when specifying
	"skip_password_check" introduced in v1.0.11 for fixing master user
	logins, allowing the user to log in as anyone without a valid
	password.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://dovecot.org/list/dovecot-news/2008-March/000065.html</url>
	<url>http://secunia.com/advisories/29295/</url>
	</references>
	<dates>
	<discovery>2008-03-09</discovery>
	<entry>2008-03-10</entry>
	</dates>
	</vuln>

	<vuln vid="de4d4110-ebce-11dc-ae14-0016179b2dd5">
	<topic>mplayer -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mplayer team reports:</p>
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
	<p>A buffer overflow was found in the code used to extract album
	titles from CDDB server answers. When parsing answers from the
	CDDB server, the album title is copied into a fixed-size buffer
	with insufficient size checks, which may cause a buffer overflow.
	A malicious database entry could trigger a buffer overflow in the
	program. That can lead to arbitrary code execution with the UID of
	the user running MPlayer.</p>
	<p>A buffer overflow was found in the code used to escape URL
	strings. The code used to skip over IPv6 addresses can be tricked
	into leaving a pointer to a temporary buffer with a non-NULL value;
	this causes the unescape code to reuse the buffer, and may lead to
	a buffer overflow if the old buffer is smaller than required.
	A malicious URL string may be used to trigger a buffer overflow in
	the program, that can lead to arbitrary code execution with the UID
	of the user running MPlayer.</p>
	<p>A buffer overflow was found in the code used to parse MOV file
	headers. The code read some values from the file and used them as
	indexes into as array allocated on the heap without performing any
	boundary check. A malicious file may be used to trigger a buffer
	overflow in the program. That can lead to arbitrary code execution
	with the UID of the user running MPlayer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0485</cvename>
	<cvename>CVE-2008-0486</cvename>
	<cvename>CVE-2008-0629</cvename>
	<cvename>CVE-2008-0630</cvename>
	<url>http://secunia.com/advisories/28779</url>
	</references>
	<dates>
	<discovery>2008-02-05</discovery>
	<entry>2008-03-06</entry>
	</dates>
	</vuln>

	<vuln vid="ca8e56d5-e856-11dc-b5af-0017319806e7">
	<topic>ghostscript -- zseticcspace() function buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>ghostscript-gpl</name>
	<name>ghostscript-gpl-nox11</name>
	<range><lt>8.61_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chris Evans from the Google Security Team reports:</p>
	<blockquote cite="http://scary.beasts.org/security/CESA-2008-001.html">
	<p>Severity: parsing of evil PostScript file will result in
	arbitrary code execution.</p>
	<p>A stack-based buffer overflow in the zseticcspace() function
	in zicc.c allows remote arbitrary code execution via a
	malicious PostScript file (.ps) that contains a long Range
	array.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28017</bid>
	<cvename>CVE-2008-0411</cvename>
	<url>http://scary.beasts.org/security/CESA-2008-001.html</url>
	</references>
	<dates>
	<discovery>2008-02-28</discovery>
	<entry>2008-03-05</entry>
	</dates>
	</vuln>

	<vuln vid="ce2f2ade-e7df-11dc-a701-000bcdc1757a">
	<topic>phpmyadmin -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement report:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1">
	<p>phpMyAdmin used the $_REQUEST superglobal as a source for
	its parameters, instead of $_GET and $_POST. This means that
	on most servers, a cookie with the same name as one of
	phpMyAdmin's parameters can interfere.</p>
	<p>Another application could set a cookie for the root path
	"/" with a "sql_query" name, therefore overriding the
	user-submitted sql_query because by default, the $_REQUEST
	superglobal imports first GET, then POST then COOKIE data.</p>
	<h3>Mitigation factor</h3>
	<p>An attacker must trick the victim into visiting a page on
	the same web server where he has placed code that creates
	a malicious cookie.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>28068</bid>
	<cvename>CVE-2008-1149</cvename>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1</url>
	</references>
	<dates>
	<discovery>2008-03-01</discovery>
	<entry>2008-03-04</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="f9e96930-e6df-11dc-8c6a-00304881ac9a">
	<topic>pcre -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>pcre</name>
	<range><lt>7.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PCRE developers report:</p>
	<blockquote cite="http://pcre.org/changelog.txt">
	<p>A character class containing a very large number of characters with
	codepoints greater than 255 (in UTF-8 mode, of course) caused a
	buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>27786</bid>
	<cvename>CVE-2008-0674</cvename>
	<url>http://pcre.org/changelog.txt</url>
	</references>
	<dates>
	<discovery>2008-01-28</discovery>
	<entry>2008-02-29</entry>
	</dates>
	</vuln>

	<vuln vid="e8a6a16d-e498-11dc-bb89-000bcdc1757a">
	<topic>libxine -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.10.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xine Team reports:</p>
	<blockquote cite="http://www.xinehq.de/index.php/news">
	<p>A new xine-lib version is now available. This release
	contains a security fix (array index vulnerability which
	may lead to a stack buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0486</cvename>
	<url>http://www.xinehq.de/index.php/news</url>
	</references>
	<dates>
	<discovery>2007-02-08</discovery>
	<entry>2008-02-26</entry>
	</dates>
	</vuln>

	<vuln vid="9f581778-e3d4-11dc-bb89-000bcdc1757a">
	<topic>coppermine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>coppermine</name>
	<range><lt>1.4.15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Coppermine Security advisory</p>
	<blockquote cite="http://coppermine-gallery.net/forum/index.php?topic=48106.0">
	<p>The development team is releasing a security update for
	Coppermine in order to counter a recently discovered
	cross-site-scripting vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0504</cvename>
	<cvename>CVE-2008-0505</cvename>
	<cvename>CVE-2008-0506</cvename>
	<url>http://coppermine-gallery.net/forum/index.php?topic=48106.0</url>
	<url>http://coppermine-gallery.net/forum/index.php?topic=50103.0</url>
	<url>http://secunia.com/advisories/28682/</url>
	</references>
	<dates>
	<discovery>2007-11-06</discovery>
	<entry>2008-02-25</entry>
	</dates>
	</vuln>

	<vuln vid="f113bbeb-e3ac-11dc-bb89-000bcdc1757a">
	<topic>moinmoin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>moinmoin</name>
	<range><lt>1.6.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>MoinMoin Security advisory</p>
	<blockquote cite="http://moinmo.in/SecurityFixes">
	<p>XSS issue in login action</p>
	<p>XSS issue in AttachFile action</p>
	<p>XSS issue in RenamePage/DeletePage action</p>
	<p>XSS issue in gui editor</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>27404</bid>
	<cvename>CVE-2007-0857</cvename>
	<cvename>CVE-2007-0901</cvename>
	<cvename>CVE-2007-0902</cvename>
	<cvename>CVE-2007-2423</cvename>
	<cvename>CVE-2007-2673</cvename>
	<cvename>CVE-2008-0780</cvename>
	<cvename>CVE-2008-0781</cvename>
	<cvename>CVE-2008-0782</cvename>
	<url>http://moinmo.in/SecurityFixes</url>
	<url>http://secunia.com/advisories/29010/</url>
	</references>
	<dates>
	<discovery>2007-02-08</discovery>
	<entry>2008-02-25</entry>
	<modified>2008-02-26</modified>
	</dates>
	</vuln>

	<vuln vid="30c560ff-e0df-11dc-891a-02061b08fc24">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.26</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Software ASA reports about multiple security
	fixes:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
	<ul>
	<li>Fixed an issue where simulated text inputs could trick
	users into uploading arbitrary files, as reported by
	Mozilla.</li>
	<li>Image properties can no longer be used to execute
	scripts, as reported by Max Leonov.</li>
	<li>Fixed an issue where the representation of DOM
	attribute values could allow cross site scripting, as
	reported by Arnaud.lb.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-1080</cvename>
	<cvename>CVE-2008-1081</cvename>
	<url>http://www.opera.com/docs/changelogs/freebsd/926/</url>
	<url>http://www.opera.com/support/search/view/877/</url>
	<url>http://www.opera.com/support/search/view/879/</url>
	<url>http://www.opera.com/support/search/view/880/</url>
	</references>
	<dates>
	<discovery>2008-02-20</discovery>
	<entry>2008-02-22</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="810a5197-e0d9-11dc-891a-02061b08fc24">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.12,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.12</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.8</lt></range>
	</package>
	<package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.0.9</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports of multiple security issues
	in Firefox, Seamonkey, and Thunderbird. Several of these
	issues can probably be used to run arbitrary code with the
	privilege of the user running the program.</p>
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	<ul>
	<li>Web forgery overwrite with div overlay</li>
	<li>URL token stealing via stylesheet redirect</li>
	<li>Mishandling of locally-saved plain text files</li>
	<li>File action dialog tampering</li>
	<li>Possible information disclosure in BMP decoder</li>
	<li>Web browsing history and forward navigation stealing</li>
	<li>Directory traversal via chrome: URI</li>
	<li>Stored password corruption</li>
	<li>Privilege escalation, XSS, Remote Code Execution</li>
	<li>Multiple file input focus stealing vulnerabilities</li>
	<li>Crashes with evidence of memory corruption (rv:1.8.1.12)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0412</cvename>
	<cvename>CVE-2008-0413</cvename>
	<cvename>CVE-2008-0414</cvename>
	<cvename>CVE-2008-0415</cvename>
	<cvename>CVE-2008-0417</cvename>
	<cvename>CVE-2008-0418</cvename>
	<cvename>CVE-2008-0419</cvename>
	<cvename>CVE-2008-0420</cvename>
	<cvename>CVE-2008-0591</cvename>
	<cvename>CVE-2008-0592</cvename>
	<cvename>CVE-2008-0593</cvename>
	<cvename>CVE-2008-0594</cvename>
	<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-01.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-02.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-03.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-04.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-05.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-06.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-07.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-08.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-09.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-10.html</url>
	<url>http://www.mozilla.org/security/announce/2008/mfsa2008-11.html</url>
	</references>
	<dates>
	<discovery>2008-02-07</discovery>
	<entry>2008-02-22</entry>
	<modified>2009-12-12</modified>
	</dates>
	</vuln>

	<vuln vid="e5d29309-e0db-11dc-97b2-001c2514716c">
	<topic>openldap -- modrdn Denial of Service vulnerability</topic>
	<affects>
	<package>
	<name>openldap-server</name>
	<range><lt>2.3.41</lt></range>
	<range><gt>2.4.0</gt><lt>2.4.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/28926/">
	<p>A vulnerability has been reported in OpenLDAP, which can
	be exploited by malicious users to cause a DoS (Denial of
	Service).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>27778</bid>
	<cvename>CVE-2008-0658</cvename>
	</references>
	<dates>
	<discovery>2008-02-13</discovery>
	<entry>2008-02-22</entry>
	</dates>
	</vuln>

	<vuln vid="be4b0529-dbaf-11dc-9791-000ea6702141">
	<topic>clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><ge>0.92</ge><lt>0.92.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDefense Security Advisory 02.12.08:</p>
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658">
	<p>Remote exploitation of an integer overflow vulnerability
	in Clam AntiVirus' ClamAV, as included in various vendors'
	operating system distributions, allows attackers to execute
	arbitrary code with the privileges of the affected process.</p>
	<p>The vulnerability exists within the code responsible
	for parsing and scanning PE files. While iterating through
	all sections contained in the PE file, several attacker
	controlled values are extracted from the file. On each iteration,
	arithmetic operations are performed without taking into
	consideration 32-bit integer wrap.</p>
	<p>Since insufficient integer overflow checks are present,
	an attacker can cause a heap overflow by causing a specially
	crafted Petite packed PE binary to be scanned. This results
	in an exploitable memory corruption condition.</p>
	<p>Exploitation of this vulnerability results in the
	execution of arbitrary code with the privileges of the process
	using libclamav. In the case of the clamd program, this will
	result in code execution with the privileges of the clamav user.
	Unsuccessful exploitation results in the clamd process crashing.</p>
	</blockquote>
	<h1>Workaround</h1>
	<p>Disabling the scanning of PE files will prevent exploitation.</p>
	<p>If using clamscan, this can be done by running clamscan with the
	'--no-pe' option.</p>
	<p>If using clamdscan, set the 'ScanPE' option in the clamd.conf
	file to 'no'.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0318</cvename>
	<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658</url>
	<url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
	</references>
	<dates>
	<discovery>2008-01-07</discovery>
	<entry>2008-02-15</entry>
	</dates>
	</vuln>

	<vuln vid="dea7df85-d96c-11dc-9bfc-000e0c092e7a">
	<topic>cacti -- Multiple security vulnerabilities have been discovered</topic>
	<affects>
	<package>
	<name>cacti</name>
	<range><lt>0.8.7b</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The cacti development team reports:</p>
	<blockquote cite="http://forums.cacti.net/about25749.html">
	<p>Multiple security vulnerabilities have been discovered in
	Cacti's web interface:</p>
	<ul>
	<li>XSS vulnerabilities</li>
	<li>Path disclosure vulnerabilities</li>
	<li>SQL injection vulnerabilities</li>
	<li>HTTP response splitting vulnerabilities</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://forums.cacti.net/about25749.html</url>
	</references>
	<dates>
	<discovery>2008-02-12</discovery>
	<entry>2008-02-12</entry>
	</dates>
	</vuln>

	<vuln vid="739329c8-d8f0-11dc-ac2f-0016d325a0ed">
	<topic>ikiwiki -- javascript insertion via uris</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>2.32.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ikiwiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index30h2">
	<p>The htmlscrubber did not block javascript in uris. This was
	fixed by adding a whitelist of valid uri types, which does not
	include javascript. Some urls specifyable by the meta plugin
	could also theoretically have been used to inject javascript; this
	was also blocked.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0808</cvename>
	<url>http://ikiwiki.info/security/#index30h2</url>
	</references>
	<dates>
	<discovery>2008-02-10</discovery>
	<entry>2008-02-11</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="1a818749-d646-11dc-8959-000bcdc1757a">
	<topic>zenphoto -- XSS vulnerability</topic>
	<affects>
	<package>
	<name>zenphoto</name>
	<range><lt>1.1.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>zenphoto project reports:</p>
	<blockquote cite="http://www.zenphoto.org/2008/02/">
	<p>A new zenphoto version is now available. This release contains
	security fixes for HTML, XSS, and SQL injection vulnerabilities.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6666</cvename>
	<url>http://www.securityfocus.com/bid/27084</url>
	<url>http://secunia.com/advisories/28281</url>
	</references>
	<dates>
	<discovery>2008-01-03</discovery>
	<entry>2008-02-09</entry>
	</dates>
	</vuln>

	<vuln vid="0832ee18-cf77-11dc-8c6a-00304881ac9a">
	<topic>jetty -- multiple vulnerability</topic>
	<affects>
	<package>
	<name>jetty</name>
	<range><lt>6.1.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Greg Wilkins reports:</p>
	<blockquote cite="http://jira.codehaus.org/browse/JETTY-386#action_117699">
	<p>jetty allows remote attackers to bypass protection mechanisms and
	read the source of files via multiple '/' characters in the URI.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>27117</bid>
	<cvename>CVE-2007-6672</cvename>
	<url>http://jira.codehaus.org/browse/JETTY-386#action_117699</url>
	</references>
	<dates>
	<discovery>2007-12-22</discovery>
	<entry>2008-02-04</entry>
	</dates>
	</vuln>

	<vuln vid="6ecd0b42-ce77-11dc-89b1-000e35248ad7">
	<topic>libxine -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xine project reports:</p>
	<blockquote cite="http://xinehq.de/index.php/news">
	<p>A new xine-lib version is now available. This release contains
	a security fix (remotely-expoitable buffer overflow, CVE-2006-1664).
	(This is not the first time that that bug has been fixed...)
	It also fixes a few more recent bugs, such as the audio output
	problems in 1.1.9.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2006-1664</cvename>
	<url>http://secunia.com/advisories/19853/</url>
	</references>
	<dates>
	<discovery>2008-01-23</discovery>
	<entry>2008-01-29</entry>
	</dates>
	</vuln>

	<vuln vid="fe2b6597-c9a4-11dc-8da8-0008a18a9961">
	<topic>xorg -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xorg-server</name>
	<range><lt>1.4_4,1</lt></range>
	</package>
	<package>
	<name>libXfont</name>
	<range><lt>1.3.1_2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthieu Herrb of X.Org reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-January/031918.html">
	<p>Several vulnerabilities have been identified in server code
	of the X window system caused by lack of proper input validation
	on user controlled data in various parts of the software,
	causing various kinds of overflows.</p>
	<p>Exploiting these overflows will crash the X server or,
	under certain circumstances allow the execution of arbitray
	machine code.</p>
	<p>When the X server is running with root privileges (which is the
	case for the Xorg server and for most kdrive based servers),
	these vulnerabilities can thus also be used to raise
	privileges.</p>
	<p>All these vulnerabilities, to be exploited succesfully, require
	either an already established connection to a running X server
	(and normally running X servers are only accepting authenticated
	connections), or a shell access with a valid user on the machine
	where the vulnerable server is installed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5760</cvename>
	<cvename>CVE-2007-5958</cvename>
	<cvename>CVE-2007-6427</cvename>
	<cvename>CVE-2007-6428</cvename>
	<cvename>CVE-2007-6429</cvename>
	<cvename>CVE-2008-0006</cvename>
	<url>http://lists.freedesktop.org/archives/xorg/2008-January/031918.html</url>
	<url>http://lists.freedesktop.org/archives/xorg/2008-January/032099.html</url>
	<url>http://secunia.com/advisories/28532/</url>
	</references>
	<dates>
	<discovery>2008-01-18</discovery>
	<entry>2008-01-23</entry>
	</dates>
	</vuln>

