Ubuntu CVE review

git-svn-id: svn+ssh://svn.debian.org/svn/kernel-sec@1022 e094ebfe-e918-0410-adfb-c712417f3574

19 files changed, 66 insertions, 46 deletions

diff --git a/active/00boilerplate b/active/00boilerplate
index 76cba362..3187b276 100644
--- a/active/00boilerplate
+++ b/active/00boilerplate
@@ -12,3 +12,4 @@ linux-2.6:
 2.6.15-dapper-security: 
 2.6.17-edgy-security: 
 2.6.20-feisty-security: 
+2.6.22-gutsy-security: 
diff --git a/active/CVE-2004-2731 b/active/CVE-2004-2731
index 9b3114ba..3a2508b9 100644
--- a/active/CVE-2004-2731
+++ b/active/CVE-2004-2731
@@ -25,7 +25,7 @@ linux-2.6: N/A
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: needed
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
-	
\ No newline at end of file
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
diff --git a/active/CVE-2006-7229 b/active/CVE-2006-7229
index 2a7b32de..a9b5bfe3 100644
--- a/active/CVE-2006-7229
+++ b/active/CVE-2006-7229
@@ -1,4 +1,4 @@
-Candidate: CVE-2007-7229
+Candidate: CVE-2006-7229
 References: 
  https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.15/+bug/65631
 Description: 
@@ -11,6 +11,7 @@ linux-2.6: N/A
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
diff --git a/active/CVE-2007-0997 b/active/CVE-2007-0997
index 1b412072..0ccf4bde 100644
--- a/active/CVE-2007-0997
+++ b/active/CVE-2007-0997
@@ -17,6 +17,7 @@ linux-2.6: released (2.6.18-1)
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: 
 2.4.27-sarge-security: 
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: needed
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
diff --git a/active/CVE-2007-3379 b/active/CVE-2007-3379
index 325506d7..0ba7a4f6 100644
--- a/active/CVE-2007-3379
+++ b/active/CVE-2007-3379
@@ -11,6 +11,7 @@ linux-2.6: N/A
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
diff --git a/active/CVE-2007-3850 b/active/CVE-2007-3850
index 2a6bec35..b4d29aee 100644
--- a/active/CVE-2007-3850
+++ b/active/CVE-2007-3850
@@ -14,6 +14,7 @@ linux-2.6:
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
diff --git a/active/CVE-2007-4133 b/active/CVE-2007-4133
index eba12059..cb393279 100644
--- a/active/CVE-2007-4133
+++ b/active/CVE-2007-4133
@@ -12,6 +12,6 @@ linux-2.6: released (2.6.20-1)
 2.6.18-etch-security: released (2.6.18.dfsg.1-13etch4) [bugfix/hugetlb-prio_tree-unit-fix.patch]
 2.6.8-sarge-security: 
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: needed
+2.6.20-feisty-security: N/A
diff --git a/active/CVE-2007-4311 b/active/CVE-2007-4311
index 6ffe922c..594159ec 100644
--- a/active/CVE-2007-4311
+++ b/active/CVE-2007-4311
@@ -10,6 +10,6 @@ linux-2.6:
 2.6.18-etch-security: 
 2.6.8-sarge-security: 
 2.4.27-sarge-security: pending (2.4.27-10sarge6) [248_random-reseed-sizeof-fix.diff]
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
diff --git a/active/CVE-2007-4567 b/active/CVE-2007-4567
index 243cf6da..b772d4db 100644
--- a/active/CVE-2007-4567
+++ b/active/CVE-2007-4567
@@ -15,3 +15,4 @@ linux-2.6:
 2.6.15-dapper-security: N/A
 2.6.17-edgy-security: N/A
 2.6.20-feisty-security: needed
+2.6.22-gutsy-security: N/A
diff --git a/active/CVE-2007-4571 b/active/CVE-2007-4571
index 0007fc50..56afd52b 100644
--- a/active/CVE-2007-4571
+++ b/active/CVE-2007-4571
@@ -13,6 +13,7 @@ linux-2.6: released (2.6.22-5)
 2.6.18-etch-security: ignored (2.6.18.dfsg.1-13etch3)
 2.6.8-sarge-security: 
 2.4.27-sarge-security: 
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: needed
+2.6.20-feisty-security: needed
+2.6.22-gutsy-security: needed
diff --git a/active/CVE-2007-4574 b/active/CVE-2007-4574
index b58cf9f8..de3c4665 100644
--- a/active/CVE-2007-4574
+++ b/active/CVE-2007-4574
@@ -10,6 +10,6 @@ linux-2.6: N/A
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
diff --git a/active/CVE-2007-4997 b/active/CVE-2007-4997
index 1df5a747..11662ec6 100644
--- a/active/CVE-2007-4997
+++ b/active/CVE-2007-4997
@@ -1,5 +1,6 @@
 Candidate: CVE-2007-4997
 References: 
+ http://git.kernel.org/?p=linux/kernel/git/avi/kvm.git;a=commitdiff;h=04045f98e0457aba7d4e6736f37eed189c48a5f7