	<vuln vid="024edd06-c933-11dc-810c-0016179b2dd5">
	<topic>xfce -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xfce4-panel</name>
	<name>libxfce4gui</name>
	<range><lt>4.4.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml">
	<p>A remote attacker could entice a user to install a specially
	crafted "rc" file to execute arbitrary code via long strings
	in the "Name" and "Comment" fields or via unspecified vectors
	involving the second vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6531</cvename>
	<cvename>CVE-2007-6532</cvename>
	<url>http://www.xfce.org/documentation/changelogs/4.4.2</url>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml</url>
	</references>
	<dates>
	<discovery>2008-01-09</discovery>
	<entry>2008-01-22</entry>
	<modified>2008-02-13</modified>
	</dates>
	</vuln>

	<vuln vid="a59afa47-c930-11dc-810c-0016179b2dd5">
	<topic>claws-mail -- insecure temporary file creation</topic>
	<affects>
	<package>
	<name>claws-mail</name>
	<range><lt>3.1.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nico Golde reports:</p>
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089">
	<p>A local attacker could exploit this vulnerability to conduct
	symlink attacks to overwrite files with the privileges of the user
	running Claws Mail.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26676</bid>
	<cvename>CVE-2007-6208</cvename>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200801-03.xml</url>
	<url>http://security.gentoo.org/glsa/glsa-200801-03.xml</url>
	<url>http://secunia.com/advisories/27897</url>
	</references>
	<dates>
	<discovery>2007-12-03</discovery>
	<entry>2008-01-22</entry>
	<modified>2008-02-12</modified>
	</dates>
	</vuln>

	<vuln vid="e5a9de5f-c6bc-11dc-b9f1-00a0cce0781e">
	<topic>IRC Services-- Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>ircservices</name>
	<range><lt>5.0.63</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/27761">
	<p>A vulnerability has been reported in IRC Services,
	which can be exploited by malicious people to cause
	a Denial of Service. The vulnerability is caused due
	to the improper handling of overly long passwords within
	the "default_encrypt()" function in encrypt.c and can be
	exploited to crash an affected server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6122</cvename>
	<url>http://secunia.com/advisories/27761</url>
	<url>http://ircservices.za.net/Changes.txt</url>
	</references>
	<dates>
	<discovery>2007-11-21</discovery>
	<entry>2008-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="02eedd3c-c6b5-11dc-93b6-000e35248ad7">
	<topic>libxine -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>libxine</name>
	<range><lt>1.1.9.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xine project reports:</p>
	<blockquote cite="http://xinehq.de/index.php/news">
	<p>A new xine-lib version is now available. This release contains
	a security fix (remotely-expoitable buffer overflow, CVE-2008-0225).
	It also contains a read-past-end fix for an internal library
	function which is only used if the OS does not supply it and a
	rendering fix for Darwin/PPC.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0225</cvename>
	<url>http://aluigi.altervista.org/adv/xinermffhof-adv.txt</url>
	<url>http://secunia.com/advisories/28384</url>
	</references>
	<dates>
	<discovery>2008-01-08</discovery>
	<entry>2008-01-19</entry>
	</dates>
	</vuln>

	<vuln vid="60e1792b-c380-11dc-821a-000bcdc1757a">
	<topic>geeklog xss vulnerability</topic>
	<affects>
	<package>
	<name>geeklog</name>
	<range><lt>1.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Geeklog reports:</p>
	<blockquote cite="http://www.geeklog.net/article.php/geeklog-1.4.0sr6">
	<p>MustLive pointed out a possible XSS in the form to email an
	article to a friend that we're fixing with this release.</p>
	<p>Please note that this problem only exists in Geeklog 1.4.0
	- neither Geeklog 1.4.1 nor any older versions (1.3.x series)
	have that problem.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2006-3756</cvename>
	<url>http://www.geeklog.net/article.php/geeklog-1.4.0sr6</url>
	</references>
	<dates>
	<discovery>2008-01-08</discovery>
	<entry>2008-01-15</entry>
	</dates>
	</vuln>

	<vuln vid="4451a4c9-c05e-11dc-982e-001372fd0af2">
	<topic>drupal -- cross site request forgery</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.6</lt></range>
	</package>
	<package>
	<name>drupal4</name>
	<range><lt>4.7.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/208562">
	<p>The aggregator module fetches items from RSS feeds and makes
	them available on the site. The module provides an option to
	remove items from a particular feed. This has been implemented
	as a simple GET request and is therefore vulnerable to cross
	site request forgeries. For example: Should a privileged user
	view a page containing an <img> tag with a specially
	constructed src pointing to a remove items URL, the items would
	be removed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0272</cvename>
	<url>http://drupal.org/node/208562</url>
	<url>http://secunia.com/advisories/28422/</url>
	</references>
	<dates>
	<discovery>2008-01-10</discovery>
	<entry>2008-01-11</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="6f736456-c060-11dc-982e-001372fd0af2">
	<topic>drupal -- cross site scripting (utf8)</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.6</lt></range>
	</package>
	<package>
	<name>drupal4</name>
	<range><lt>4.7.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/208564">
	<p>When outputting plaintext Drupal strips potentially dangerous
	HTML tags and attributes from HTML, and escapes characters which
	have a special meaning in HTML. This output filtering secures
	the site against cross site scripting attacks via user input.</p>
	<p>Certain byte sequences that are invalid in the UTF8
	specification are not handled properly by Internet Explorer 6
	and may lead it to see a multibyte start character where none is
	present. Internet Explorer 6 then consumes a number of
	subsequent UTF-8 characters. This may lead to unsafe attributes
	that were outside a tag for the filter to appear inside a tag
	for Internet Explorer 6. This behaviour can then be used to
	insert and execute javascript in the context of the website.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0273</cvename>
	<url>http://drupal.org/node/208564</url>
	<url>http://secunia.com/advisories/28422/</url>
	</references>
	<dates>
	<discovery>2008-01-10</discovery>
	<entry>2008-01-11</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="f0fa19dd-c060-11dc-982e-001372fd0af2">
	<topic>drupal -- cross site scripting (register_globals)</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.6</lt></range>
	</package>
	<package>
	<name>drupal4</name>
	<range><lt>4.7.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/208565">
	<p>When theme .tpl.php files are accessible via the web and the PHP
	setting register_globals is set to enabled, anonymous users are
	able to execute cross site scripting attacks via specially
	crafted links.</p>
	<p>Drupal's .htaccess attempts to set register_globals to disabled
	and also prevents access to .tpl.php files. Only when both these
	measures are not effective and your PHP interpreter is
	configured with register_globals set to enabled, will this issue
	affect you.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0274</cvename>
	<url>http://drupal.org/node/208565</url>
	<url>http://secunia.com/advisories/28422/</url>
	</references>
	<dates>
	<discovery>2008-01-10</discovery>
	<entry>2008-01-11</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="f358de71-bf64-11dc-928b-0016179b2dd5">
	<topic>maradns -- CNAME record resource rotation denial of service</topic>
	<affects>
	<package>
	<name>maradns</name>
	<range><lt>1.2.12.08</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/28329">
	<p>A vulnerability has been reported in MaraDNS, which can be
	exploited by malicious people to cause a Denial of Service.</p>
	<p>The vulnerability is caused due to an error within the handling of
	certain DNS packets. This can be exploited to cause a resource
	rotation by sending specially crafted DNS packets, which cause an
	authoritative CNAME record to not resolve, resulting in a Denial of
	Sevices.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2008-0061</cvename>
	<url>http://maradns.blogspot.com/2007/08/maradns-update-all-versions.html</url>
	<url>http://secunia.com/advisories/28329</url>
	</references>
	<dates>
	<discovery>2008-01-04</discovery>
	<entry>2008-01-10</entry>
	</dates>
	</vuln>

	<vuln vid="f762ccbb-baed-11dc-a302-000102cc8983">
	<topic>linux-realplayer -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-realplayer</name>
	<range><ge>10.0.5</ge><lt>10.0.9.809.20070726</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/27361">
	<p>Multiple vulnerabilities have been reported in
	RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious
	people to compromise a user's system.</p>
	<p>An input validation error when processing .RA/.RAM files can be
	exploited to cause a heap corruption via a specially crafted
	.RA/.RAM file with an overly large size field in the header.</p>
	<p>An error in the processing of .PLS files can be exploited to cause
	a memory corruption and execute arbitrary code via a specially
	crafted .PLS file.</p>
	<p>An input validation error when parsing .SWF files can be exploited
	to cause a buffer overflow via a specially crafted .SWF file with
	malformed record headers.</p>
	<p>A boundary error when processing rm files can be exploited to
	cause a buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5081</cvename>
	<cvename>CVE-2007-3410</cvename>
	<cvename>CVE-2007-2263</cvename>
	<cvename>CVE-2007-2264</cvename>
	<url>http://secunia.com/advisories/27361</url>
	<url>http://service.real.com/realplayer/security/10252007_player/en/</url>
	<url>http://www.zerodayinitiative.com/advisories/ZDI-07-063.html</url>
	<url>http://www.zerodayinitiative.com/advisories/ZDI-07-062.html</url>
	<url>http://www.zerodayinitiative.com/advisories/ZDI-07-061.html</url>
	<url>http://secunia.com/advisories/25819/</url>
	<certvu>759385</certvu>
	</references>
	<dates>
	<discovery>2007-10-25</discovery>
	<entry>2008-01-04</entry>
	</dates>
	</vuln>

	<vuln vid="562cf6c4-b9f1-11dc-a302-000102cc8983">
	<topic>linux-flashplugin -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><ge>9.0</ge><lt>9.0r115</lt></range>
	<range><ge>7.0</ge><lt>7.0r73</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe Security bulletin:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-20.html">
	<p>Critical vulnerabilities have been identified in Adobe Flash
	Player that could allow an attacker who successfully exploits these
	potential vulnerabilities to take control of the affected system. A
	malicious SWF must be loaded in Flash Player by the user for an
	attacker to exploit these potential vulnerabilities. Users are
	recommended to update to the most current version of Flash Player
	available for their platform.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6242</cvename>
	<cvename>CVE-2007-4768</cvename>
	<cvename>CVE-2007-5275</cvename>
	<cvename>CVE-2007-6243</cvename>
	<cvename>CVE-2007-6244</cvename>
	<cvename>CVE-2007-6245</cvename>
	<cvename>CVE-2007-4324</cvename>
	<cvename>CVE-2007-6246</cvename>
	<cvename>CVE-2007-5476</cvename>
	<url>http://www.adobe.com/support/security/bulletins/apsb07-20.html</url>
	<url>http://secunia.com/advisories/28161/</url>
	</references>
	<dates>
	<discovery>2007-12-18</discovery>
	<entry>2008-01-03</entry>
	</dates>
	</vuln>

	<vuln vid="cf484358-b5d6-11dc-8de0-001c2514716c">
	<topic>dovecot -- Specific LDAP + auth cache configuration may mix up user logins</topic>
	<affects>
	<package>
	<name>dovecot</name>
	<range><lt>1.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dovecot reports:</p>
	<blockquote cite="http://www.dovecot.org/list/dovecot-news/2007-December/000057.html">
	<p>If two users with the same password and same pass_filter
	variables log in within auth_cache_ttl seconds (1h by default),
	the second user may get logged in with the first user's cached
	pass_attrs. For example if pass_attrs contained the user's
	home/mail directory, this would mean that the second user will
	be accessing the first user's mails.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.dovecot.org/list/dovecot-news/2007-December/000057.html</url>
	</references>
	<dates>
	<discovery>2007-12-21</discovery>
	<entry>2007-12-29</entry>
	</dates>
	</vuln>

	<vuln vid="4aab7bcd-b294-11dc-a6f0-00a0cce0781e">
	<topic>gallery2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gallery2</name>
	<range><lt>2.2.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Gallery team reports:</p>
	<blockquote cite="http://gallery.menalto.com/gallery_2.2.4_released">
	<p>Gallery 2.2.4 addresses the following security
	vulnerabilities:</p>
	<ul>
	<li>Publish XP module - Fixed unauthorized album creation
	and file uploads.</li>
	<li>URL rewrite module - Fixed local file inclusion
	vulnerability in unsecured admin controller and
	information disclosure in hotlink protection.</li>
	<li>Core / add-item modules - Fixed Cross Site Scripting
	(XSS) vulnerabilities through malicious file names.</li>
	<li>Installation (Gallery application) - Update
	web-accessibility protection of the storage folder for
	Apache 2.2.</li>
	<li>Core (Gallery application) / MIME module - Fixed
	vulnerability in checks for disallowed file extensions
	in file uploads.</li>
	<li>Gallery Remote module - Added missing permissions
	checks for some GR commands.</li>
	<li>WebDAV module - Fixed Cross Site Scripting (XSS)
	vulnerability through HTTP PROPPATCH.</li>
	<li>WebDAV module - Fixed information (item data)
	disclosure in a WebDAV view.</li>
	<li>Comment module - Fixed information (item data)
	disclosure in comment views.</li>
	<li>Core module (Gallery application) - Improved
	resilience against item information disclosure
	attacks.</li>
	<li>Slideshow module - Fixed information (item data)
	disclosure in the slideshow.</li>
	<li>Print modules - Fixed information (item data)
	disclosure in several print modules.</li>
	<li>Core / print modules - Fixed arbitrary URL redirection
	(phishing attacks) in the core module and several print
	modules.</li>
	<li>WebCam module - Fixed proxied request weakness.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6685</cvename>
	<cvename>CVE-2007-6686</cvename>
	<cvename>CVE-2007-6687</cvename>
	<cvename>CVE-2007-6689</cvename>
	<cvename>CVE-2007-6690</cvename>
	<cvename>CVE-2007-6692</cvename>
	<url>http://gallery.menalto.com/gallery_2.2.4_released</url>
	</references>
	<dates>
	<discovery>2007-12-24</discovery>
	<entry>2007-12-25</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="299e3f81-aee7-11dc-b781-0016179b2dd5">
	<topic>e2fsprogs -- heap buffer overflow</topic>
	<affects>
	<package>
	<name>e2fsprogs</name>
	<range><lt>1.40.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Theodore Y. Ts'o reports:</p>
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230">
	<p>Fix a potential security vulnerability where an untrusted
	filesystem can be corrupted in such a way that a program using
	libext2fs will allocate a buffer which is far too small. This
	can lead to either a crash or potentially a heap-based buffer
	overflow crash. No known exploits exist, but main concern is
	where an untrusted user who possesses privileged access in a
	guest Xen environment could corrupt a filesystem which is then
	accessed by thus allowing the untrusted user to gain privileged
	access in the host OS. Thanks to the McAfee AVERT Research group
	for reporting this issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26772</bid>
	<cvename>CVE-2007-5497</cvename>
	<url>http://secunia.com/advisories/27889/</url>
	<url>http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230</url>
	</references>
	<dates>
	<discovery>2007-12-07</discovery>
	<entry>2007-12-20</entry>
	</dates>
	</vuln>

	<vuln vid="8a835235-ae84-11dc-a5f9-001a4d49522b">
	<topic>wireshark -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.16</ge><lt>0.99.7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Wireshark team reports of multiple vulnerabilities:</p>
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-03.html">
	<ul>
	<li>Wireshark could crash when reading an MP3 file.</li>
	<li>Beyond Security discovered that Wireshark could loop
	excessively while reading a malformed DNP packet.</li>
	<li>Stefan Esser discovered a buffer overflow in the SSL
	dissector.</li>
	<li>The ANSI MAP dissector could be susceptible to a
	buffer overflow on some platforms.</li>
	<li>The Firebird/Interbase dissector could go into an
	infinite loop or crash.</li>
	<li>The NCP dissector could cause a crash.</li>
	<li>The HTTP dissector could crash on some systems while
	decoding chunked messages.</li>
	<li>The MEGACO dissector could enter a large loop and
	consume system resources.</li>
	<li>The DCP ETSI dissector could enter a large loop and
	consume system resources.</li>
	<li>Fabiodds discovered a buffer overflow in the iSeries
	(OS/400) Communication trace file parser.</li>
	<li>The PPP dissector could overflow a buffer.</li>
	<li>The Bluetooth SDP dissector could go into an infinite
	loop.</li>
	<li>A malformed RPC Portmap packet could cause a
	crash.</li>
	<li>The IPv6 dissector could loop excessively.</li>
	<li>The USB dissector could loop excessively or crash.</li>
	<li>The SMB dissector could crash.</li>
	<li>The RPL dissector could go into an infinite loop.</li>
	<li>The WiMAX dissector could crash due to unaligned
	access on some platforms.</li>
	<li>The CIP dissector could attempt to allocate a huge
	amount of memory and crash.</li>
	</ul>

	<h2>Impact</h2>

	<p>It may be possible to make Wireshark or Ethereal crash or
	use up available memory by injecting a purposefully
	malformed packet onto the wire or by convincing someone to
	read a malformed packet trace file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6112</cvename>
	<cvename>CVE-2007-6113</cvename>
	<cvename>CVE-2007-6114</cvename>
	<cvename>CVE-2007-6115</cvename>
	<cvename>CVE-2007-6117</cvename>
	<cvename>CVE-2007-6118</cvename>
	<cvename>CVE-2007-6120</cvename>
	<cvename>CVE-2007-6121</cvename>
	<cvename>CVE-2007-6438</cvename>
	<cvename>CVE-2007-6439</cvename>
	<cvename>CVE-2007-6441</cvename>
	<cvename>CVE-2007-6450</cvename>
	<cvename>CVE-2007-6451</cvename>
	<url>http://www.wireshark.org/security/wnpa-sec-2007-03.html</url>
	</references>
	<dates>
	<discovery>2007-12-19</discovery>
	<entry>2007-12-19</entry>
	<modified>2007-12-22</modified>
	</dates>
	</vuln>

	<vuln vid="31b045e7-ae75-11dc-a5f9-001a4d49522b">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.25</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Software ASA reports about multiple security
	fixes:</p>
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
	<ul>
	<li>Fixed an issue where plug-ins could be used to allow
	cross domain scripting, as reported by David
	Bloom. Details will be disclosed at a later date.</li>
	<li>Fixed an issue with TLS certificates that could be
	used to execute arbitrary code, as reported by Alexander
	Klink (Cynops GmbH). Details will be disclosed at a
	later date.</li>
	<li>Rich text editing can no longer be used to allow cross
	domain scripting, as reported by David Bloom. See our
	advisory.</li>
	<li>Prevented bitmaps from revealing random data from
	memory, as reported by Gynvael Coldwind. Details will be
	disclosed at a later date.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6520</cvename>
	<cvename>CVE-2007-6521</cvename>
	<cvename>CVE-2007-6522</cvename>
	<cvename>CVE-2007-6524</cvename>
	<url>http://www.opera.com/docs/changelogs/freebsd/925/</url>
	<url>http://www.opera.com/support/search/view/875/</url>
	</references>
	<dates>
	<discovery>2007-12-19</discovery>
	<entry>2007-12-19</entry>
	<modified>2007-12-29</modified>
	</dates>
	</vuln>

	<vuln vid="31435fbc-ae73-11dc-a5f9-001a4d49522b">
	<topic>peercast -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>peercast</name>
	<range><lt>0.1218</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Luigi Auriemma reports that peercast is vulnerable to a
	buffer overflow which could lead to a DoS or potentially
	remote code execution:</p>
	<blockquote cite="http://aluigi.altervista.org/adv/peercasthof-adv.txt">
	<p>The handshakeHTTP function which handles all the requests
	received by the other clients is vulnerable to a heap
	overflow which allows an attacker to fill the
	loginPassword and loginMount buffers located in the
	Servent class with how much data he wants.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6454</cvename>
	<url>http://aluigi.altervista.org/adv/peercasthof-adv.txt</url>
	<url>http://secunia.com/advisories/28120/</url>
	</references>
	<dates>
	<discovery>2007-12-17</discovery>
	<entry>2007-12-19</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="fee7e059-acec-11dc-807f-001b246e4fdf">
	<topic>ganglia-webfrontend -- XSS vulnerabilities</topic>
	<affects>
	<package>
	<name>ganglia-webfrontend</name>
	<range><lt>3.0.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Ganglia project reports:</p>
	<blockquote cite="http://ganglia.info/?p=60">
	<p>The Ganglia development team is pleased to release Ganglia
	3.0.6 (Foss) which is available[...]. This release includes a
	security fix for web frontend cross-scripting vulnerability.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com</url>
	<url>http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&forum_name=ganglia-developers</url>
	</references>
	<dates>
	<discovery>2007-12-10</discovery>
	<entry>2007-12-17</entry>
	<modified>2007-12-18</modified>
	</dates>
	</vuln>

	<vuln vid="30f5ca1d-a90b-11dc-bf13-0211060005df">
	<topic>qemu -- Translation Block Local Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.0_4</lt></range>
	<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070802_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/26666/discuss">
	<p>QEMU is prone to a local denial-of-service vulnerability
	because it fails to perform adequate boundary checks when
	handling user-supplied input.</p>
	<p>Attackers can exploit this issue to cause denial-of-service
	conditions. Given the nature of the issue, attackers may also be
	able to execute arbitrary code, but this has not been confirmed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26666</bid>
	<cvename>CVE-2007-6227</cvename>
	<url>http://www.securityfocus.com/archive/1/484429</url>
	</references>
	<dates>
	<discovery>2007-11-30</discovery>
	<entry>2007-12-12</entry>
	<modified>2007-12-14</modified>
	</dates>
	</vuln>

	<vuln vid="fa708908-a8c7-11dc-b41d-000fb5066b20">
	<topic>drupal -- SQL injection vulnerability</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.4</lt></range>
	</package>
	<package>
	<name>drupal4</name>
	<range><lt>4.7.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/198162">
	<p>The function taxonomy_select_nodes() directly injects variables
	into SQL queries instead of using placeholders. While taxonomy
	module itself validates the input passed to
	taxonomy_select_nodes(), this is a weakness in Drupal core.
	Several contributed modules, such as taxonomy_menu, ajaxLoader,
	and ubrowser, directly pass user input to taxonomy_select_nodes(),
	enabling SQL injection attacks by anonymous users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6299</cvename>
	<url>http://drupal.org/node/198162</url>
	<url>http://secunia.com/advisories/27932/</url>
	</references>
	<dates>
	<discovery>2007-12-05</discovery>
	<entry>2007-12-12</entry>
	</dates>
	</vuln>

	<vuln vid="ffcbd42d-a8c5-11dc-bec2-02e0185f8d72">
	<topic>samba -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>samba</name>
	<name>samba3</name>
	<name>ja-samba</name>
	<range><lt>3.0.28</lt></range>
	<range><gt>*,1</gt><lt>3.0.28,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secuna Research reports:</p>
	<blockquote cite="http://secunia.com/advisories/27760/">
	<p>Secunia Research has discovered a vulnerability in Samba, which
	can be exploited by malicious people to compromise a vulnerable
	system. The vulnerability is caused due to a boundary error within
	the "send_mailslot()" function. This can be exploited to cause a
	stack-based buffer overflow with zero bytes via a specially crafted
	"SAMLOGON" domain logon packet containing a username string placed
	at an odd offset followed by an overly long GETDC string.
	Successful exploitation allows execution of arbitrary code, but
	requires that the "domain logons" option is enabled.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6015</cvename>
	<url>http://secunia.com/advisories/27760/</url>
	</references>
	<dates>
	<discovery>2007-12-10</discovery>
	<entry>2007-12-12</entry>
	<modified>2008-09-26</modified>
	</dates>
	</vuln>

	<vuln vid="b2571f88-a867-11dc-a6f0-00a0cce0781e">
	<topic>smbftpd -- format string vulnerability</topic>
	<affects>
	<package>
	<name>smbftpd</name>
	<range><lt>0.96</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/27014/">
	<p>Format string vulnerability in the SMBDirList function in dirlist.c
	in SmbFTPD 0.96 allows remote attackers to execute arbitrary code
	via format string specifiers in a directory name.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5184</cvename>
	<url>http://secunia.com/advisories/27014/</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=543077</url>
	</references>
	<dates>
	<discovery>2007-10-01</discovery>
	<entry>2007-12-12</entry>
	</dates>
	</vuln>

	<vuln vid="6ae7cef2-a6ae-11dc-95e6-000c29c5647f">
	<topic>jetty -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>jetty</name>
	<range><lt>6.1.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5613">
	<p>Cross-site scripting (XSS) vulnerability in Dump Servlet in
	Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject
	arbitrary web script or HTML via unspecified parameters and
	cookies.</p>
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5614">
	<p>Mortbay Jetty before 6.1.6rc1 does not properly handle "certain
	quote sequences" in HTML cookie parameters, which allows remote
	attackers to hijack browser sessions via unspecified vectors.</p>
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5615">
	<p>CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0
	allows remote attackers to inject arbitrary HTTP headers and
	conduct HTTP response splitting attacks via unspecified vectors.
	</p>
	</blockquote>
	</body>
	</description>
	<references>
	<certvu>237888</certvu>
	<certvu>212984</certvu>
	<certvu>438616</certvu>
	<cvename>CVE-2007-5613</cvename>
	<cvename>CVE-2007-5614</cvename>
	<cvename>CVE-2007-5615</cvename>
	<url>http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt</url>
	</references>
	<dates>
	<discovery>2007-12-05</discovery>
	<entry>2007-12-10</entry>
	</dates>
	</vuln>

	<vuln vid="821afaa2-9e9a-11dc-a7e3-0016360406fa">
	<topic>liveMedia -- DoS vulnerability</topic>
	<affects>
	<package>
	<name>liveMedia</name>
	<range><lt>2007.11.18,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The live555 development team reports:</p>
	<blockquote cite="http://www.live555.com/liveMedia/public/changelog.txt">
	<p>Fixed a bounds-checking error in "parseRTSPRequestString()"
	caused by an int vs. unsigned problem.</p>
	</blockquote>
	<blockquote cite="http://aluigi.altervista.org/adv/live555x-adv.txt">
	<p>The function which handles the incoming queries from the
	clients is affected by a vulnerability which allows an attacker
	to crash the server remotely using the smallest RTSP query
	possible to use.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6036</cvename>
	<url>http://aluigi.altervista.org/adv/live555x-adv.txt</url>
	<url>http://www.live555.com/liveMedia/public/changelog.txt</url>
	</references>
	<dates>
	<discovery>2007-11-20</discovery>
	<entry>2007-12-08</entry>
	<modified>2007-12-09</modified>
	</dates>
	</vuln>

	<vuln vid="610bc692-a2ad-11dc-900c-000bcdc1757a">
	<topic>GNU finger vulnerability</topic>
	<affects>
	<package>
	<name>gnu-finger</name>
	<range><le>1.37_1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU security announcement:</p>
	<blockquote cite="http://www.gnu.org/software/finger/">
	<p>GNU Finger unfortunately has not been updated in
	many years, and has known security vulnerabilities.
	Please do not use it in production environments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-1999-1165</cvename>
	<url>http://www.gnu.org/software/finger/</url>
	</references>
	<dates>
	<discovery>1999-07-21</discovery>
	<entry>2007-12-05</entry>
	</dates>
	</vuln>

	<vuln vid="6eb580d7-a29c-11dc-8919-001c2514716c">
	<topic>Squid -- Denial of Service Vulnerability</topic>
	<affects>
	<package>
	<name>squid</name>
	<range><ge>2.0</ge><lt>2.6.16_1</lt></range>
	<range><ge>3.*</ge><lt>3.0.r1.20071001_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Squid secuirty advisory reports:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_2.txt">
	<p>Due to incorrect bounds checking Squid is vulnerable
	to a denial of service check during some cache update
	reply processing.</p>
	<p>This problem allows any client trusted to use the
	service to perform a denial of service attack on the
	Squid service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26687</bid>
	<cvename>CVE-2007-6239</cvename>
	</references>
	<dates>
	<discovery>2007-11-28</discovery>
	<entry>2007-12-04</entry>
	<modified>2007-12-07</modified>
	</dates>
	</vuln>

	<vuln vid="30acb8ae-9d46-11dc-9114-001c2514716c">
	<topic>rubygem-rails -- session-fixation vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>1.2.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rails core team reports:</p>
	<blockquote cite="http://weblog.rubyonrails.com/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release">
	<p>The rails core team has released ruby on rails 1.2.6 to
	address a bug in the fix for session fixation attacks
	(CVE-2007-5380). The CVE Identifier for this new issue
	is CVE-2007-6077.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6077</cvename>
	</references>
	<dates>
	<discovery>2007-11-24</discovery>
	<entry>2007-11-27</entry>
	</dates>
	</vuln>

	<vuln vid="44fb0302-9d38-11dc-9114-001c2514716c">
	<topic>rubygem-rails -- JSON XSS vulnerability</topic>
	<affects>
	<package>
	<name>rubygem-rails</name>
	<range><lt>1.2.5</lt></range>
	</package>
	<package>
	<name>rubygem-activesupport</name>
	<range><lt>1.4.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rails core team reports:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release">
	<p>All users of Rails 1.2.4 or earlier are advised to upgrade
	to 1.2.5, though it isn't strictly necessary if you
	aren't working with JSON. For more information the JSON
	vulnerability, see CVE-2007-3227.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3227</cvename>
	</references>
	<dates>
	<discovery>2007-10-12</discovery>
	<entry>2007-11-28</entry>
	<modified>2007-12-01</modified>
	</dates>
	</vuln>

	<vuln vid="31d9fbb4-9d09-11dc-a29d-0016d325a0ed">
	<topic>ikiwiki -- improper symlink verification vulnerability</topic>
	<affects>
	<package>
	<name>ikiwiki</name>
	<range><lt>2.14</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ikiwiki development team reports:</p>
	<blockquote cite="http://ikiwiki.info/security/#index29h2">
	<p>Ikiwiki did not check if path to the srcdir to contained a
	symlink. If an attacker had commit access to the directories in
	the path, they could change it to a symlink, causing ikiwiki to
	read and publish files that were not intended to be
	published. (But not write to them due to other checks.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://ikiwiki.info/security/#index29h2</url>
	</references>
	<dates>
	<discovery>2007-11-26</discovery>
	<entry>2007-11-27</entry>
	</dates>
	</vuln>

	<vuln vid="f1f6f6da-9d2f-11dc-9114-001c2514716c">
	<topic>firefox -- multiple remote unspecified memory corruption vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.10,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.10</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.7</lt></range>
	</package>
	<package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.0.2</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.12.12</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><lt>2.0.a2007.12.12</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla Foundation reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/2007/mfsa2007-38.html">
	<p>The Firefox 2.0.0.10 update contains fixes for three bugs that
	improve the stability of the product. These crashes showed some
	evidence of memory corruption under certain circumstances and we
	presume that with enough effort at least some of these could be
	exploited to run arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26593</bid>
	<cvename>CVE-2007-5959</cvename>
	</references>
	<dates>
	<discovery>2007-11-26</discovery>
	<entry>2007-11-27</entry>
	<modified>2007-12-14</modified>
	</dates>
	</vuln>

	<vuln vid="15485ae8-9848-11dc-9e48-0016179b2dd5">
	<topic>phpmyadmin -- Cross Site Scripting</topic>
	<affects>
	<package>
	<name>phpmyadmin</name>
	<range><lt>2.11.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin security announcement:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8">
	<p>The login page auth_type cookie was vulnerable to XSS via
	the convcharset parameter. An attacker could use this to
	execute malicious code on the visitors computer</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-6100</cvename>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8</url>
	<url>http://www.nth-dimension.org.uk/downloads.php?id=38</url>
	</references>
	<dates>
	<discovery>2007-11-20</discovery>
	<entry>2007-11-21</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="a63b15f9-97ff-11dc-9e48-0016179b2dd5">
	<topic>samba -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>samba</name>
	<name>samba3</name>
	<name>ja-samba</name>
	<range><lt>3.0.26a</lt></range>
	<range><gt>*,1</gt><lt>3.0.26a_2,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba Team reports:</p>
	<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-5398.html">
	<p>Secunia Research reported a vulnerability that allows for
	the execution of arbitrary code in nmbd. This defect may
	only be exploited when the "wins support" parameter has
	been enabled in smb.conf.</p>
	</blockquote>
	<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-4572.html">
	<p>Samba developers have discovered what is believed to be
	a non-exploitable buffer over in nmbd during the processing
	of GETDC logon server requests. This code is only used
	when the Samba server is configured as a Primary or Backup
	Domain Controller.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26454</bid>
	<cvename>CVE-2007-4572</cvename>
	<cvename>CVE-2007-5398</cvename>
	<url>http://secunia.com/advisories/27450/</url>
	<url>http://us1.samba.org/samba/security/CVE-2007-4572.html</url>
	<url>http://us1.samba.org/samba/security/CVE-2007-5398.html</url>
	</references>
	<dates>
	<discovery>2007-11-15</discovery>
	<entry>2007-11-21</entry>
	<modified>2008-09-26</modified>
	</dates>
	</vuln>

	<vuln vid="392b5b1d-9471-11dc-9db7-001c2514716c">
	<topic>php -- multiple security vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PHP project reports:</p>
	<blockquote cite="http://www.php.net/releases/5_2_5.php">
	<p>Security Enhancements and Fixes in PHP 5.2.5:</p>
	<ul>
	<li>Fixed dl() to only accept filenames. Reported by Laurent
	Gaffie.</li>
	<li>Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
	Reported by Laurent Gaffie.</li>
	<li>Fixed htmlentities/htmlspecialchars not to accept partial
	multibyte sequences. Reported by Rasmus Lerdorf</li>
	<li>Fixed possible triggering of buffer overflows inside glibc
	implementations of the fnmatch(), setlocale() and glob()
	functions. Reported by Laurent Gaffie.</li>
	<li>Fixed "mail.force_extra_parameters" php.ini directive not to be
	modifiable in .htaccess due to the security implications. Reported
	by SecurityReason.</li>
	<li>Fixed bug #42869 (automatic session id insertion adds sessions
	id to non-local forms).</li>
	<li>Fixed bug #41561 (Values set with php_admin_* in httpd.conf can
	be overwritten with ini_set()).</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26403</bid>
	<cvename>CVE-2007-4887</cvename>
	</references>
	<dates>
	<discovery>2007-11-08</discovery>
	<entry>2007-11-16</entry>
	</dates>
	</vuln>

	<vuln vid="a7080c30-91a2-11dc-b2eb-00b0d07e6c7e">
	<topic>mt-daapd -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>mt-daapd</name>
	<range><lt>0.2.4.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>US-CERT reports:</p>
	<blockquote cite="http://www.us-cert.gov/cas/bulletins/SB07-316.html">
	<p>webserver.c in mt-dappd in Firefly Media Server 0.2.4 and
	earlier allows remote attackers to cause a denial of service
	(NULL dereference and daemon crash) via a stats method action
	to /xml-rpc with (1) an empty Authorization header line, which
	triggers a crash in the ws_decodepassword function; or (2) a
	header line without a ':' character, which triggers a crash
	in the ws_getheaders function.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5824</cvename>
	</references>
	<dates>
	<discovery>2007-11-05</discovery>
	<entry>2007-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="92f86b93-923f-11dc-a2bf-02e081235dab">
	<topic>net-snmp -- denial of service via GETBULK request</topic>
	<affects>
	<package>
	<name>net-snmp</name>
	<range><lt>5.3.1_7</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846">
	<p>The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1
	allows remote attackers to cause a denial of service (CPU
	and memory consumption) via a GETBULK request with a large
	max-repeaters value.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5846</cvename>
	</references>
	<dates>
	<discovery>2007-11-06</discovery>
	<entry>2007-11-13</entry>
	<modified>2007-11-14</modified>
	</dates>
	</vuln>