 Description: 
 Ubuntu-Description: 
 Notes: 
@@ -16,6 +17,6 @@ linux-2.6: needed
 2.6.18-etch-security: pending (2.6.18.dfsg.1-13etch5) [bugfix/ieee80211-underflow.patch]
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: needed
+2.6.20-feisty-security: needed
diff --git a/active/CVE-2007-5093 b/active/CVE-2007-5093
index 20b02f6b..8e2b5fbf 100644
--- a/active/CVE-2007-5093
+++ b/active/CVE-2007-5093
@@ -1,5 +1,6 @@
 Candidate: CVE-2007-5093
 References: 
+ http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6-stable.git;a=commitdiff;h=852ffe0acf89f959e8d35080bbd2bdc2d8f2e9e5
  MLIST:20070902 Oops in pwc v4l driver
  URL:http://marc.info/?l=linux-kernel&m=118873457814808&w=2
  MLIST:20070903 Re: Oops in pwc v4l driver
@@ -22,6 +23,7 @@ linux-2.6:
 2.6.18-etch-security: released (2.6.18.dfsg.1-13etch4) [bugfix/usb-pwc-disconnect-block.patch]
 2.6.8-sarge-security: 
 2.4.27-sarge-security: 
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: needed
+2.6.20-feisty-security: needed
+2.6.20-gutsy-security: needed
diff --git a/active/CVE-2007-5500 b/active/CVE-2007-5500
index 1807e943..76b5736d 100644
--- a/active/CVE-2007-5500
+++ b/active/CVE-2007-5500
@@ -1,15 +1,18 @@
 Candidate: CVE-2007-5500
 References: 
+ http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.23.y.git;a=commitdiff;h=36ef66c5d137b9a31fd8c35d236fb9e26ef74f97
 Description: 
  wait_task_stopped: Check p->exit_state instead of TASK_TRACED
 Ubuntu-Description: 
 Notes: 
+ kees> 2.6.15 does not actually lock up -- it just spins in userspace
 Bugs: 
 upstream: released (2.6.23.8)
 linux-2.6: 
 2.6.18-etch-security: 
 2.6.8-sarge-security: 
 2.4.27-sarge-security: 
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: needed
+2.6.20-feisty-security: needed
+2.6.22-gutsy-security: needed
diff --git a/active/CVE-2007-5501 b/active/CVE-2007-5501
index 37b3383b..84b5e715 100644
--- a/active/CVE-2007-5501
+++ b/active/CVE-2007-5501
@@ -12,6 +12,7 @@ linux-2.6: needed
 2.6.18-etch-security: N/A
 2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: needed
diff --git a/active/CVE-2007-5904 b/active/CVE-2007-5904
index 76cba362..f6de904b 100644
--- a/active/CVE-2007-5904
+++ b/active/CVE-2007-5904
@@ -1,4 +1,4 @@
-Candidate: 
+Candidate: CVE-2007-5904
 References: 
 Description: 
 Ubuntu-Description: 
@@ -12,3 +12,4 @@ linux-2.6:
 2.6.15-dapper-security: 
 2.6.17-edgy-security: 
 2.6.20-feisty-security: 
+2.6.22-gutsy-security: 
diff --git a/active/CVE-2007-5908 b/active/CVE-2007-5908
index b923eee3..061750b2 100644
--- a/active/CVE-2007-5908
+++ b/active/CVE-2007-5908
@@ -3,12 +3,14 @@ References:
 Description: 
 Ubuntu-Description: 
 Notes: 
+ kees> this is not actually an exploitable security issue. there is no way to add clock sources that could trigger the overflow.
 Bugs: 
 upstream: 
 linux-2.6: 
 2.6.18-etch-security: 
 2.6.8-sarge-security: 
 2.4.27-sarge-security: 
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
-2.6.20-feisty-security: 
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
diff --git a/ignored/CVE-2006-6058 b/ignored/CVE-2006-6058
index 9ac88f7e..85686e2c 100644
--- a/ignored/CVE-2006-6058
+++ b/ignored/CVE-2006-6058
@@ -1,5 +1,6 @@
 Candidate: CVE-2006-6058
 References: 
+ http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.23.y.git;a=commitdiff;h=f0ae3188daf70ed07a4dfbeb133bef3a92838a15
  MISC:http://projects.info-pull.com/mokb/MOKB-17-11-2006.html
  FRSIRT:ADV-2006-4613
  URL:http://www.frsirt.com/english/advisories/2006/4613
@@ -24,3 +25,5 @@ linux-2.6: ignored
 2.4.27-sarge-security: ignored
 2.6.15-dapper-security: needed
 2.6.17-edgy-security: needed
+2.6.20-feisty-security: needed
+2.6.22-gutsy-security: needed
diff --git a/scripts/ubuntu-table b/scripts/ubuntu-table
index 8153fb26..868b5c6e 100755
--- a/scripts/ubuntu-table
+++ b/scripts/ubuntu-table
@@ -25,7 +25,7 @@ for rel in releases:
     print format % rel.split('-')[1],
 print
 
-for cve in cves:
+for cve in sorted(cves):
     needed = 0
     released = 0
     action_required = 0