	<vuln vid="ff65eecb-91e4-11dc-bd6c-0016179b2dd5">
	<topic>flac -- media file processing integer overflow vulnerabilities</topic>
	<affects>
	<package>
	<name>flac</name>
	<range><lt>1.1.2_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDefense Laps reports:</p>
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608">
	<p>Remote exploitation of multiple integer overflow vulnerabilities
	in libFLAC, as included with various vendor's software
	distributions, allows attackers to execute arbitrary code
	in the context of the currently logged in user.</p>
	<p>These vulnerabilities specifically exist in the handling of
	malformed FLAC media files. In each case, an integer overflow can
	occur while calculating the amount of memory to allocate. As such,
	insufficient memory is allocated for the data that is subsequently
	read in from the file, and a heap based buffer overflow occurs.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4619</cvename>
	<url>http://secunia.com/advisories/27210/</url>
	<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608</url>
	</references>
	<dates>
	<discovery>2007-10-11</discovery>
	<entry>2007-11-13</entry>
	</dates>
	</vuln>

	<vuln vid="2747fc39-915b-11dc-9239-001c2514716c">
	<topic>xpdf -- multiple remote Stream.CC vulnerabilities</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>1.3.3_2</lt></range>
	</package>
	<package>
	<name>gpdf</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>kdegraphics</name>
	<range><lt>3.5.8_1</lt></range>
	</package>
	<package>
	<name>koffice</name>
	<range><lt>1.6.3_3,2</lt></range>
	</package>
	<package>
	<name>poppler</name>
	<range><lt>0.6</lt></range>
	</package>
	<package>
	<name>xpdf</name>
	<range><lt>3.02_5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/483372">
	<p>Secunia Research has discovered some vulnerabilities in Xpdf,
	which can be exploited by malicious people to compromise a user's
	system.</p>
	<ul>
	<li>An array indexing error within the
	"DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc
	can be exploited to corrupt memory via a specially crafted PDF
	file.</li>
	<li>An integer overflow error within the "DCTStream::reset()"
	method in xpdf/Stream.cc can be exploited to cause a heap-based
	buffer overflow via a specially crafted PDF file.</li>
	<li>A boundary error within the "CCITTFaxStream::lookChar()" method
	in xpdf/Stream.cc can be exploited to cause a heap-based buffer
	overflow by tricking a user into opening a PDF file containing a
	specially crafted "CCITTFaxDecode" filter.</li>
	</ul>
	<p>Successful exploitation may allow execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26367</bid>
	<cvename>CVE-2007-4352</cvename>
	<cvename>CVE-2007-5392</cvename>
	<cvename>CVE-2007-5393</cvename>
	</references>
	<dates>
	<discovery>2007-11-07</discovery>
	<entry>2007-11-12</entry>
	<modified>2007-11-14</modified>
	</dates>
	</vuln>

	<vuln vid="ffba6ab0-90b5-11dc-9835-003048705d5a">
	<topic>plone -- unsafe data interpreted as pickles</topic>
	<affects>
	<package>
	<name>plone</name>
	<range><ge>2.5</ge><lt>2.5.5</lt></range>
	<range><ge>3.0</ge><lt>3.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Plone projectreports:</p>
	<blockquote cite="http://plone.org/about/security/advisories/cve-2007-5741">
	<p>This hotfix corrects a vulnerability in the statusmessages
	and linkintegrity modules, where unsafe network data was
	interpreted as python pickles. This allows an attacker to
	run arbitrary python code within the Zope/Plone process.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26354</bid>
	<cvename>CVE-2007-5741</cvename>
	</references>
	<dates>
	<discovery>2007-11-06</discovery>
	<entry>2007-11-12</entry>
	</dates>
	</vuln>

	<vuln vid="2d2dcbb4-906c-11dc-a951-0016179b2dd5">
	<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The DigiTrust Group reports:</p>
	<blockquote cite="http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html">
	<p>When creating a new database, a malicious user can use a
	client-side Web proxy to place malicious code in the db parameter of
	the POST request. Since db_create.php does not properly sanitize
	user-supplied input, an administrator could face a persistent XSS
	attack when the database names are displayed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5976</cvename>
	<cvename>CVE-2007-5977</cvename>
	<url>http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7</url>
	</references>
	<dates>
	<discovery>2007-11-11</discovery>
	<entry>2007-11-11</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="9b718b82-8ef5-11dc-8e42-001c2514716c">
	<topic>gallery2 -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gallery2</name>
	<range><lt>2.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gallery project reports:</p>
	<blockquote cite="http://gallery.menalto.com/gallery_2.2.3_released">
	<p>Gallery 2.2.3 addresses the following security vulnerabilities:</p>
	<ul>
	<li>Unauthorized renaming of items possible with WebDAV (reported
	by Merrick Manalastas)</li>
	<li>Unauthorized modification and retrieval of item properties
	possible with WebDAV</li>
	<li>Unauthorized locking and replacing of items possible with
	WebDAV</li>
	<li>Unauthorized editing of data file possible via linked items with
	Reupload and WebDAV (reported by Nicklous Roberts)</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4650</cvename>
	<bid>25580</bid>
	</references>
	<dates>
	<discovery>2007-08-29</discovery>
	<entry>2007-11-09</entry>
	</dates>
	</vuln>

	<vuln vid="20a4eb11-8ea3-11dc-a396-0016179b2dd5">
	<topic>tikiwiki -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>tikiwik</name>
	<range><lt>1.9.8.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/26618/">
	<p>Some vulnerabilities have been reported in TikiWiki, which
	can be exploited by malicious people to conduct cross-site
	scripting and script insertion attacks and disclose potentially
	sensitive information.</p>
	<p>Input passed to the username parameter in tiki-remind_password.php
	(when remind is set to send me my password) is not properly
	sanitised before being returned to the user. This can be exploited
	to execute arbitrary HTML and script code (for example with meta
	refreshes to a javascript: URL) in a user's browser session in
	context of an affected site.</p>
	<p>Input passed to the local_php and error_handler parameters in
	tiki-index.php is not properly verified before being used to include
	files. This can be exploited to include arbitrary files from local
	resources.</p>
	<p>Input passed to the imp_language parameter in
	tiki-imexport_languages.php is not properly verified before being
	used to include files. This can be exploited to include arbitrary
	files from local resources.</p>
	<p>Certain img src elements are not properly santised before being
	used. This can be exploited to insert arbitrary HTML and script
	code, which is executed in a user's browser session in context of an
	affected site when the malicious data is viewed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4554</cvename>
	<cvename>CVE-2007-5683</cvename>
	<cvename>CVE-2007-5684</cvename>
	<url>http://secunia.com/advisories/26618/</url>
	<url>http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&pathrev=REL-1-9-8-2</url>
	</references>
	<dates>
	<discovery>2007-08-27</discovery>
	<entry>2007-11-09</entry>
	<modified>2008-10-03</modified>
	</dates>
	</vuln>

	<vuln vid="8dd9722c-8e97-11dc-b8f6-001c2514716c">
	<topic>cups -- off-by-one buffer overflow</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>1.3.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/27233">
	<p>Secunia Research has discovered a vulnerability in CUPS, which can
	be exploited by malicious people to compromise a vulnerable
	system.</p>
	<p>The vulnerability is caused due to a boundary error within the
	"ippReadIO()" function in cups/ipp.c when processing IPP (Internet
	Printing Protocol) tags. This can be exploited to overwrite one
	byte on the stack with a zero by sending an IPP request containing
	specially crafted "textWithLanguage" or "nameWithLanguage" tags.</p>
	<p>Successful exploitation allows execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4351</cvename>
	<url>http://secunia.com/secunia_research/2007-76/</url>
	</references>
	<dates>
	<discovery>2007-11-06</discovery>
	<entry>2007-11-09</entry>
	<modified>2007-11-12</modified>
	</dates>
	</vuln>

	<vuln vid="5b47c279-8cb5-11dc-8878-0016179b2dd5">
	<topic>perl -- regular expressions unicode data buffer overflow</topic>
	<affects>
	<package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><gt>5.8.*</gt><lt>5.8.8_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Red Hat reports:</p>
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0966.html">
	<p>A flaw was found in Perl's regular expression engine. Specially
	crafted input to a regular expression can cause Perl to improperly
	allocate memory, possibly resulting in arbitrary code running with
	the permissions of the user running Perl.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5116</cvename>
	<url>http://secunia.com/advisories/27546/</url>
	</references>
	<dates>
	<discovery>2007-11-05</discovery>
	<entry>2007-11-06</entry>
	<modified>2007-11-07</modified>
	</dates>
	</vuln>

	<vuln vid="bfd6eef4-8c94-11dc-8c55-001c2514716c">
	<topic>pcre -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>pcre</name>
	<name>pcre-utf8</name>
	<range><lt>7.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian project reports:</p>
	<blockquote cite="http://www.debian.org/security/2007/dsa-1399">
	<p>Tavis Ormandy of the Google Security Team has discovered
	several security issues in PCRE, the Perl-Compatible Regular
	Expression library, which potentially allow attackers to
	execute arbitrary code by compiling specially crafted regular
	expressions.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-1659</cvename>
	<cvename>CVE-2007-1660</cvename>
	<cvename>CVE-2007-1661</cvename>
	<cvename>CVE-2007-1662</cvename>
	<cvename>CVE-2007-4766</cvename>
	<cvename>CVE-2007-4767</cvename>
	<cvename>CVE-2007-4768</cvename>
	<url>http://www.pcre.org/changelog.txt</url>
	</references>
	<dates>
	<discovery>2007-11-05</discovery>
	<entry>2007-11-06</entry>
	</dates>
	</vuln>

	<vuln vid="617a4021-8bf0-11dc-bffa-0016179b2dd5">
	<topic>perdition -- str_vwrite format string vulnerability</topic>
	<affects>
	<package>
	<name>perdition</name>
	<range><lt>1.17.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SEC-Consult reports:</p>
	<blockquote cite="http://www.sec-consult.com/300.html">
	<p>Perdition IMAP is affected by a format string bug in one of its
	IMAP output-string formatting functions. The bug allows the
	execution of arbitrary code on the affected server.
	A successful exploit does not require prior authentication.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26270</bid>
	<cvename>CVE-2007-5740</cvename>
	<url>http://www.sec-consult.com/300.html</url>
	<url>http://secunia.com/advisories/27458</url>
	</references>
	<dates>
	<discovery>2007-10-31</discovery>
	<entry>2007-11-05</entry>
	</dates>
	</vuln>

	<vuln vid="f8b0f83c-8bb3-11dc-bffa-0016179b2dd5">
	<topic>gftp -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gftp</name>
	<range><lt>2.0.18_6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml">
	<p>Kalle Olavi Niemitalo discovered two boundary errors in fsplib code
	included in gFTP when processing overly long directory or file
	names.</p>
	<p>A remote attacker could trigger these vulnerabilities by enticing
	a user to download a file with a specially crafted directory or file
	name, possibly resulting in the execution of arbitrary code or a
	Denial of Service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3961</cvename>
	<cvename>CVE-2007-3962</cvename>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml</url>
	</references>
	<dates>
	<discovery>2007-11-01</discovery>
	<entry>2007-11-05</entry>
	<modified>2007-11-11</modified>
	</dates>
	</vuln>

	<vuln vid="a1ef3fc0-8ad0-11dc-9490-0016179b2dd5">
	<topic>dircproxy -- remote denial of service</topic>
	<affects>
	<package>
	<name>dircproxy</name>
	<range><lt>1.0.5_1</lt></range>
	</package>
	<package>
	<name>dircproxy-devel</name>
	<range><lt>1.2.0.b2_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Securiweb reports:</p>
	<blockquote cite="http://dircproxy.securiweb.net/ticket/89">
	<p>dircproxy allows remote attackers to cause a denial of
	service (segmentation fault) via an ACTION command without a
	parameter, which triggers a NULL pointer dereference, as
	demonstrated using a blank /me message from irssi.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5226</cvename>
	<url>http://dircproxy.securiweb.net/ticket/89</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=319301</url>
	</references>
	<dates>
	<discovery>2006-09-06</discovery>
	<entry>2007-11-04</entry>
	<modified>2008-01-31</modified>
	</dates>
	</vuln>

	<vuln vid="a467d0f9-8875-11dc-b3ba-0016179b2dd5">
	<topic>wordpress -- cross-site scripting</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<range><lt>2.3.1</lt></range>
	</package>
	<package>
	<name>zh-wordpress</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory report:</p>
	<blockquote cite="http://secunia.com/advisories/27407">
	<p>Input passed to the "posts_columns" parameter in
	wp-admin/edit-post-rows.php is not properly sanitised before
	being returned to the user. This can be exploited to execute
	arbitrary HTML and script code in a user's browser session in
	context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5710</cvename>
	<url>http://secunia.com/advisories/27407</url>
	<url>http://wordpress.org/development/2007/10/wordpress-231/</url>
	</references>
	<dates>
	<discovery>2007-10-29</discovery>
	<entry>2007-11-01</entry>
	</dates>
	</vuln>

	<vuln vid="db449245-870d-11dc-a3ec-001921ab2fa4">
	<topic>openldap -- multiple remote denial of service vulnerabilities</topic>
	<affects>
	<package>
	<name>openldap-server</name>
	<range><lt>2.3.39</lt></range>
	<range><gt>2.4.0</gt><lt>2.4.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BugTraq reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/26245/">
	<p>OpenLDAP is prone to multiple remote denial-of-service
	vulnerabilities because of an incorrect NULL-termination
	issue and a double-free issue.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>26245</bid>
	<cvename>CVE-2007-5707</cvename>
	<cvename>CVE-2007-5708</cvename>
	</references>
	<dates>
	<discovery>2007-10-29</discovery>
	<entry>2007-10-30</entry>
	<modified>2007-10-31</modified>
	</dates>
	</vuln>

	<vuln vid="d2c2952d-85a1-11dc-bfff-003048705d5a">
	<topic>py-django -- denial of service vulnerability</topic>
	<affects>
	<package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<range><lt>0.96.1</lt></range>
	</package>
	<package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<range><lt>20071026</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Django project reports:</p>
	<blockquote cite="http://www.djangoproject.com/weblog/2007/oct/26/security-fix/">
	<p>A per-process cache used by Django's internationalization
	("i18n") system to store the results of translation lookups
	for particular values of the HTTP Accept-Language header
	used the full value of that header as a key. An attacker
	could take advantage of this by sending repeated requests
	with extremely large strings in the Accept-Language header,
	potentially causing a denial of service by filling available
	memory.</p>
	<p>Due to limitations imposed by Web server software on the
	size of HTTP header fields, combined with reasonable limits
	on the number of requests which may be handled by a single
	server process over its lifetime, this vulnerability may be
	difficult to exploit. Additionally, it is only present when
	the "USE_I18N" setting in Django is "True" and the i18n
	middleware component is enabled*. Nonetheless, all users of
	affected versions of Django are encouraged to update.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.djangoproject.com/weblog/2007/oct/26/security-fix/</url>
	</references>
	<dates>
	<discovery>2007-10-26</discovery>
	<entry>2007-10-27</entry>
	</dates>
	</vuln>

	<vuln vid="44224e08-8306-11dc-9283-0016179b2dd5">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory from Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/view/866/">
	<p>If a user has configured Opera to use an external newsgroup
	client or e-mail application, specially crafted Web pages can
	cause Opera to run that application incorrectly. In some cases
	this can lead to execution of arbitrary code.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/867/">
	<p>When accesing frames from different Web sites, specially crafted
	scripts can bypass the same-origin policy, and overwrite functions
	from those frames. If scripts on the page then run those functions,
	this can cause the script of the attacker's choice to run in the
	context of the target Web site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5540</cvename>
	<cvename>CVE-2007-5541</cvename>
	<url>http://www.opera.com/support/search/view/866/</url>
	<url>http://www.opera.com/support/search/view/867/</url>
	<url>http://secunia.com/advisories/27277/</url>
	</references>
	<dates>
	<discovery>2007-10-17</discovery>
	<entry>2007-10-25</entry>
	</dates>
	</vuln>

	<vuln vid="9c00d446-8208-11dc-9283-0016179b2dd5">
	<topic>drupal --- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal4</name>
	<range><lt>4.7.8</lt></range>
	</package>
	<package>
	<name>drupal5</name>
	<range><lt>5.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/184315">
	<p>In some circumstances Drupal allows user-supplied data to
	become part of response headers. As this user-supplied data
	is not always properly escaped, this can be exploited by
	malicious users to execute HTTP response splitting attacks
	which may lead to a variety of issues, among them cache
	poisoning, cross-user defacement and injection of arbitrary
	code.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/184316">
	<p>The Drupal installer allows any visitor to provide credentials
	for a database when the site's own database is not reachable. This
	allows attackers to run arbitrary code on the site's server.
	An immediate workaround is the removal of the file install.php
	in the Drupal root directory.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/184320">
	<p>The allowed extension list of the core Upload module contains
	the extension HTML by default. Such files can be used to execute
	arbitrary script code in the context of the affected site when a
	user views the file. Revoking upload permissions or removing the
	.html extension from the allowed extension list will stop uploads
	of malicious files. but will do nothing to protect your site
	againstfiles that are already present. Carefully inspect the file
	system path for any HTML files. We recommend you remove any HTML
	file you did not update yourself. You should look for , CSS
	includes, Javascript includes, and onerror="" attributes if
	you need to review files individually.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/184348">
	<p>The Drupal Forms API protects against cross site request
	forgeries (CSRF), where a malicious site can cause a user
	to unintentionally submit a form to a site where he is
	authenticated. The user deletion form does not follow the
	standard Forms API submission model and is therefore not
	protected against this type of attack. A CSRF attack may
	result in the deletion of users.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/184354">
	<p>The publication status of comments is not passed during the
	hook_comments API operation, causing various modules that rely
	on the publication status (such as Organic groups, or Subscriptions)
	to mail out unpublished comments.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5597</cvename>
	<cvename>CVE-2007-5596</cvename>
	<cvename>CVE-2007-5595</cvename>
	<cvename>CVE-2007-5594</cvename>
	<cvename>CVE-2007-5593</cvename>
	<url>http://drupal.org/node/184315</url>
	<url>http://drupal.org/node/184316</url>
	<url>http://drupal.org/node/184348</url>
	<url>http://drupal.org/node/184354</url>
	<url>http://drupal.org/node/184320</url>
	<url>http://secunia.com/advisories/27292</url>
	<url>http://secunia.com/advisories/27292</url>
	<url>http://secunia.com/advisories/27292</url>
	<url>http://secunia.com/advisories/27290</url>
	<url>http://secunia.com/advisories/27290</url>
	</references>
	<dates>
	<discovery>2007-10-17</discovery>
	<entry>2007-10-24</entry>
	</dates>
	</vuln>

	<vuln vid="3a81017a-8154-11dc-9283-0016179b2dd5">
	<topic>ldapscripts -- Command Line User Credentials Disclosure</topic>
	<affects>
	<package>
	<name>ldapscripts</name>
	<range><lt>1.7.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ganael Laplanche reports:</p>
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600">
	<p>Up to now, each ldap* command was called with the -w parameter,
	which allows to specify the bind password on the command line.
	Unfortunately, this could make the password appear to anybody
	performing a `ps` during the call. This is now avoided by using
	the -y parameter and a password file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600</url>
	<url>http://secunia.com/advisories/27111</url>
	<cvename>CVE-2007-5373</cvename>
	</references>
	<dates>
	<discovery>2007-10-09</discovery>
	<entry>2007-10-23</entry>
	</dates>
	</vuln>

	<vuln vid="e24797af-803d-11dc-b787-003048705d5a">
	<topic>firefox -- OnUnload Javascript browser entrapment vulnerability</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.8,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.8</lt></range>
	</package>
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RedHat reports:</p>
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0979.html">
	<p>Several flaws were found in the way in which Firefox
	displayed malformed web content. A web page containing
	specially-crafted content could potentially trick a user
	into surrendering sensitive information. (CVE-2007-1095,
	CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-1095</cvename>
	</references>
	<dates>
	<discovery>2007-10-19</discovery>
	<entry>2007-10-22</entry>
	<modified>2007-10-23</modified>
	</dates>
	</vuln>

	<vuln vid="498a8731-7cfc-11dc-96e6-0012f06707f0">
	<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.1.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The DigiTrust Group discovered serious XSS vulnerability in
	the phpMyAdmin server_status.php script. According to their
	report</p>
	<blockquote cite="http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html">
	<p>vulnerability can be exploited to execute arbitrary HTML and
	script code in a user's browser session in context of an affected
	site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5589</cvename>
	<url>http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html</url>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6</url>
	</references>
	<dates>
	<discovery>2007-10-17</discovery>
	<entry>2007-10-17</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="51b51d4a-7c0f-11dc-9e47-0011d861d5e2">
	<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
	<affects>
	<package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.1.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/26020/discuss">
	<p>phpMyAdmin is prone to a cross-site scripting vulnerability
	because it fails to properly sanitize user-supplied input.</p>
	<p>An attacker may leverage this issue to execute arbitrary script
	code in the browser of an unsuspecting user in the context of the
	affected site. This may help the attacker steal potentially
	sensitive information and launch other attacks.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5386</cvename>
	<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5</url>
	<url>http://www.digitrustgroup.com/advisories/TDG-advisory071009a</url>
	<url>http://secunia.com/advisories/27173</url>
	<bid>26020</bid>
	</references>
	<dates>
	<discovery>2007-10-12</discovery>
	<entry>2007-10-16</entry>
	<modified>2007-10-20</modified>
	</dates>
	</vuln>

	<vuln vid="7453c85d-7830-11dc-b4c8-0016179b2dd5">
	<topic>nagios-plugins -- Long Location Header Buffer Overflow Vulnerability</topic>
	<affects>
	<package>
	<name>nagios-plugins</name>
	<range><lt>1.4.10,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/27124/">
	<p>The vulnerability is caused due to a boundary error within the
	redir() function in check_http.c when processing HTTP Location:
	header information. This can be exploited to cause a buffer overflow
	by returning an overly long string in the "Location:" header to a
	vulnerable system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sourceforge.net/forum/forum.php?forum_id=740172</url>
	<url>http://secunia.com/advisories/27124/</url>
	<cvename>CVE-2007-5198</cvename>
	</references>
	<dates>
	<discovery>2007-09-28</discovery>
	<entry>2007-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="172acf78-780c-11dc-b3f4-0016179b2dd5">
	<topic>png -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>png</name>
	<range><lt>1.2.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/27093/">
	<p>Some vulnerabilities have been reported in libpng, which can be
	exploited by malicious people to cause a DoS (Denial of
	Service).</p>
	<p>Certain errors within libpng, including a logical NOT instead of a
	bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency
	extension, and an incorrect use of sizeof() may be exploited to
	crash an application using the library.</p>
	<p>Various out-of-bounds read errors exist within the functions
	png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(),
	png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by
	exploited to crash an application using the library.</p>
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/27130/">
	<p>The vulnerability is caused due to an off-by-one error within
	the ICC profile chunk handling, which potentially can be
	exploited to crash an application using the library.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/27093/</url>
	<url>http://secunia.com/advisories/27130/</url>
	<cvename>CVE-2007-5267</cvename>
	<cvename>CVE-2007-5266</cvename>
	<cvename>CVE-2007-5268</cvename>
	<cvename>CVE-2007-5269</cvename>
	</references>
	<dates>
	<discovery>2007-10-08</discovery>
	<entry>2007-10-11</entry>
	</dates>
	</vuln>

	<vuln vid="f5b29ec0-71f9-11dc-8c6a-00304881ac9a">
	<topic>ImageMagick -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.3.5.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities have been discovered in ImageMagick.</p>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4985">
	<p>ImageMagick before 6.3.5-9 allows context-dependent attackers
	to cause a denial of service via a crafted image file that
	triggers (1) an infinite loop in the ReadDCMImage function,
	related to ReadBlobByte function calls; or (2) an infinite
	loop in the ReadXCFImage function, related to ReadBlobMSBLong
	function calls.</p>
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4986">
	<p>Multiple integer overflows in ImageMagick before 6.3.5-9
	allow context-dependent attackers to execute arbitrary code
	via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5)
	.xwd image file, which triggers a heap-based buffer overflow.</p>
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4987">
	<p>Off-by-one error in the ReadBlobString function in blob.c in
	ImageMagick before 6.3.5-9 allows context-dependent attackers
	to execute arbitrary code via a crafted image file, which
	triggers the writing of a '\0' character to an out-of-bounds
	address.</p>
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4988">
	<p>Sign extension error in the ReadDIBImage function in
	ImageMagick before 6.3.5-9 allows context-dependent attackers
	to execute arbitrary code via a crafted width value in an
	image file, which triggers an integer overflow and a
	heap-based buffer overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4985</cvename>
	<cvename>CVE-2007-4986</cvename>
	<cvename>CVE-2007-4987</cvename>
	<cvename>CVE-2007-4988</cvename>
	<url>http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html</url>
	</references>
	<dates>
	<discovery>2007-09-19</discovery>
	<entry>2007-10-10</entry>
	</dates>
	</vuln>

	<vuln vid="c93e4d41-75c5-11dc-b903-0016179b2dd5">
	<topic>jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented</topic>
	<affects>
	<package>
	<name>jdk</name>
	<range><ge>1.3.0</ge><lt>1.6.0.3p3</lt></range>
	<range><ge>1.5.0,1</ge><lt>1.5.0.13p7,1</lt></range>
	</package>
	<package>
	<name>linux-blackdown-jdk</name>
	<range><ge>1.3.0</ge></range>
	</package>
	<package>
	<name>linux-sun-jdk</name>
	<range><ge>1.3.0</ge><lt>1.3.1.20</lt></range>
	<range><ge>1.4.0</ge><lt>1.4.2.16</lt></range>
	<range><eq>1.5.0.b1</eq></range>
	<range><eq>1.5.0.b1,1</eq></range>
	<range><ge>1.5.0,2</ge><lt>1.5.0.13,2</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.0.03</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SUN reports:</p>
	<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1">
	<p>A vulnerability in the Java Runtime Environment (JRE) with applet
	caching may allow an untrusted applet that is downloaded from a
	malicious website to make network connections to network services
	on machines other than the one that the applet was downloaded from.
	This may allow network resources (such as web pages) and
	vulnerabilities (that exist on these network services) which are not
	otherwise normally accessible to be accessed or exploited.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1</url>
	<cvename>CVE-2007-5232</cvename>
	</references>
	<dates>
	<discovery>2007-10-03</discovery>
	<entry>2007-10-08</entry>
	<modified>2007-11-16</modified>
	</dates>
	</vuln>

	<vuln vid="a5f667db-7596-11dc-8b7a-0019b944b34e">
	<topic>xfs -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>xfs</name>
	<range><lt>1.0.5,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthieu Herrb reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2007-October/028899.html">
	<h1>Problem Description:</h1>
	<p>Several vulnerabilities have been identified in xfs, the X font
	server. The QueryXBitmaps and QueryXExtents protocol requests
	suffer from lack of validation of their 'length' parameters.</p>
	<h1>Impact:</h1>
	<p>On most modern systems, the font server is accessible only for
	local clients and runs with reduced privileges, but on some
	systems it may still be accessible from remote clients and
	possibly running with root privileges, creating an opportunity
	for remote privilege escalation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4568</cvename>
	<url>http://lists.freedesktop.org/archives/xorg/2007-October/028899.html</url>
	</references>
	<dates>
	<discovery>2007-10-02</discovery>
	<entry>2007-10-08</entry>
	</dates>
	</vuln>

	<vuln vid="a058d6fa-7325-11dc-ae10-0016179b2dd5">
	<topic>tcl/tk -- buffer overflow in ReadImage function</topic>
	<affects>
	<package>
	<name>tk</name>
	<name>tk-threads</name>
	<range><gt>8.2.*</gt><lt>8.2.3_11</lt></range>
	<range><gt>8.3.*</gt><lt>8.3.5_10</lt></range>
	<range><gt>8.4.*,2</gt><lt>8.4.16,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Buffer overflow in the ReadImage function in generic/tkImgGIF.c
	in Tcl/Tk, allows remote attackers to execute arbitrary code via
	multi-frame interlaced GIF files in which later frames are smaller
	than the first.</p>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/26942</url>
	<url>http://sourceforge.net/project/shownotes.php?release_id=541207</url>
	<cvename>CVE-2007-5137</cvename>
	</references>
	<dates>
	<discovery>2007-09-27</discovery>
	<entry>2007-10-05</entry>
	<modified>2011-09-04</modified>
	</dates>
	</vuln>

	<vuln vid="91ed69f9-72c7-11dc-981a-001921ab2fa4">
	<topic>firebird -- multiple remote buffer overflow vulnerabilities</topic>
	<affects>
	<package>
	<name>firebird-server</name>
	<range><ge>1.*</ge><lt>1.5.5</lt></range>
	<range><ge>2.0.*</ge><lt>2.0.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>RISE Security reports:</p>
	<blockquote cite="http://risesecurity.org/advisory/RISE-2007003/">
	<p>There exists multiple vulnerabilities within functions
	of Firebird Relational Database, which when properly
	exploited can lead to remote compromise of the vulnerable
	system.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25925</bid>
	</references>
	<dates>
	<discovery>2007-10-03</discovery>
	<entry>2007-10-04</entry>
	</dates>
	</vuln>

	<vuln vid="15ec9123-7061-11dc-b372-001921ab2fa4">
	<topic>id3lib -- insecure temporary file creation</topic>
	<affects>
	<package>
	<name>id3lib</name>
	<range><lt>3.8.3_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Bug report log reports:</p>
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540">
	<p>When tagging file $foo, a temporary copy of the file is
	created, and for some reason, libid3 doesn't use mkstemp
	but just creates $foo.XXXXXX literally, without any checking.</p>
	<p>This would silently truncate and overwrite an existing
	$foo.XXXXXX.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25372</bid>
	<cvename>CVE-2007-4460</cvename>
	</references>
	<dates>
	<discovery>2007-08-20</discovery>
	<entry>2007-10-01</entry>
	<modified>2007-10-01</modified>
	</dates>
	</vuln>

	<vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72">
	<topic>mediawiki -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>mediawiki</name>
	<range><gt>1.10.0</gt><lt>1.10.2</lt></range>
	<range><gt>1.9.0</gt><lt>1.9.4</lt></range>
	<range><gt>1.8.0</gt><lt>1.8.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MediaWiki development team reports:</p>
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html">
	<p>A possible HTML/XSS injection vector in the API
	pretty-printing mode has been found and fixed.</p>
	<p>The vulnerability may be worked around in an unfixed version
	by simply disabling the API interface if it is not in use, by
	adding this to LocalSettings.php:</p>
	<p>$wgEnableAPI = false;</p>
	<p>(This is the default setting in 1.8.x.)</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4828</cvename>
	<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html</url>
	</references>
	<dates>
	<discovery>2007-09-10</discovery>
	<entry>2007-09-21</entry>
	<modified>2007-10-10</modified>
	</dates>
	</vuln>

	<vuln vid="63347ee7-6841-11dc-82b6-02e0185f8d72">
	<topic>wordpress -- remote sql injection vulnerability</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<range><lt>2.2.3,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>zh-wordpress</name>
	<range><lt>2.2.3</lt></range>
	</package>
	<package>
	<name>wordpress-mu</name>
	<range><lt>1.2.4,2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alexander Concha reports:</p>
	<blockquote cite="http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html">
	<p>While testing WordPress, it has been discovered a SQL
	Injection vulnerability that allows an attacker to retrieve
	remotely any user credentials from a vulnerable site, this
	bug is caused because of early database escaping and the
	lack of validation in query string like parameters.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4894</cvename>
	<url>http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html</url>
	</references>
	<dates>
	<discovery>2007-09-10</discovery>
	<entry>2007-09-21</entry>
	</dates>
	</vuln>

	<vuln vid="2bc96f18-683f-11dc-82b6-02e0185f8d72">
	<topic>samba -- nss_info plugin privilege escalation vulnerability</topic>
	<affects>
	<package>
	<name>samba</name>
	<range><lt>3.0.26a</lt></range>
	<range><gt>*,1</gt><lt>3.0.26a,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba development team reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2007-4138.html">
	<p>The idmap_ad.so library provides an nss_info extension to
	Winbind for retrieving a user's home directory path, login
	shell and primary group id from an Active Directory domain
	controller. This functionality is enabled by defining the
	"winbind nss info" smb.conf option to either "sfu" or
	"rfc2307".</p>
	<p>Both the Windows "Identity Management for Unix" and
	"Services for Unix" MMC plug-ins allow a user to be assigned
	a primary group for Unix clients that differs from the user's
	Windows primary group. When the rfc2307 or sfu nss_info plugin
	has been enabled, in the absence of either the RFC2307 or SFU
	primary group attribute, Winbind will assign a primary group ID
	of 0 to the domain user queried using the getpwnam() C library
	call.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4138</cvename>
	<url>http://www.samba.org/samba/security/CVE-2007-4138.html</url>
	</references>
	<dates>
	<discovery>2007-09-11</discovery>
	<entry>2007-09-21</entry>
	<modified>2008-09-26</modified>
	</dates>
	</vuln>

	<vuln vid="75231c63-f6a2-499d-8e27-787773bda284">
	<topic>bugzilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.20.*</ge><lt>2.22.3</lt></range>
	<range><ge>3.*</ge><lt>3.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/2.20.4/">
	<p>This advisory covers three security issues that have recently been
	fixed in the Bugzilla code:</p>
	<ul>
	<li>A possible cross-site scripting (XSS) vulnerability when filing
	bugs using the guided form.</li>
	<li>When using email_in.pl, insufficiently escaped data may be
	passed to sendmail.</li>
	<li>Users using the WebService interface may access Bugzilla's
	time-tracking fields even if they normally cannot see them.</li>
	</ul>
	<p>We strongly advise that 2.20.x and 2.22.x users should upgrade to
	2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or
	below, should upgrade to 3.0.1.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25425</bid>
	<cvename>CVE-2007-4538</cvename>
	<cvename>CVE-2007-4539</cvename>
	<cvename>CVE-2007-4543</cvename>
	<url>http://www.bugzilla.org/security/2.20.4/</url>
	</references>
	<dates>
	<discovery>2007-08-23</discovery>
	<entry>2007-09-21</entry>
	</dates>
	</vuln>

	<vuln vid="b6f6da57-680a-11dc-b350-001921ab2fa4">
	<topic>clamav -- multiple remote Denial of Service vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.91.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BugTraq reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/25398">
	<p>ClamAV is prone to multiple denial-of-service vulnerabilities.</p>
	<p>A successful attack may allow an attacker to crash the
	application and deny service to users.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25398</bid>
	<cvename>CVE-2007-4510</cvename>
	</references>
	<dates>
	<discovery>2007-08-21</discovery>
	<entry>2007-09-21</entry>
	</dates>
	</vuln>

	<vuln vid="12488805-6773-11dc-8be8-02e0185f8d72">
	<topic>coppermine -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>coppermine</name>
	<range><lt>1.4.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The coppermine development team reports two vulnerabilities
	with the coppermine application. These vulnerabilities are
	caused by improper checking of the log variable in "viewlog.php"
	and improper checking of the referer variable in "mode.php".
	This could allow local file inclusion, potentially disclosing
	valuable information and could lead to an attacker conducting
	a cross site scripting attack against the targeted site.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4976</cvename>
	<cvename>CVE-2007-4977</cvename>
	<url>http://coppermine-gallery.net/forum/index.php?topic=46847.0</url>
	</references>
	<dates>
	<discovery>2007-09-14</discovery>
	<entry>2007-09-20</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="e595e170-6771-11dc-8be8-02e0185f8d72">
	<topic>openoffice -- arbitrary command execution vulnerability</topic>
	<affects>
	<package>
	<name>openoffice</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDefense reports:</p>
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593">
	<p>Remote exploitation of multiple integer overflow
	vulnerabilities within OpenOffice, as included in various
	vendors' operating system distributions, allows attackers to
	execute arbitrary code.</p>
	<p>These vulnerabilities exist within the TIFF parsing code of
	the OpenOffice suite. When parsing the TIFF directory entries
	for certain tags, the parser uses untrusted values from the
	file to calculate the amount of memory to allocate. By
	providing specially crafted values, an integer overflow occurs
	in this calculation. This results in the allocation of a
	buffer of insufficient size, which in turn leads to a heap
	overflow.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2834</cvename>
	<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593</url>
	</references>
	<dates>
	<discovery>2007-09-19</discovery>
	<entry>2007-09-20</entry>
	</dates>
	</vuln>

	<vuln vid="f8d3689e-6770-11dc-8be8-02e0185f8d72">
	<topic>bugzilla -- "createmailregexp" security bypass vulnerability</topic>
	<affects>
	<package>
	<name>bugzilla</name>
	<range><ge>3.*</ge><lt>3.0.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Bugzilla development team reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/3.0.1/">
	<p>Bugzilla::WebService::User::offer_account_by_email does
	not check the "createemailregexp" parameter, and thus
	allows users to create accounts who would normally be
	denied account creation. The "emailregexp" parameter is
	still checked. If you do not have the SOAP::Lite Perl
	module installed on your Bugzilla system, your system is
	not vulnerable (because the Bugzilla WebService will not
	be enabled).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-5038</cvename>
	<url>http://www.bugzilla.org/security/3.0.1/</url>
	</references>
	<dates>
	<discovery>2007-09-18</discovery>
	<entry>2007-09-20</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="14ad2a28-66d2-11dc-b25f-02e0185f8d72">
	<topic>konquerer -- address bar spoofing</topic>
	<affects>
	<package>
	<name>kdebase</name>
	<range><lt>3.5.7_3</lt></range>
	</package>
	<package>
	<name>kdelibs</name>
	<range><lt>3.5.7_2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The KDE development team reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20070914-1.txt">
	<p>The Konqueror address bar is vulnerable to spoofing attacks
	that are based on embedding white spaces in the url. In addition
	the address bar could be tricked to show an URL which it is
	intending to visit for a short amount of time instead of the
	current URL.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3820</cvename>
	<cvename>CVE-2007-4224</cvename>
	<cvename>CVE-2007-4225</cvename>
	<url>http://www.kde.org/info/security/advisory-20070914-1.txt</url>
	</references>
	<dates>
	<discovery>2007-09-14</discovery>
	<entry>2007-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="79b616d0-66d1-11dc-b25f-02e0185f8d72">
	<topic>kdm -- passwordless login vulnerability</topic>
	<affects>
	<package>
	<name>kdebase3</name>
	<range><lt>3.5.7_3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The KDE development team reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20070919-1.txt">
	<p>KDM can be tricked into performing a password-less login
	even for accounts with a password set under certain
	circumstances, namely autologin to be configured and
	"shutdown with password" enabled.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4569</cvename>
	<url>http://www.kde.org/info/security/advisory-20070919-1.txt</url>
	</references>
	<dates>
	<discovery>2007-09-19</discovery>
	<entry>2007-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="209f0d75-4b5c-11dc-a6cd-000fb5066b20">
	<topic>flyspray -- authentication bypass</topic>
	<affects>
	<package>
	<name>flyspray</name>
	<range><lt>0.9.9.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Flyspray Project reports:</p>
	<blockquote cite="http://www.flyspray.org/fsa:1">
	<p>Flyspray authentication system can be bypassed by sending a
	carefully crafted post request.</p>
	<p>To be vulnerable, PHP configuration directive output_buffering
	has to be disabled or set to a low value.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-1788</cvename>
	<url>http://www.flyspray.org/fsa:1</url>
	</references>
	<dates>
	<discovery>2007-03-13</discovery>
	<entry>2007-09-19</entry>
	</dates>
	</vuln>

	<vuln vid="3ce8c7e2-66cf-11dc-b25f-02e0185f8d72">
	<topic>mozilla -- code execution via Quicktime media-link files</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.7,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.7</lt></range>
	</package>
	<!-- Packages which probably will be upgraded -->
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.5</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.12.12</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><lt>2.0.a2007.12.12</lt></range>
	</package>
	<!-- Deprecated/old names -->
	<package>
	<name>firefox-ja</name>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports a vulnerability within the
	mozilla browser. This vulnerability also affects various
	other browsers like firefox and seamonkey. The vulnerability
	is caused by QuickTime Media-Link files that contain a qtnext
	attribute. This could allow an attacker to start the browser
	with arbitrary command-line options. This could allow the
	attacker to install malware, steal local data and possibly
	execute and/or do other arbitrary things within the users
	context.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2006-4965</cvename>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-28.html</url>
	</references>
	<dates>
	<discovery>2007-09-18</discovery>
	<entry>2007-09-19</entry>
	<modified>2007-12-14</modified>
	</dates>
	</vuln>

	<vuln vid="71d903fc-602d-11dc-898c-001921ab2fa4">
	<topic>php -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>php5</name>
	<range><lt>5.2.4</lt></range>
	</package>
	<package>
	<name>php4</name>
	<range><lt>4.4.8</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP development team reports:</p>
	<blockquote cite="http://www.php.net/releases/5_2_4.php">
	<p>Security Enhancements and Fixes in PHP 5.2.4:</p>
	<ul>
	<li>Fixed a floating point exception inside wordwrap() (Reported
	by Mattias Bengtsson)</li>
	<li>Fixed several integer overflows inside the GD extension
	(Reported by Mattias Bengtsson)</li>
	<li>Fixed size calculation in chunk_split() (Reported by Gerhard
	Wagner)</li>
	<li>Fixed integer overflow in str[c]spn(). (Reported by Mattias
	Bengtsson)</li>
	<li>Fixed money_format() not to accept multiple %i or %n tokens.
	(Reported by Stanislav Malyshev)</li>
	<li>Fixed zend_alter_ini_entry() memory_limit interruption
	vulnerability. (Reported by Stefan Esser)</li>
	<li>Fixed INFILE LOCAL option handling with MySQL extensions not
	to be allowed when open_basedir or safe_mode is active. (Reported
	by Mattias Bengtsson)</li>
	<li>Fixed session.save_path and error_log values to be checked
	against open_basedir and safe_mode (CVE-2007-3378) (Reported by
	Maksymilian Arciemowicz)</li>
	<li>Fixed a possible invalid read in glob() win32 implementation
	(CVE-2007-3806) (Reported by shinnai)</li>
	<li>Fixed a possible buffer overflow in php_openssl_make_REQ
	(Reported by zatanzlatan at hotbrev dot com)</li>
	<li>Fixed an open_basedir bypass inside glob() function (Reported
	by dr at peytz dot dk)</li>
	<li>Fixed a possible open_basedir bypass inside session extension
	when the session file is a symlink (Reported by c dot i dot morris
	at durham dot ac dot uk)</li>
	<li>Improved fix for MOPB-03-2007.</li>
	<li>Corrected fix for CVE-2007-2872.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2872</cvename>
	<cvename>CVE-2007-3378</cvename>
	<cvename>CVE-2007-3806</cvename>
	<cvename>CVE-2007-3996</cvename>
	<cvename>CVE-2007-3997</cvename>
	<cvename>CVE-2007-3998</cvename>
	<cvename>CVE-2007-4652</cvename>
	<cvename>CVE-2007-4657</cvename>
	<cvename>CVE-2007-4658</cvename>
	<cvename>CVE-2007-4659</cvename>
	<cvename>CVE-2007-4660</cvename>
	<cvename>CVE-2007-4661</cvename>
	<cvename>CVE-2007-4662</cvename>
	<cvename>CVE-2007-4663</cvename>
	<cvename>CVE-2007-4670</cvename>
	<url>http://www.php.net/releases/4_4_8.php</url>
	<url>http://www.php.net/releases/5_2_4.php</url>
	<url>http://secunia.com/advisories/26642</url>
	</references>
	<dates>
	<discovery>2007-08-30</discovery>
	<entry>2007-09-11</entry>
	<modified>2008-01-14</modified>
	</dates>
	</vuln>

	<vuln vid="c115271d-602b-11dc-898c-001921ab2fa4">
	<topic>apache -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.6</lt></range>
	<range><gt>2.0.0</gt><lt>2.0.61</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache HTTP server project reports:</p>
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
	<p>The following potential security flaws are addressed:</p>
	<ul>
	<li>CVE-2007-3847: mod_proxy: Prevent reading past the end of a
	buffer when parsing date-related headers.</li>
	<li>CVE-2007-1863: mod_cache: Prevent a segmentation fault if
	attributes are listed in a Cache-Control header without any
	value.</li>
	<li>CVE-2007-3304: prefork, worker, event MPMs: Ensure that the
	parent process cannot be forced to kill processes outside its
	process group.</li>
	<li>CVE-2006-5752: mod_status: Fix a possible XSS attack against
	a site with a public server-status page and ExtendedStatus
	enabled, for browsers which perform charset "detection".
	Reported by Stefan Esser.</li>
	<li>CVE-2006-1862: mod_mem_cache: Copy headers into longer lived
	storage; header names and values could previously point to
	cleaned up storage.</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3847</cvename>
	<cvename>CVE-2007-1863</cvename>
	<cvename>CVE-2006-5752</cvename>
	<cvename>CVE-2007-3304</cvename>
	</references>
	<dates>
	<discovery>2007-09-07</discovery>
	<entry>2007-09-11</entry>
	</dates>
	</vuln>

	<vuln vid="4b673ae7-5f9a-11dc-84dd-000102cc8983">
	<topic>lighttpd -- FastCGI header overrun in mod_fastcgi</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.18</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>lighttpd maintainer reports:</p>
	<blockquote cite="http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt">
	<p>Lighttpd is prone to a header overflow when using the mod_fastcgi
	extension, this can lead to arbitrary code execution in the fastcgi
	application. For a detailed description of the bug see the external
	reference.</p>
	<p>This bug was found by Mattias Bengtsson and Philip Olausson</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt</url>
	<url>http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/</url>
	<cvename>CVE-2007-4727</cvename>
	</references>
	<dates>
	<discovery>2007-09-09</discovery>
	<entry>2007-09-10</entry>
	</dates>
	</vuln>

	<vuln vid="f14ad681-5b88-11dc-812d-0011098b2f36">
	<topic>rkhunter -- insecure temporary file creation</topic>
	<affects>
	<package>
	<name>rkhunter</name>
	<range><lt>1.2.5</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml">
	<p>Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux
	Security Team have reported that the check_update.sh script and
	the main rkhunter script insecurely creates several temporary
	files with predictable filenames.</p>
	<p>A local attacker could create symbolic links in the temporary
	files directory, pointing to a valid file somewhere on the
	filesystem. When rkhunter or the check_update.sh script runs,
	this would result in the file being overwritten with the rights of
	the user running the utility, which could be the root user.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>13399</bid>
	<cvename>CVE-2005-1270</cvename>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml</url>
	</references>
	<dates>
	<discovery>2005-04-26</discovery>
	<entry>2007-09-05</entry>
	</dates>
	</vuln>

	<vuln vid="72cdf2ab-5b87-11dc-812d-0011098b2f36">
	<topic>lsh -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>lsh</name>
	<range><lt>2.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/14609">
	<p>A vulnerability has been reported in LSH, which potentially
	can be exploited by malicious people to cause a DoS (Denial
	of Service).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2003-0826</cvename>
	<cvename>CVE-2005-0814</cvename>
	<url>http://secunia.com/advisories/14609</url>
	</references>
	<dates>
	<discovery>2005-03-17</discovery>
	<entry>2007-09-05</entry>
	<modified>2008-01-07</modified>
	</dates>
	</vuln>

	<vuln vid="45500f74-5947-11dc-87c1-000e2e5785ad">
	<topic>fetchmail -- denial of service on reject of local warning message</topic>
	<affects>
	<package>
	<name>fetchmail</name>
	<range><ge>4.6.8</ge><lt>6.3.8_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-02.txt">
	<p>fetchmail will generate warning messages in certain
	circumstances (for instance, when leaving oversized messages
	on the server or login to the upstream fails) and send them
	to the local postmaster or the user running it.</p>
	<p>If this warning message is then refused by the SMTP listener
	that fetchmail is forwarding the message to, fetchmail
	crashes and does not collect further messages until it is
	restarted.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4565</cvename>
	<url>http://www.fetchmail.info/fetchmail-SA-2007-02.txt</url>
	</references>
	<dates>
	<discovery>2007-07-29</discovery>
	<entry>2007-09-02</entry>
	</dates>
	</vuln>

	<vuln vid="d944719e-42f4-4864-89ed-f045b541919f">
	<topic>gtar -- Directory traversal vulnerability</topic>
	<affects>
	<package>
	<name>gtar</name>
	<range><lt>1.18_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Red Hat reports:</p>
	<blockquote cite="http://rhn.redhat.com/errata/RHSA-2007-0860.html">
	<p>A path traversal flaw was discovered in the way GNU
	tar extracted archives. A malicious user could create a
	tar archive that could write to arbitrary files to which
	the user running GNU tar had write access.</p>
	</blockquote>
	<p>Red Hat credits Dmitry V. Levin for reporting the issue.</p>
	</body>
	</description>
	<references>
	<bid>25417</bid>
	<cvename>CVE-2007-4131</cvename>
	<url>http://rhn.redhat.com/errata/RHSA-2007-0860.html</url>
	<url>https://bugzilla.redhat.com/show_bug.cgi?id=251921</url>
	</references>
	<dates>
	<discovery>2007-08-23</discovery>
	<entry>2007-09-01</entry>
	</dates>
	</vuln>

	<vuln vid="d9867f50-54d0-11dc-b80b-0016179b2dd5">
	<topic>claws-mail -- POP3 Format String Vulnerability</topic>
	<affects>
	<package>
	<name>claws-mail</name>
	<name>sylpheed-claws</name>
	<range><lt>2.10.0_3</lt></range>
	</package>
	<package>
	<name>sylpheed2</name>
	<range><lt>2.4.4_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/26550/">
	<p>A format string error in the "inc_put_error()" function in
	src/inc.c when displaying a POP3 server's error response can
	be exploited via specially crafted POP3 server replies containing
	format specifiers.</p>
	<p>Successful exploitation may allow execution of arbitrary code,
	but requires that the user is tricked into connecting to a malicious
	POP3 server.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2958</cvename>
	<url>http://secunia.com/advisories/26550/</url>
	<url>http://secunia.com/secunia_research/2007-70/advisory/</url>
	</references>
	<dates>
	<discovery>2007-08-24</discovery>
	<entry>2007-08-27</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="af8e3a0c-5009-11dc-8a43-003048705d5a">
	<topic>rsync -- off by one stack overflow</topic>
	<affects>
	<package>
	<name>rsync</name>
	<range><lt>2.6.9_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>BugTraq reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/25336/discuss">
	<p>The rsync utility is prone to an off-by-one buffer-overflow
	vulnerability. This issue is due to a failure of the application
	to properly bounds-check user-supplied input.</p>
	<p>Successfully exploiting this issue may allow arbitrary
	code-execution in the context of the affected utility.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25336</bid>
	<cvename>CVE-2007-4091</cvename>
	</references>
	<dates>
	<discovery>2007-08-15</discovery>
	<entry>2007-08-21</entry>
	<modified>2007-08-23</modified>
	</dates>
	</vuln>

	<vuln vid="df4a7d21-4b17-11dc-9fc2-001372ae3ab9">
	<topic>opera -- Vulnerability in javascript handling</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.23.20070809</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory from Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/view/865/">
	<p>A specially crafted JavaScript can make Opera execute
	arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.opera.com/support/search/view/865/</url>
	</references>
	<dates>
	<discovery>2007-08-03</discovery>
	<entry>2007-08-15</entry>
	<modified>2007-08-25</modified>
	</dates>
	</vuln>

	<vuln vid="4a338d17-412d-11dc-bdb0-0016179b2dd5">
	<topic>fsplib -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>fsplib</name>
	<range><lt>0.9</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/26184/">
	<p>fsplib can be exploited to compromise an application using
	the library.</p>
	<p>A boundary error exists in the processing of file names in
	fsp_readdir_native, which can be exploited to cause a stack-based
	buffer overflow if the defined MAXNAMLEN is bigger than 256.</p>
	<p>A boundary error exists in the processing of directory entries in
	fsp_readdir, which can be exploited to cause a stack-based buffer
	overflow on systems with an insufficient size allocated for the
	d_name field of directory entries.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3961</cvename>
	<cvename>CVE-2007-3962</cvename>
	<url>http://secunia.com/advisories/26184/</url>
	</references>
	<dates>
	<discovery>2007-07-24</discovery>
	<entry>2007-08-02</entry>
	</dates>
	</vuln>

	<vuln vid="4872d9a7-4128-11dc-bdb0-0016179b2dd5">
	<topic>joomla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>joomla</name>
	<range><lt>1.0.13</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<p>joomla can be exploited to conduct session fixation
	attacks, cross-site scripting attacks or HTTP response
	splitting attacks.</p>
	<p>Certain unspecified input passed in com_search, com_content and
	mod_login is not properly sanitised before being returned to a
	user. This can be exploited to execute arbitrary HTML and script
	code in a user's browser session in context of an affected
	site.</p>
	<p>Input passed to the url parameter is not properly sanitised
	before being returned to the user. This can be exploited to insert
	arbitrary HTTP headers, which will be included in a response sent
	to the user, allowing for execution of arbitrary HTML and script
	code in a user's browser session in context of an affected
	site.</p>
	<p>An error exists in the handling of sessions and can be exploited
	to hijack another user's session by tricking the user into logging
	in after following a specially crafted link.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-4188</cvename>
	<cvename>CVE-2007-4189</cvename>
	<cvename>CVE-2007-4190</cvename>
	<cvename>CVE-2007-5577</cvename>
	<url>http://www.joomla.org/content/view/3677/1/</url>
	<url>http://secunia.com/advisories/26239/</url>
	</references>
	<dates>
	<discovery>2007-07-30</discovery>
	<entry>2007-08-02</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="2dc764fa-40c0-11dc-aeac-02e0185f8d72">
	<topic>FreeBSD -- Buffer overflow in tcpdump(1)</topic>
	<affects>
	<package>
	<name>tcpdump</name>
	<range><lt>3.9.6</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_7</lt></range>
	<range><ge>6.1</ge><lt>6.1_19</lt></range>
	<range><ge>5.5</ge><lt>5.5_15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>An un-checked return value in the BGP dissector code can
	result in an integer overflow. This value is used in
	subsequent buffer management operations, resulting in a stack
	based buffer overflow under certain circumstances.</p>
	<h1>Impact:</h1>
	<p>By crafting malicious BGP packets, an attacker could exploit
	this vulnerability to execute code or crash the tcpdump
	process on the target system. This code would be executed in
	the context of the user running tcpdump(1). It should be
	noted that tcpdump(1) requires privileges in order to open live
	network interfaces.</p>
	<h1>Workaround:</h1>
	<p>No workaround is available.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3798</cvename>
	<freebsdsa>SA-07:06.tcpdump</freebsdsa>
	</references>
	<dates>
	<discovery>2007-08-01</discovery>
	<entry>2007-08-02</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="3de342fb-40be-11dc-aeac-02e0185f8d72">
	<topic>FreeBSD -- Predictable query ids in named(8)</topic>
	<affects>
	<package>
	<name>named</name>
	<range><ge>9.4</ge><lt>9.4.1.1</lt></range>
	<range><ge>9.3</ge><lt>9.3.4.1</lt></range>
	</package>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_7</lt></range>
	<range><ge>6.1</ge><lt>6.1_19</lt></range>
	<range><ge>5.5</ge><lt>5.5_15</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>When named(8) is operating as a recursive DNS server or
	sending NOTIFY requests to slave DNS servers, named(8)
	uses a predictable query id.</p>
	<h1>Impact:</h1>
	<p>An attacker who can see the query id for some request(s)
	sent by named(8) is likely to be able to perform DNS cache
	poisoning by predicting the query id for other request(s).</p>
	<h1>Workaround:</h1>
	<p>No workaround is available.</p>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2926</cvename>
	<freebsdsa>SA-07:07.bind</freebsdsa>
	</references>
	<dates>
	<discovery>2007-07-24</discovery>
	<entry>2007-08-02</entry>
	<modified>2016-08-09</modified>
	</dates>
	</vuln>

	<vuln vid="0e43a14d-3f3f-11dc-a79a-0016179b2dd5">
	<topic>xpdf -- stack based buffer overflow</topic>
	<affects>
	<package>
	<name>xpdf</name>
	<range><lt>3.02_2</lt></range>
	</package>
	<package>
	<name>kdegraphics</name>
	<range><lt>3.5.7_1</lt></range>
	</package>
	<package>
	<name>cups-base</name>
	<range><lt>1.2.11_3</lt></range>
	</package>
	<package>
	<name>gpdf</name>
	<range><gt>0</gt></range>
	</package>
	<package>
	<name>pdftohtml</name>
	<range><lt>0.39_3</lt></range>
	</package>
	<package>
	<name>poppler</name>
	<range><lt>0.5.9_4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The KDE Team reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20070730-1.txt">
	<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
	a vulnerability that can cause a stack based buffer overflow
	via a PDF file that exploits an integer overflow in
	StreamPredictor::StreamPredictor(). Remotely supplied
	pdf files can be used to disrupt the kpdf viewer on
	the client machine and possibly execute arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>25124</bid>
	<cvename>CVE-2007-3387</cvename>
	<url>http://www.kde.org/info/security/advisory-20070730-1.txt</url>
	</references>
	<dates>
	<discovery>2007-07-30</discovery>
	<entry>2007-07-31</entry>
	<modified>2009-04-29</modified>
	</dates>
	</vuln>

	<vuln vid="ff284bf0-3f32-11dc-a79a-0016179b2dd5">
	<cancelled superseded="2dc764fa-40c0-11dc-aeac-02e0185f8d72"/>
	</vuln>

	<vuln vid="863f95d3-3df1-11dc-b3d3-0016179b2dd5">
	<topic>mutt -- buffer overflow vulnerability</topic>
	<affects>
	<package>
	<name>mutt</name>
	<name>mutt-lite</name>
	<name>ja-mutt</name>
	<name>zh-mutt</name>
	<range><lt>1.4.2.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Securityfocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/24192/">
	<p>Mutt is prone to a local buffer-overflow vulnerability
	because it fails to properly bounds-check user-supplied
	input before using it in a memory copy operation.
	An attacker can exploit this issue to execute arbitrary
	code with the with the privileges of the victim. Failed
	exploit attempts will result in a denial of service.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>24192</bid>
	<cvename>CVE-2007-2683</cvename>
	<url>http://www.redhat.com/support/errata/RHSA-2007-0386.html</url>
	</references>
	<dates>
	<discovery>2007-05-28</discovery>
	<entry>2007-07-29</entry>
	</dates>
	</vuln>

	<vuln vid="d2b8a963-3d59-11dc-b3d3-0016179b2dd5">
	<topic>p5-Net-DNS -- multiple Vulnerabilities</topic>
	<affects>
	<package>
	<name>p5-Net-DNS</name>
	<range><lt>0.60</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/25829/">
	<p>An error exists in the handling of DNS queries where IDs are
	incremented with a fixed value and are additionally used for
	child processes in a forking server. This can be exploited to
	poison the DNS cache of an application using the module if a
	valid ID is guessed.</p>
	<p>An error in the PP implementation within the "dn_expand()"
	function can be exploited to cause a stack overflow due to an
	endless loop via a specially crafted DNS packet.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3377</cvename>
	<cvename>CVE-2007-3409</cvename>
	<url>http://secunia.com/advisories/25829/</url>
	</references>
	<dates>
	<discovery>2007-06-27</discovery>
	<entry>2007-07-28</entry>
	</dates>
	</vuln>

	<vuln vid="88260dfe-3d21-11dc-b3d3-0016179b2dd5">
	<topic>phpsysinfo -- url Cross-Site Scripting</topic>
	<affects>
	<package>
	<name>phpSysInfo</name>
	<range><lt>2.5.3_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Doz reports:</p>
	<blockquote cite="http://secunia.com/advisories/26248/">
	<p>A Input passed in the URL to index.php is not properly
	sanitised before being returned to the user. This can be
	exploited to execute arbitrary HTML and script code in a
	user's browser session in context of an affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/26248/</url>
	</references>
	<dates>
	<discovery>2007-07-27</discovery>
	<entry>2007-07-28</entry>
	<modified>2007-08-01</modified>
	</dates>
	</vuln>

	<vuln vid="98dd7788-3d13-11dc-b3d3-0016179b2dd5">
	<topic>drupal -- Cross site request forgeries</topic>
	<affects>
	<package>
	<name>drupal5</name>
	<range><lt>5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/162360">
	<p>Several parts in Drupal core are not protected against cross
	site request forgeries due to inproper use of the Forms API,
	or by taking action solely on GET requests. Malicious users are
	able to delete comments and content revisions and disable menu
	items by enticing a privileged users to visit certain URLs while
	the victim is logged-in to the targeted site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/162360</url>
	<url>http://secunia.com/advisories/26224/</url>
	</references>
	<dates>
	<discovery>2007-07-26</discovery>
	<entry>2007-07-28</entry>
	</dates>
	</vuln>

	<vuln vid="1f5b711b-3d0e-11dc-b3d3-0016179b2dd5">
	<topic>drupal -- Multiple cross-site scripting vulnerabilities</topic>
	<affects>
	<package>
	<name>drupal4</name>
	<range><lt>4.7.7</lt></range>
	</package>
	<package>
	<name>drupal5</name>
	<range><lt>5.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/162361">
	<p>Some server variables are not escaped consistently. When
	a malicious user is able to entice a victim to visit a specially
	crafted link or webpage, arbitrary HTML and script code can be
	injected and executed in the context of the victim's session on
	the targeted website.</p>
	<p>Custom content type names are not escaped consistently. A
	malicious user with the 'administer content types' permission
	would be able to inject and execute arbitrary HTML and script
	code on the website. Revoking the 'administer content types'
	permission provides an immediate workaround.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://drupal.org/node/162361</url>
	<url>http://secunia.com/advisories/26224/</url>
	</references>
	<dates>
	<discovery>2007-07-26</discovery>
	<entry>2007-07-28</entry>
	</dates>
	</vuln>

	<vuln vid="1ed03222-3c65-11dc-b3d3-0016179b2dd5">
	<topic>vim -- Command Format String Vulnerability</topic>
	<affects>
	<package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim-ruby</name>
	<name>vim6</name>
	<name>vim6-ruby</name>
	<range><lt>7.1.39</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/25941/">
	<p>A format string error in the "helptags_one()" function in
	src/ex_cmds.c when running the "helptags" command can be exploited
	to execute arbitrary code via specially crafted help files.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2953</cvename>
	<url>http://secunia.com/advisories/25941/</url>
	</references>
	<dates>
	<discovery>2007-07-27</discovery>
	<entry>2007-07-27</entry>
	</dates>
	</vuln>

	<vuln vid="b73335a5-3bbe-11dc-8e83-0016179b2dd5">
	<topic>libvorbis -- Multiple memory corruption flaws</topic>
	<affects>
	<package>
	<name>libvorbis</name>
	<range><lt>1.2.0,3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>isecpartners reports:</p>
	<blockquote cite="http://www.isecpartners.com/advisories/2007-003-libvorbis.txt">
	<p>libvorbis contains several vulnerabilities
	allowing heap overwrite, read violations and a function
	pointer overwrite. These bugs cause a at least a denial
	of service, and potentially code execution.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://www.isecpartners.com/advisories/2007-003-libvorbis.txt</url>
	<cvename>CVE-2007-3106</cvename>
	</references>
	<dates>
	<discovery>2007-06-05</discovery>
	<entry>2007-07-26</entry>
	</dates>
	</vuln>

	<vuln vid="ab2575d6-39f0-11dc-b8cc-000fea449b8a">
	<topic>tomcat -- XSS vulnerability in sample applications</topic>
	<affects>
	<package>
	<name>apache-tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
	</package>
	<package>
	<name>tomcat</name>
	<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
	</package>
	<package>
	<name>jakarta-tomcat</name>
	<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Project reports:</p>
	<blockquote cite="http://tomcat.apache.org/security-5.html">
	<p>The JSP and Servlet included in the sample application within
	the Tomcat documentation webapp did not escape user provided
	data before including it in the output. This enabled a XSS
	attack. These pages have been simplified not to use any user
	provided data in the output.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-1355</cvename>
	<bid>24058</bid>
	</references>
	<dates>
	<discovery>2007-05-19</discovery>
	<entry>2007-07-24</entry>
	</dates>
	</vuln>

	<vuln vid="872623af-39ec-11dc-b8cc-000fea449b8a">
	<topic>tomcat -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>apache-tomcat</name>
	<range><ge>4.1.0</ge><lt>4.1.36</lt></range>
	<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
	</package>
	<package>
	<name>tomcat</name>
	<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
	</package>
	<package>
	<name>jakarta-tomcat</name>
	<range><ge>4.0.0</ge><lt>4.1.0</lt></range>
	<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Project reports:</p>
	<blockquote cite="http://www.mail-archive.com/dev@tomcat.apache.org/msg16385.html">
	<p>The Apache Tomcat team is proud to announce the immediate
	availability of Tomcat 4.1.36 stable. This build contains
	numerous library updates, A small number of bug fixes and
	two important security fixes.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2005-2090</cvename>
	<cvename>CVE-2007-0450</cvename>
	<cvename>CVE-2007-1358</cvename>
	</references>
	<dates>
	<discovery>2007-04-27</discovery>
	<entry>2007-07-24</entry>
	</dates>
	</vuln>

	<vuln vid="cddde37a-39b5-11dc-b3da-001921ab2fa4">
	<topic>dokuwiki -- XSS vulnerability in spellchecker backend</topic>
	<affects>
	<package>
	<name>dokuwiki</name>
	<range><lt>20070626_1</lt></range>
	</package>
	<package>
	<name>dokuwiki-devel</name>
	<range><lt>20070524_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>DokuWiki reports:</p>
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1195">
	<p>The spellchecker tests the UTF-8 capabilities of the used browser
	by sending an UTF-8 string to the backend, which will send it back
	unfiltered. By comparing string length the spellchecker can work
	around broken implementations. An attacker could construct a form to
	let users send JavaScript to the spellchecker backend, resulting in
	malicious JavaScript being executed in their browser.</p>
	<p>Affected are all versions up to and including 2007-06-26 even when
	the spell checker is disabled.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://xforce.iss.net/xforce/xfdb/35501</url>
	<cvename>CVE-2007-3930</cvename>
	</references>
	<dates>
	<discovery>2007-06-26</discovery>
	<entry>2007-07-24</entry>
	</dates>
	</vuln>

	<vuln vid="fc9c217e-3791-11dc-bb1a-000fea449b8a">
	<topic>lighttpd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>lighttpd</name>
	<range><lt>1.4.15_1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/26130/">
	<p>Some vulnerabilities have been reported in lighttpd,
	which can be exploited by malicious people to bypass
	certain security restrictions or cause a DoS (Denial
	of Service).</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3947</cvename>
	<cvename>CVE-2007-3948</cvename>
	<cvename>CVE-2007-3949</cvename>
	<cvename>CVE-2007-3950</cvename>
	<url>http://trac.lighttpd.net/trac/ticket/1216</url>
	<url>http://trac.lighttpd.net/trac/ticket/1232</url>
	<url>http://trac.lighttpd.net/trac/ticket/1230</url>
	<url>http://trac.lighttpd.net/trac/ticket/1263</url>
	</references>
	<dates>
	<discovery>2007-07-20</discovery>
	<entry>2007-07-21</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="12d266b6-363f-11dc-b6c9-000c6ec775d9">
	<topic>opera -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.22</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera Software ASA reports of multiple security fixes in
	Opera, including an arbitrary code execute
	vulnerability:</p>
	<blockquote cite="http://www.opera.com/support/search/view/861/">
	<p>Opera for Linux, FreeBSD, and Solaris has a flaw in the
	createPattern function that leaves old data that was in
	the memory before Opera allocated it in the new
	pattern. The pattern can be read and analyzed by
	JavaScript, so an attacker can get random samples of the
	user's memory, which may contain data.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/862/">
	<p>Removing a specially crafted torrent from the download
	manager can crash Opera. The crash is caused by an
	erroneous memory access.</p>
	<p>An attacker needs to entice the user to accept the
	malicious BitTorrent download, and later remove it from
	Opera's download manager. To inject code, additional means
	will have to be employed.</p>
	<p>Users clicking a BitTorrent link and rejecting the
	download are not affected.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/863/">
	<p>data: URLs embed data inside them, instead of linking to
	an external resource. Opera can mistakenly display the end
	of a data URL instead of the beginning. This allows an
	attacker to spoof the URL of a trusted site.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/864/">
	<p>Opera's HTTP authentication dialog is displayed when the
	user enters a Web page that requires a login name and a
	password. To inform the user which server it was that
	asked for login credentials, the dialog displays the
	server name.</p>
	<p>The user has to see the entire server name. A truncated
	name can be misleading. Opera's authentication dialog cuts
	off the long server names at the right hand side, adding
	an ellipsis (...) to indicate that it has been cut off.</p>
	<p>The dialog has a predictable size, allowing an attacker
	to create a server name which will look almost like a
	trusted site, because the real domain name has been cut
	off. The three dots at the end will not be obvious to all
	users.</p>
	<p>This flaw can be exploited by phishers who can set up
	custom sub-domains, for example by hosting their own
	public DNS.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3929</cvename>
	<cvename>CVE-2007-4944</cvename>
	<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564</url>
	<url>http://www.opera.com/support/search/view/861/</url>
	<url>http://www.opera.com/support/search/view/862/</url>
	<url>http://www.opera.com/support/search/view/863/</url>
	<url>http://www.opera.com/support/search/view/864/</url>
	<url>http://www.opera.com/docs/changelogs/freebsd/922/</url>
	</references>
	<dates>
	<discovery>2007-07-19</discovery>
	<entry>2007-07-19</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="e190ca65-3636-11dc-a697-000c6ec775d9">
	<topic>mozilla -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>firefox</name>
	<range><lt>2.0.0.5,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.a2_3,1</lt></range>
	</package>
	<package>
	<name>linux-firefox</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<name>thunderbird</name>
	<range><lt>2.0.0.5</lt></range>
	</package>
	<!-- Packages which probably will be upgraded -->
	<package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.3</lt></range>
	</package>
	<package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.12.12</lt></range>
	</package>
	<package>
	<name>linux-seamonkey-devel</name>
	<range><lt>2.0.a2007.12.12</lt></range>
	</package>
	<!-- Deprecated/old names -->
	<package>
	<name>firefox-ja</name>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports of multiple security issues
	in Firefox, Seamonkey, and Thunderbird. Several of these
	issues can probably be used to run arbitrary code with the
	privilege of the user running the program.</p>
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5">
	<ul>
	<li>MFSA 2007-25 XPCNativeWrapper pollution</li>
	<li>MFSA 2007-24 Unauthorized access to wyciwyg:// documents</li>
	<li>MFSA 2007-21 Privilege escalation using an event
	handler attached to an element not in the document</li>
	<li>MFSA 2007-20 Frame spoofing while window is loading</li>
	<li>MFSA 2007-19 XSS using addEventListener and setTimeout</li>
	<li>MFSA 2007-18 Crashes with evidence of memory corruption</li>
	</ul>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3089</cvename>
	<cvename>CVE-2007-3734</cvename>
	<cvename>CVE-2007-3735</cvename>
	<cvename>CVE-2007-3737</cvename>
	<cvename>CVE-2007-3738</cvename>
	<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5</url>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-18.html</url>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-19.html</url>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-20.html</url>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-21.html</url>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-24.html</url>
	<url>http://www.mozilla.org/security/announce/2007/mfsa2007-25.html</url>
	<uscertta>TA07-199A</uscertta>
	</references>
	<dates>
	<discovery>2007-07-17</discovery>
	<entry>2007-07-19</entry>
	<modified>2008-06-21</modified>
	</dates>
	</vuln>

	<vuln vid="b42e8c32-34f6-11dc-9bc9-001921ab2fa4">
	<topic>linux-flashplugin -- critical vulnerabilities</topic>
	<affects>
	<package>
	<name>linux-flashplugin</name>
	<range><gt>9.0</gt><le>9.0r45</le></range>
	<range><gt>8.0</gt><le>8.0r34</le></range>
	<range><le>7.0r69</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-12.html">
	<p>Critical vulnerabilities have been identified in
	Adobe Flash Player that could allow an attacker who
	successfully exploits these potential vulnerabilities
	to take control of the affected system. A malicious
	SWF must be loaded in Flash Player by the user for
	an attacker to exploit these potential vulnerabilities.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2022</cvename>
	<cvename>CVE-2007-3456</cvename>
	<cvename>CVE-2007-3457</cvename>
	</references>
	<dates>
	<discovery>2007-07-10</discovery>
	<entry>2007-07-18</entry>
	</dates>
	</vuln>

	<vuln vid="7fadc049-2ba0-11dc-9377-0016179b2dd5">
	<topic>wireshark -- Multiple problems</topic>
	<affects>
	<package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.20</ge><lt>0.99.6</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>wireshark Team reports:</p>
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-02.html">
	<p>It may be possible to make Wireshark or Ethereal crash or use up
	available memory by injecting a purposefully malformed packet onto
	the wire or by convincing someone to read a malformed packet trace
	file.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3389</cvename>
	<cvename>CVE-2007-3390</cvename>
	<cvename>CVE-2007-3391</cvename>
	<cvename>CVE-2007-3392</cvename>
	<cvename>CVE-2007-3393</cvename>
	<url>http://secunia.com/advisories/25833/</url>
	<url>http://www.wireshark.org/security/wnpa-sec-2007-02.html</url>
	</references>
	<dates>
	<discovery>2007-06-29</discovery>
	<entry>2007-07-06</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="2c4f4688-298b-11dc-a197-0011098b2f36">
	<topic>typespeed -- arbitrary code execution</topic>
	<affects>
	<package>
	<name>typespeed</name>
	<range><le>0.4.1</le></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-684">
	<p>Ulf Härnhammar from the Debian Security Audit Project
	discovered a problem in typespeed, a touch-typist trainer
	disguised as game. This could lead to a local attacker
	executing arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2005-0105</cvename>
	<url>http://www.debian.org/security/2005/dsa-684</url>
	</references>
	<dates>
	<discovery>2005-02-16</discovery>
	<entry>2007-07-03</entry>
	<modified>2007-07-09</modified>
	</dates>
	</vuln>

	<vuln vid="7128fb45-2633-11dc-94da-0016179b2dd5">
	<topic>vlc -- format string vulnerability and integer overflow</topic>
	<affects>
	<package>
	<name>vlc</name>
	<range><lt>0.8.6c</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>isecpartners reports:</p>
	<blockquote cite="http://www.isecpartners.com/advisories/2007-001-vlc.txt">
	<p>VLC is vulnerable to a format string attack in the parsing
	of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA
	data or SAP/SDP service discovery messages. Additionally,
	there are two errors in the handling of wav files, one a
	denial of service due to an uninitialized variable, and one
	integer overflow in sampling frequency calculations.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3316</cvename>
	<cvename>CVE-2007-3468</cvename>
	<cvename>CVE-2007-3467</cvename>
	<url>http://www.isecpartners.com/advisories/2007-001-vlc.txt</url>
	</references>
	<dates>
	<discovery>2007-06-05</discovery>
	<entry>2007-06-18</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="32d38cbb-2632-11dc-94da-0016179b2dd5">
	<topic>flac123 -- stack overflow in comment parsing</topic>
	<affects>
	<package>
	<name>flac123</name>
	<range><lt>0.0.10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>isecpartners reports:</p>
	<blockquote cite="http://www.isecpartners.com/advisories/2007-002-flactools.txt">
	<p>flac123, also known as flac-tools, is vulnerable
	to a buffer overflow in vorbis comment parsing.
	This allows for the execution of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3507</cvename>
	<url>http://sourceforge.net/forum/forum.php?forum_id=710314</url>
	<url>http://www.isecpartners.com/advisories/2007-002-flactools.txt</url>
	</references>
	<dates>
	<discovery>2007-06-05</discovery>
	<entry>2007-06-28</entry>
	<modified>2007-08-10</modified>
	</dates>
	</vuln>

	<vuln vid="6e099997-25d8-11dc-878b-000c29c5647f">
	<topic>gd -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>gd</name>
	<range><lt>2.0.35,1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>gd had been reported vulnerable to several
	vulnerabilities:</p>
	<ul>
	<li>CVE-2007-3472: Integer overflow in gdImageCreateTrueColor
	function in the GD Graphics Library (libgd) before 2.0.35
	allows user-assisted remote attackers has unspecified attack
	vectors and impact.</li>
	<li>CVE-2007-3473: The gdImageCreateXbm function in the GD
	Graphics Library (libgd) before 2.0.35 allows user-assisted
	remote attackers to cause a denial of service (crash) via
	unspecified vectors involving a gdImageCreate failure.</li>
	<li>CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF
	reader in the GD Graphics Library (libgd) before 2.0.35 allow
	user-assisted remote attackers to have unspecified attack vectors
	and impact.</li>
	<li>CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35
	allows user-assisted remote attackers to cause a denial of service
	(crash) via a GIF image that has no global color map.</li>
	<li>CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics
	Library (libgd) before 2.0.35 allows user-assisted remote attackers
	to cause a denial of service (crash and heap corruption) via large
	color index values in crafted image data, which results in a
	segmentation fault.</li>
	<li>CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions
	in GD Graphics Library (libgd) before 2.0.35 allows attackers to
	cause a denial of service (CPU consumption) via a large (1) start or
	(2) end angle degree value.</li>
	<li>CVE-2007-3478: Race condition in gdImageStringFTEx
	(gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd)
	before 2.0.35 allows user-assisted remote attackers to cause a
	denial of service (crash) via unspecified vectors, possibly
	involving truetype font (TTF) support.</li>
	</ul>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3472</cvename>
	<cvename>CVE-2007-3473</cvename>
	<cvename>CVE-2007-3474</cvename>
	<cvename>CVE-2007-3475</cvename>
	<cvename>CVE-2007-3476</cvename>
	<cvename>CVE-2007-3477</cvename>
	<cvename>CVE-2007-3478</cvename>
	<url>http://www.libgd.org/ReleaseNote020035</url>
	<url>http://www.frsirt.com/english/advisories/2007/2336</url>
	<url>http://bugs.libgd.org/?do=details&task_id=89</url>
	<url>http://bugs.libgd.org/?do=details&task_id=94</url>
	<url>http://bugs.libgd.org/?do=details&task_id=70</url>
	<url>http://bugs.libgd.org/?do=details&task_id=87</url>
	<url>http://bugs.libgd.org/?do=details&task_id=92</url>
	<url>http://bugs.libgd.org/?do=details&task_id=74</url>
	<url>http://bugs.libgd.org/?do=details&task_id=48</url>
	<url>http://bugs.php.net/bug.php?id=40578</url>
	</references>
	<dates>
	<discovery>2007-06-21</discovery>
	<entry>2007-06-29</entry>
	</dates>
	</vuln>

	<vuln vid="b1b5c125-2308-11dc-b91a-001921ab2fa4">
	<topic>evolution-data-server -- remote execution of arbitrary code vulnerability</topic>
	<affects>
	<package>
	<name>evolution-data-server</name>
	<range><lt>1.10.2_1</lt></range>
	<range><gt>1.11.*</gt><lt>1.11.4</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian project reports:</p>
	<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00082.html">
	<p>It was discovered that the IMAP code in the Evolution
	Data Server performs insufficient sanitising of a value
	later used an array index, which can lead to the execution
	of arbitrary code.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3257</cvename>
	<url>http://secunia.com/advisories/25766/</url>
	<url>http://bugzilla.gnome.org/show_bug.cgi?id=447414</url>
	</references>
	<dates>
	<discovery>2007-06-23</discovery>
	<entry>2007-06-25</entry>
	<modified>2007-06-28</modified>
	</dates>
	</vuln>

	<vuln vid="d337b206-200f-11dc-a197-0011098b2f36">
	<topic>xpcd -- buffer overflow</topic>
	<affects>
	<package>
	<name>xpcd</name>
	<range><gt>0</gt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Project reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-676">
	<p>Erik Sjolund discovered a buffer overflow in pcdsvgaview,
	an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses
	svgalib to display graphics on the Linux console for which
	root permissions are required. A malicious user could
	overflow a fixed-size buffer and may cause the program to
	execute arbitrary code with elevated privileges.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>12523</bid>
	<cvename>CVE-2005-0074</cvename>
	<url>http://www.debian.org/security/2005/dsa-676</url>
	</references>
	<dates>
	<discovery>2005-02-11</discovery>
	<entry>2007-06-21</entry>
	</dates>
	</vuln>

	<vuln vid="903654bd-1927-11dc-b8a0-02e0185f8d72">
	<topic>clamav -- multiple vulnerabilities</topic>
	<affects>
	<package>
	<name>clamav</name>
	<range><lt>0.90.3</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Clamav had been found vulnerable to multiple vulnerabilities:</p>
	<ul>
	<li>Improper checking for the end of an buffer causing an
	unspecified attack vector.</li>
	<li>Insecure temporary file handling, which could be exploited
	to read sensitive information.</li>
	<li>A flaw in the parser engine which could allow a remote
	attacker to bypass the scanning of RAR files.</li>
	<li>A flaw in libclamav/unrar.c which could cause a remote
	Denial of Service (DoS) by sending a specially crafted
	RAR file with a modified vm_codesize.</li>
	<li>A flaw in the OLE2 parser which could cause a remote
	Denial of Service (DoS).</li>
	</ul>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-2650</cvename>
	<cvename>CVE-2007-3023</cvename>
	<cvename>CVE-2007-3024</cvename>
	<cvename>CVE-2007-3122</cvename>
	<cvename>CVE-2007-3123</cvename>
	<url>http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853</url>
	</references>
	<dates>
	<discovery>2007-04-18</discovery>
	<entry>2007-06-19</entry>
	</dates>
	</vuln>

	<vuln vid="8092b820-1d6f-11dc-a0b2-001921ab2fa4">
	<topic>p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability</topic>
	<affects>
	<package>
	<name>p5-Mail-SpamAssassin</name>
	<range><lt>3.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>SpamAssassin website reports:</p>
	<blockquote cite="http://spamassassin.apache.org/advisories/cve-2007-2873.txt">
	<p>A local user symlink-attack DoS vulnerability in
	SpamAssassin has been found, affecting versions 3.1.x,
	3.2.0, and SVN trunk.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://spamassassin.apache.org/advisories/cve-2007-2873.txt</url>
	<cvename>CVE-2007-2873</cvename>
	</references>
	<dates>
	<discovery>2007-06-11</discovery>
	<entry>2007-06-18</entry>
	</dates>
	</vuln>

	<vuln vid="39988ee8-1918-11dc-b6bd-0016179b2dd5">
	<topic>cups -- Incomplete SSL Negotiation Denial of Service</topic>
	<affects>
	<package>
	<name>cups-base</name>
	<range><lt>1.2.11</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/24517/">
	<p>CUPS is not using multiple workers to handle connections.
	This can be exploited to stop CUPS from accepting new connections
	by starting but never completing an SSL negotiation.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://secunia.com/advisories/24517/</url>
	<url>http://security.gentoo.org/glsa/glsa-200703-28.xml</url>
	<cvename>CVE-2007-0720</cvename>
	</references>
	<dates>
	<discovery>2007-05-05</discovery>
	<entry>2007-06-12</entry>
	</dates>
	</vuln>

	<vuln vid="70ae62b0-16b0-11dc-b803-0016179b2dd5">
	<topic>c-ares -- DNS Cache Poisoning Vulnerability</topic>
	<affects>
	<package>
	<name>c-ares</name>
	<range><lt>1.4.0</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/25579/">
	<p>The vulnerability is caused due to predictable
	DNS "Transaction ID" field in DNS queries and can
	be exploited to poison the DNS cache of an application
	using the library if a valid ID is guessed.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<cvename>CVE-2007-3152</cvename>
	<cvename>CVE-2007-3153</cvename>
	<url>http://secunia.com/advisories/25579/</url>
	<url>http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup</url>
	</references>
	<dates>
	<discovery>2007-06-08</discovery>
	<entry>2007-06-09</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="0838733d-1698-11dc-a197-0011098b2f36">
	<topic>wordpress -- XMLRPC SQL Injection</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>zh-wordpress</name>
	<range><lt>2.2.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/25552/">
	<p>Slappter has discovered a vulnerability in WordPress, which can
	be exploited by malicious users to conduct SQL injection
	attacks.</p>
	<p>Input passed to the "wp.suggestCategories" method in xmlrpc.php
	is not properly sanitised before being used in SQL queries. This
	can be exploited to manipulate SQL queries by injecting arbitrary
	SQL code.</p>
	<p>Successful exploitation allows e.g. retrieving usernames and
	password hashes, but requires valid user credentials and knowledge
	of the database table prefix.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>24344</bid>
	<url>http://secunia.com/advisories/25552/</url>
	</references>
	<dates>
	<discovery>2007-06-06</discovery>
	<entry>2007-06-09</entry>
	<modified>2007-06-24</modified>
	</dates>
	</vuln>

	<vuln vid="6a31cbe3-1695-11dc-a197-0011098b2f36">
	<topic>wordpress -- unmoderated comments disclosure</topic>
	<affects>
	<package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>zh-wordpress</name>
	<range><lt>2.2.2</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Blogsecurity reports:</p>
	<blockquote cite="http://blogsecurity.net/news/news-310507/">
	<p>An attacker can read comments on posts that have not been
	moderated. This can be a real security risk if blog admins
	are using unmoderated comments (comments that have not been
	made public) to hide sensitive notes regarding posts, future
	work, passwords etc. So please be careful if you are one of
	these blog admins.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<url>http://blogsecurity.net/news/news-310507/</url>
	</references>
	<dates>
	<discovery>2007-06-01</discovery>
	<entry>2007-06-09</entry>
	<modified>2007-08-16</modified>
	</dates>
	</vuln>

	<vuln vid="12b7286f-16a2-11dc-b803-0016179b2dd5">
	<topic>webmin -- cross site scripting vulnerability</topic>
	<affects>
	<package>
	<name>webmin</name>
	<range><lt>1.350</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/25580/">
	<p>Input passed to unspecified parameters in pam_login.cgi
	is not properly sanitised before being returned to the
	user. This can be exploited to execute arbitrary HTML and
	script code in a user's browser session in context of an
	affected site.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>24381</bid>
	<cvename>CVE-2007-3156</cvename>
	<url>http://secunia.com/advisories/25580/</url>
	<url>http://www.webmin.com/changes-1.350.html</url>
	</references>
	<dates>
	<discovery>2007-06-01</discovery>
	<entry>2007-06-09</entry>
	<modified>2010-05-12</modified>
	</dates>
	</vuln>

	<vuln vid="3ac80dd2-14df-11dc-bcfc-0016179b2dd5">
	<topic>mplayer -- cddb stack overflow</topic>
	<affects>
	<package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.10_10</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mplayer Team reports:</p>
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
	<p>A stack overflow was found in the code used to handle
	cddb queries. When copying the album title and category,
	no checking was performed on the size of the strings
	before storing them in a fixed-size array. A malicious
	entry in the database could trigger a stack overflow in
	the program, leading to arbitrary code execution with the
	uid of the user running MPlayer.</p>
	</blockquote>
	</body>
	</description>
	<references>
	<bid>24302</bid>
	<cvename>CVE-2007-2948</cvename>

File Metadata

Mime Type: application/octet-stream
Expires: Fri, May 3, 11:16 PM (2 d)
Storage Engine: chunks
Storage Format: Chunks
Storage Handle: 55fpF6yRbEZs
Default Alt Text: (4 MB)

Offset	End	Complete
0	4194304	Yes
4194304	4461540	Yes

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions