CVE-2009-3720

Name	CVE-2009-3720
Source	CVE (at NVD; RH)
Description	The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
References	DSA-1921-1, DSA-1977-1
NVD severity	medium
Debian Bugs	551936, 551938, 560912, 560913, 560914, 560915, 560916, 560917, 560919, 560920, 560921, 560922, 560924, 560925, 560926, 560927, 560928, 560929, 560930, 560931, 560932, 560933, 560935, 560936, 560937, 560940, 560942, 560944, 560945, 560946, 560949, 560950, 560951, 560953
Debian/oldstable	packages ayttm, expat, python-4suite, python-xml, python2.4, python2.5, smart, tdom, vnc4, w3c-libwww, xmlrpc-c are vulnerable.
Debian/stable	packages ayttm, python-4suite, python2.4, python2.5, vnc4, xmlrpc-c, xotcl are vulnerable.
Debian/testing	packages python-4suite, vnc4, xmlrpc-c are vulnerable.
Debian/unstable	packages python-4suite, python2.4, vnc4, xmlrpc-c are vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
audacity (PTS)	etch	1.2.4b-2.1	vulnerable
	lenny, lenny (security)	1.3.5-2+lenny1	fixed
	squeeze	1.3.10-1	fixed
	sid	1.3.11-2	fixed
ayttm (PTS)	etch	0.4.6+34-3	vulnerable
	lenny	0.5.0+45-1	vulnerable
	squeeze, sid	0.6.1-2	fixed
cableswig (PTS)	etch	0.1.0+cvs20060311-1	vulnerable
	lenny	0.1.0+cvs20080508-1	vulnerable
	squeeze, sid	0.1.0+cvs20090916-1	vulnerable
cadaver (PTS)	etch	0.22.3+debian-1	vulnerable
	lenny	0.23.2-1	vulnerable
	squeeze, sid	0.23.3-1	vulnerable
cmake (PTS)	etch	2.4.5-1	vulnerable
	etch-backports	2.6.0-5~bpo40+1	vulnerable
	lenny	2.6.0-6	fixed
	squeeze, sid	2.8.0-5	fixed
coin3 (PTS)	squeeze, sid	3.1.2-1	vulnerable
expat (PTS)	etch	1.95.8-3.4	vulnerable
	etch (security)	1.95.8-3.4+etch3	fixed
	lenny, lenny (security)	2.0.1-4+lenny3	fixed
	squeeze, sid	2.0.1-7	fixed
gdcm (PTS)	squeeze	2.0.14-2	fixed
	sid	2.0.14-3	fixed
ghostscript (PTS)	etch-backports	8.62.dfsg.1-3.1~bpo40+1	vulnerable
	lenny, lenny (security)	8.62.dfsg.1-3.2lenny1	vulnerable
	squeeze (security)	8.64~dfsg-1+squeeze1	vulnerable
	squeeze, sid	8.70~dfsg-2.1	vulnerable
grmonitor (PTS)	etch	0.81-4.1	vulnerable
	lenny	0.81-4.2	vulnerable
gs-gpl (PTS)	etch, etch (security)	8.54.dfsg.1-5etch2	vulnerable
iceape (PTS)	etch, etch (security)	1.0.13~pre080614i-0etch1	vulnerable
	lenny	1.1.14-1.1	vulnerable
	squeeze, sid	2.0.1-1	vulnerable
iceweasel (PTS)	etch, etch (security)	2.0.0.19-0etch1	fixed
	lenny, lenny (security)	3.0.6-3	fixed
	squeeze	3.5.6-1	fixed
	lenny-backports	3.5.6-1~bpo50+1	fixed
	sid	3.5.6-2	fixed
insighttoolkit (PTS)	lenny	3.6.0-3	vulnerable
	squeeze, sid	3.16.0-1	fixed
kompozer (PTS)	squeeze, sid	1:0.8~b1-2	fixed
	lenny-backports	1:0.8~b1-2~bpo50+1	fixed
matanza (PTS)	etch	0.13-3.3	vulnerable
	lenny	0.13-3.4	vulnerable
	squeeze, sid	0.13+ds1-1	vulnerable
paraview (PTS)	lenny	3.2.2-1	vulnerable
	sid	3.6.2-1	fixed
poco (PTS)	lenny	1.3.2+dfsg1-3	vulnerable
	squeeze, sid	1.3.6p1-1	fixed
python-4suite (PTS)	etch	0.99cvs20060405-1.1	vulnerable
	lenny	1.0.2-5	vulnerable
	squeeze	1.0.2-7	vulnerable
	sid	1.0.2-7.1	vulnerable
python-xml (PTS)	etch	0.8.4-6	vulnerable
	lenny	0.8.4-10.1+lenny1	fixed
python2.4 (PTS)	etch	2.4.4-3+etch2	vulnerable
	etch (security)	2.4.4-3+etch3	fixed
	lenny	2.4.6-1	vulnerable
	lenny (security)	2.4.6-1+lenny1	fixed
	sid	2.4.6-2.2	vulnerable
python2.5 (PTS)	etch	2.5-5+etch1	vulnerable
	etch (security)	2.5-5+etch2	fixed
	lenny	2.5.2-15	vulnerable
	lenny (security)	2.5.2-15+lenny1	fixed
	squeeze, sid	2.5.5-2	fixed
simgear (PTS)	etch	0.3.10-2	vulnerable
	lenny, squeeze	1.0.0-4	vulnerable
	sid	1.9.1-2	vulnerable
smart (PTS)	etch	0.41+svn727-1.1	vulnerable
	squeeze, sid	1.2-5	fixed
tdom (PTS)	etch	0.7.8-5	vulnerable
	lenny	0.8.3~20080525-2	fixed
	squeeze, sid	0.8.3~20080525-3	fixed
texlive-bin (PTS)	etch	2005.dfsg.2-12	fixed
	etch-backports	2007.dfsg.2-3~bpo40+1	fixed
	lenny	2007.dfsg.2-4+lenny2	fixed
	squeeze, sid	2009-5	fixed
tla (PTS)	etch	1.3.5+dfsg-9	vulnerable
	lenny	1.3.5+dfsg-14	vulnerable
	squeeze, sid	1.3.5+dfsg-15	fixed
udunits (PTS)	squeeze, sid	2.1.8-4	fixed
vnc4 (PTS)	etch, etch (security)	4.1.1+X4.3.0-21+etch1	vulnerable
	lenny	4.1.1+X4.3.0-31	vulnerable
	squeeze	4.1.1+X4.3.0-34	vulnerable
	sid	4.1.1+X4.3.0-35	vulnerable
vxl (PTS)	squeeze, sid	1.13.0-2	fixed
w3c-libwww (PTS)	etch	5.4.0-11	vulnerable
wxwidgets2.6 (PTS)	etch	2.6.3.2.1.5	vulnerable
	etch (security)	2.6.3.2.1.5+etch1	vulnerable
	lenny, lenny (security)	2.6.3.2.2-3+lenny1	vulnerable
	squeeze, sid	2.6.3.2.2-5	fixed
wxwidgets2.8 (PTS)	lenny, lenny (security)	2.8.7.1-1.1+lenny1	vulnerable
	squeeze	2.8.10.1-2	fixed
	sid	2.8.10.1-3	fixed
wxwindows2.4 (PTS)	etch	2.4.5.1.1	vulnerable
	etch (security)	2.4.5.1.1+etch1	vulnerable
xmlrpc-c (PTS)	etch	0.9.10-4	vulnerable
	lenny, squeeze, sid	1.06.27-1	vulnerable
	experimental	1.16.07-1	vulnerable
xotcl (PTS)	lenny	1.6.1-1	vulnerable
	squeeze, sid	1.6.5-1.1	fixed
xulrunner (PTS)	etch, etch (security)	1.8.0.15~pre080614i-0etch1	vulnerable
	lenny, lenny (security)	1.9.0.16-1	vulnerable
	squeeze	1.9.1.6-1	vulnerable
	lenny-backports	1.9.1.6-1~bpo50+2	vulnerable
	sid	1.9.1.6-2	vulnerable

The next table lists affected binary packages.

Binary Package	Release	Version	Status	Architecures
aolserver4-xotcl, xotcl-doc	lenny	1.6.1-1	vulnerable	all
	squeeze	1.6.3-2	vulnerable	all
	sid, squeeze	1.6.5-1.1	fixed	all
audacity	etch	1.2.4b-2.1	vulnerable	alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch	1.2.4b-2.1+b1	vulnerable	hppa
	lenny	1.3.5-2+lenny1	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny (security)	1.3.5-2+lenny1	fixed	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
audacity, audacity-dbg	sid	1.3.10-1	fixed	mips
	squeeze	1.3.10-1	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	1.3.11-1	fixed	mipsel
	sid	1.3.11-2	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, powerpc, s390, sparc
audacity-data	squeeze	1.3.9-4	fixed	all
	sid, squeeze	1.3.10-1	fixed	all
	sid	1.3.11-1	fixed	all
	sid	1.3.11-2	fixed	all
ayttm	etch	0.4.6+34-3	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	0.5.0+45-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	0.6.1-2	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	0.6.1-2	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
cableswig	etch	0.1.0+cvs20060311-1	vulnerable	alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch	0.1.0+cvs20060311-1+b1	vulnerable	hppa
	lenny	0.1.0+cvs20080508-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	0.1.0+cvs20090916-1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	0.1.0+cvs20090916-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
cadaver	etch	0.22.3+debian-1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	0.23.2-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	0.23.3-1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	0.23.3-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
cmake	etch	2.4.5-1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch-backports	2.6.0-5~bpo40+1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mipsel, powerpc, s390, sparc
	lenny	2.6.0-6	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
cmake, cmake-curses-gui, cmake-qt-gui	sid	2.8.0-5	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2.8.0-5	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
cmake-data	squeeze	2.6.4-3	fixed	all
	sid, squeeze	2.8.0-5	fixed	all
expat, libexpat1, libexpat1-dev	etch	1.95.8-3.4	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch (security)	1.95.8-3.4+etch3	fixed	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny, lenny (security)	2.0.1-4+lenny3	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	2.0.1-7	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2.0.1-7	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
firefox, firefox-dom-inspector, firefox-gnome-support, iceweasel-dom-inspector, mozilla-firefox, mozilla-firefox-dom-inspector, mozilla-firefox-gnome-support	etch, etch (security)	2.0.0.19-0etch1	fixed	all
ghostscript, ghostscript-cups, ghostscript-x, libgs-dev, libgs8	sid	8.70~dfsg-2.1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	8.70~dfsg-2.1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
ghostscript, ghostscript-x, libgs-dev, libgs8	etch-backports	8.62.dfsg.1-3.1~bpo40+1	vulnerable	amd64, i386, powerpc, s390
	lenny, lenny (security)	8.62.dfsg.1-3.2lenny1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	squeeze (security)	8.64~dfsg-1+squeeze1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
ghostscript-doc, gs, gs-aladdin, gs-common, gs-esp, gs-gpl	etch-backports	8.62.dfsg.1-3.1~bpo40+1	vulnerable	all
	lenny, lenny (security)	8.62.dfsg.1-3.2lenny1	vulnerable	all
	squeeze (security)	8.64~dfsg-1+squeeze1	vulnerable	all
ghostscript-doc, gs-common, gs-esp, gs-gpl	squeeze	8.70~dfsg-2	vulnerable	all
	sid, squeeze	8.70~dfsg-2.1	vulnerable	all
grmonitor	etch	0.81-4.1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	0.81-4.2	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
gs	etch, etch (security)	8.54.dfsg.1-5etch2	vulnerable	all
gs-gpl	etch, etch (security)	8.54.dfsg.1-5etch2	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
iceape, iceape-chatzilla, iceape-dev	etch, etch (security)	1.0.13~pre080614i-0etch1	vulnerable	all
	sid, squeeze	2.0.1-1	vulnerable	all
iceape-browser, iceape-calendar, iceape-dbg, iceape-dom-inspector, iceape-gnome-support, iceape-mailnews	etch, etch (security)	1.0.13~pre080614i-0etch1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
iceape-browser, iceape-dbg, iceape-mailnews	sid	2.0.1-1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2.0.1-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
iceape-dev	lenny, squeeze	1.1.14-1.1	vulnerable	all
iceape-dev-bin	lenny	1.1.14-1.1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
iceweasel, iceweasel-dbg	lenny, lenny (security)	3.0.6-3	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny-backports	3.5.6-1~bpo50+1	fixed	amd64, i386, powerpc, s390
	squeeze	3.5.6-1	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	3.5.6-2	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
iceweasel, iceweasel-dbg, iceweasel-gnome-support	etch, etch (security)	2.0.0.19-0etch1	fixed	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
iceweasel-gnome-support	lenny, lenny (security)	3.0.6-3	fixed	all
	squeeze	3.0.14-1	fixed	all
	lenny-backports	3.5.6-1~bpo50+1	fixed	all
	squeeze	3.5.6-1	fixed	all
idle-python2.4, python2.4-examples	etch	2.4.4-3+etch2	vulnerable	all
	etch (security)	2.4.4-3+etch3	fixed	all
	lenny	2.4.6-1	vulnerable	all
	lenny (security)	2.4.6-1+lenny1	fixed	all
	sid, squeeze	2.4.6-2.2	vulnerable	all
idle-python2.5, python2.5-examples	etch	2.5-5+etch1	vulnerable	all
	etch (security)	2.5-5+etch2	fixed	all
	lenny	2.5.2-15	vulnerable	all
	lenny (security)	2.5.2-15+lenny1	fixed	all
	squeeze	2.5.4-2	vulnerable	all
	sid, squeeze	2.5.5-2	fixed	all
insighttoolkit3-examples	lenny	3.6.0-3	vulnerable	all
	sid, squeeze	3.16.0-1	fixed	all
kompozer	lenny-backports	1:0.8~b1-2~bpo50+1	fixed	alpha, hppa, i386, ia64, powerpc, s390, sparc
	sid	1:0.8~b1-2	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	1:0.8~b1-2	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
kompozer-data, kompozer-dev	squeeze	1:0.8~alpha4+dfsg+svn163-2	vulnerable	all
	lenny-backports	1:0.8~b1-2~bpo50+1	fixed	all
	sid, squeeze	1:0.8~b1-2	fixed	all
lib64expat1, lib64expat1-dev	lenny, lenny (security)	2.0.1-4+lenny3	fixed	i386, powerpc, s390, sparc
	sid, squeeze	2.0.1-7	fixed	i386, powerpc, s390, sparc
libcoin60, libcoin60-dev	sid	3.1.2-1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	3.1.2-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libcoin60-doc, libcoin60-runtime	squeeze	3.1.0-2	vulnerable	all
	sid, squeeze	3.1.2-1	vulnerable	all
libgdcm-cil, libvtkgdcm-cil	sid	2.0.14-2	fixed	ia64
	squeeze	2.0.14-2	fixed	amd64, armel, i386, ia64, powerpc, s390, sparc
	sid	2.0.14-3	fixed	amd64, armel, i386, kfreebsd-amd64, kfreebsd-i386, powerpc, s390, sparc
libgdcm-java, libgdcm-tools, libgdcm2-dev, libgdcm2.0, libgdcm2.0-dbg, libvtkgdcm-java, libvtkgdcm-tools, libvtkgdcm2-dev, libvtkgdcm2.0, python-gdcm, python-vtkgdcm	sid	2.0.14-2	fixed	ia64, mips, mipsel
	squeeze	2.0.14-2	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	2.0.14-3	fixed	alpha, amd64, armel, hppa, i386, kfreebsd-amd64, kfreebsd-i386, powerpc, s390, sparc
libinsighttoolkit3-dev, libinsighttoolkit3.16, python-insighttoolkit3, tcl8.4-insighttoolkit3	sid	3.16.0-1	fixed	alpha, amd64, armel, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	3.16.0-1	fixed	amd64, armel, i386, ia64, mips, mipsel, powerpc, s390, sparc
libinsighttoolkit3-dev, libinsighttoolkit3.6, python-insighttoolkit3, tcl8.4-insighttoolkit3	lenny	3.6.0-3	vulnerable	alpha, amd64, arm, armel, i386, ia64, mips, mipsel, powerpc, s390, sparc
libkpathsea-dev, libkpathsea4, texlive-base-bin, texlive-base-bin-doc, texlive-extra-utils, texlive-font-utils, texlive-lang-indic, texlive-metapost, texlive-metapost-doc, texlive-music, texlive-omega, texlive-xetex	etch-backports	2007.dfsg.2-3~bpo40+1	fixed	amd64, hppa, i386, ia64, mipsel, powerpc, s390, sparc
	lenny	2007.dfsg.2-4+lenny2	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libkpathsea-dev, libkpathsea5, texlive-binaries	sid	2009-5	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2009-5	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libmozillainterfaces-java	squeeze	1.9.0.14-1	vulnerable	all
	lenny, lenny (security)	1.9.0.16-1	vulnerable	all
	lenny-backports	1.9.1.6-1~bpo50+2	vulnerable	all
	sid, squeeze	1.9.1.6-1	vulnerable	all
	sid	1.9.1.6-2	vulnerable	all
libmozillainterfaces-java, libmozjs-dev, libnspr4-dev, libnss3-dev, libsmjs-dev, libsmjs1, libxul-common, libxul-dev	etch, etch (security)	1.8.0.15~pre080614i-0etch1	vulnerable	all
libmozjs-dev, libmozjs1d, libmozjs1d-dbg, python-xpcom, spidermonkey-bin, xulrunner-1.9, xulrunner-1.9-dbg, xulrunner-1.9-gnome-support, xulrunner-dev	lenny, lenny (security)	1.9.0.16-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libmozjs-dev, libmozjs2d, libmozjs2d-dbg, python-xpcom, spidermonkey-bin, xulrunner-1.9.1, xulrunner-1.9.1-dbg, xulrunner-1.9.1-gnome-support, xulrunner-dev	lenny-backports	1.9.1.6-1~bpo50+2	vulnerable	alpha, amd64, arm, armel, hppa, i386, powerpc, s390, sparc
	sid	1.9.1.6-1	vulnerable	alpha, armel, mips, powerpc, sparc
	squeeze	1.9.1.6-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libmozjs-dev, libmozjs2d, libmozjs2d-dbg, python-xpcom, spidermonkey-bin, xulrunner-1.9.1, xulrunner-1.9.1-dbg, xulrunner-dev	sid	1.9.1.6-2	vulnerable	amd64, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mipsel, s390
libmozjs0d, libmozjs0d-dbg, libnspr4-0d, libnspr4-0d-dbg, libnss3-0d, libnss3-0d-dbg, libnss3-tools, libxul0d, libxul0d-dbg, python-xpcom, spidermonkey-bin, xulrunner, xulrunner-gnome-support	etch, etch (security)	1.8.0.15~pre080614i-0etch1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libpoco-dev, libpococrypto9, libpococrypto9-dbg, libpocodata9, libpocodata9-dbg, libpocofoundation9, libpocofoundation9-dbg, libpocomysql9, libpocomysql9-dbg, libpoconet9, libpoconet9-dbg, libpoconetssl9, libpoconetssl9-dbg, libpocoodbc9, libpocoodbc9-dbg, libpocosqlite9, libpocosqlite9-dbg, libpocoutil9, libpocoutil9-dbg, libpocoxml9, libpocoxml9-dbg, libpocozip9, libpocozip9-dbg	sid	1.3.6p1-1	fixed	alpha, amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	squeeze	1.3.6p1-1	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libpoco5-dev, libpocodata5, libpocodata5-dbg, libpocofoundation5, libpocofoundation5-dbg, libpoconet5, libpoconet5-dbg, libpoconetssl5, libpoconetssl5-dbg, libpocoodbc5, libpocoodbc5-dbg, libpocosqlite5, libpocosqlite5-dbg, libpocoutil5, libpocoutil5-dbg, libpocoxml5, libpocoxml5-dbg	lenny	1.3.2+dfsg1-3	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libudunits2-0, libudunits2-dev, udunits-bin	sid	2.1.8-4	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2.1.8-4	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libvxl1-dev, libvxl1.13	sid	1.13.0-2	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	1.13.0-2	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libwww-dev, libwww-ssl-dev, libwww-ssl0, libwww0	etch	5.4.0-11	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libwxbase2.4-1, libwxbase2.4-dbg, libwxbase2.4-dev, libwxgtk2.4-1, libwxgtk2.4-1-contrib, libwxgtk2.4-contrib-dev, libwxgtk2.4-dbg, libwxgtk2.4-dev, python-wxgtk2.4, wx2.4-headers	etch	2.4.5.1.1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch (security)	2.4.5.1.1+etch1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libwxbase2.6-0, libwxbase2.6-dbg, libwxbase2.6-dev, libwxgtk2.6-0, libwxgtk2.6-dbg, libwxgtk2.6-dev, python-wxgtk2.6, python-wxgtk2.6-dbg, wx-common, wx2.6-headers	lenny, lenny (security)	2.6.3.2.2-3+lenny1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libwxbase2.6-0, libwxbase2.6-dbg, libwxbase2.6-dev, libwxgtk2.6-0, libwxgtk2.6-dbg, libwxgtk2.6-dev, python-wxgtk2.6, python-wxgtk2.6-dbg, wx2.6-headers	sid	2.6.3.2.2-5	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2.6.3.2.2-5	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libwxbase2.6-0, libwxbase2.6-dbg, libwxbase2.6-dev, libwxgtk2.6-0, libwxgtk2.6-dbg, libwxgtk2.6-dev, python-wxgtk2.6, wx-common, wx2.6-headers	etch	2.6.3.2.1.5	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch (security)	2.6.3.2.1.5+etch1	vulnerable	alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390, sparc
libwxbase2.8-0, libwxbase2.8-dbg, libwxbase2.8-dev, libwxgtk2.8-0, libwxgtk2.8-dbg, libwxgtk2.8-dev, python-wxgtk2.8, python-wxgtk2.8-dbg, wx-common, wx2.8-headers	sid	2.8.10.1-2	fixed	mips
	squeeze	2.8.10.1-2	fixed	ia64, mips, mipsel
	squeeze	2.8.10.1-2+b1	fixed	amd64, armel, hppa, i386, powerpc, s390, sparc
	sid	2.8.10.1-3	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mipsel, powerpc, s390, sparc
libwxbase2.8-0, libwxbase2.8-dbg, libwxbase2.8-dev, libwxgtk2.8-0, libwxgtk2.8-dbg, libwxgtk2.8-dev, python-wxgtk2.8, python-wxgtk2.8-dbg, wx2.8-headers	lenny, lenny (security)	2.8.7.1-1.1+lenny1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
libxmlrpc-c3, libxmlrpc-c3-dev, xml-rpc-api2cpp, xml-rpc-api2txt	etch	0.9.10-4	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	1.06.27-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	1.06.27-1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	1.06.27-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	experimental	1.16.07-1	vulnerable	alpha, amd64, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
matanza	etch	0.13-3.3	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	0.13-3.4	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	0.13+ds1-1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	0.13+ds1-1	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
mozilla, mozilla-browser, mozilla-calendar, mozilla-chatzilla, mozilla-dev, mozilla-dom-inspector, mozilla-js-debugger, mozilla-mailnews, mozilla-psm	etch, etch (security)	2:1.8+1.0.13~pre080614i-0etch1	vulnerable	all
paraview	lenny	3.2.2-1	vulnerable	amd64, i386, powerpc
	sid	3.4.0-5	vulnerable	armel
	sid	3.6.2-1	fixed	mips, mipsel, sparc
	sid	3.6.2-1+b1	fixed	alpha, amd64, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, powerpc, s390
python-4suite	etch	0.99cvs20060405-1.1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
python-4suite-common, python-4suite-doc, python-4suite-server	etch	0.99cvs20060405-1.1	vulnerable	all
python-4suite-doc	lenny	1.0.2-5	vulnerable	all
	sid, squeeze	1.0.2-7	vulnerable	all
	sid	1.0.2-7.1	vulnerable	all
python-4suite-xml	lenny	1.0.2-5	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	1.0.2-7	vulnerable	mips
	squeeze	1.0.2-7	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	1.0.2-7.1	vulnerable	alpha, amd64, armel, hppa, i386, ia64, mipsel, powerpc, s390, sparc
python-smartpm, smartpm-core	sid	1.2-5	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	1.2-5	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
python-wxtools, python-wxversion, wx2.6-doc, wx2.6-examples, wx2.6-i18n	etch	2.6.3.2.1.5	vulnerable	all
	etch (security)	2.6.3.2.1.5+etch1	vulnerable	all
	lenny, lenny (security)	2.6.3.2.2-3+lenny1	vulnerable	all
	squeeze	2.6.3.2.2-3.1	vulnerable	all
python-wxtools, python-wxversion, wx2.8-doc, wx2.8-examples, wx2.8-i18n	sid, squeeze	2.8.10.1-2	fixed	all
	sid	2.8.10.1-3	fixed	all
python-xml	etch	0.8.4-6	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
python-xml, python-xml-dbg	lenny	0.8.4-10.1+lenny1	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
python-xml-doc, xbel, xbel-utils	squeeze	0.8.4-10.1	vulnerable	all
	lenny	0.8.4-10.1+lenny1	fixed	all
python2.4, python2.4-dbg, python2.4-dev, python2.4-minimal	etch	2.4.4-3+etch2	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch (security)	2.4.4-3+etch2	vulnerable	hppa
	etch (security)	2.4.4-3+etch3	fixed	alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	2.4.6-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny (security)	2.4.6-1+lenny1	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390
	sid	2.4.6-2.2	vulnerable	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
python2.5, python2.5-dbg, python2.5-dev, python2.5-minimal	etch	2.5-5+etch1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch (security)	2.5-5+etch1	vulnerable	hppa
	etch (security)	2.5-5+etch2	fixed	alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny	2.5.2-15	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	lenny (security)	2.5.2-15+lenny1	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390
	sid	2.5.5-2	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	2.5.5-2	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
simgear-dev, simgear0	etch	0.3.10-2	vulnerable	alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390, sparc
	etch	0.3.10-2+b1	vulnerable	hppa
simgear-dev, simgear1.0.0	lenny	1.0.0-4	vulnerable	alpha
	lenny	1.0.0-4+b1	vulnerable	amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	squeeze	1.0.0-4+b3	vulnerable	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
simgear-dev, simgear1.9.1	sid	1.9.1-2	vulnerable	alpha, amd64, i386, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, s390, sparc
	sid	1.9.1-2+b1	vulnerable	armel, hppa, ia64, powerpc
smartpm	etch	0.41+svn727-1.1	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	squeeze	1.2-4	vulnerable	all
	sid, squeeze	1.2-5	fixed	all
tdom	etch	0.7.8-5	vulnerable	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
tdom, tdom-dev	lenny	0.8.3~20080525-2	fixed	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	0.8.3~20080525-3	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	0.8.3~20080525-3	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
texlive-base-bin, texlive-extra-utils, texlive-font-utils, texlive-lang-indic, texlive-metapost, texlive-music, texlive-omega, texlive-pdfetex	etch	2005.dfsg.2-12	fixed	alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
tla	etch	1.3.5+dfsg-9	vulnerable	alpha, amd64, arm, hppa, ia64, mips, mipsel, powerpc, s390, sparc
	etch	1.3.5+dfsg-9+b1	vulnerable	i386
	lenny	1.3.5+dfsg-14	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	1.3.5+dfsg-15	fixed	alpha, amd64, armel, hppa, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, sparc
	squeeze	1.3.5+dfsg-15	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
tla-doc	etch	1.3.5+dfsg-9	vulnerable	all
	lenny, squeeze	1.3.5+dfsg-14	vulnerable	all
	sid, squeeze	1.3.5+dfsg-15	fixed	all
vnc4-common, vnc4server, xvnc4viewer	etch, etch (security)	4.1.1+X4.3.0-21+etch1	vulnerable	alpha, amd64, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
vnc4server, xvnc4viewer	lenny	4.1.1+X4.3.0-31	vulnerable	amd64, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	squeeze	4.1.1+X4.3.0-34	vulnerable	amd64, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	4.1.1+X4.3.0-35	vulnerable	amd64, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
wx2.4-doc, wx2.4-examples, wx2.4-i18n	etch	2.4.5.1.1	vulnerable	all
	etch (security)	2.4.5.1.1+etch1	vulnerable	all
wx2.6-doc, wx2.6-examples, wx2.6-i18n	sid, squeeze	2.6.3.2.2-5	fixed	all
wx2.8-doc, wx2.8-examples, wx2.8-i18n	squeeze	2.8.7.1-1.1	vulnerable	all
	lenny, lenny (security)	2.8.7.1-1.1+lenny1	vulnerable	all
xbel, xbel-utils	etch	0.8.4-6	vulnerable	all
xotcl, xotcl-dev, xotcl-shells	lenny	1.6.1-1	vulnerable	alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	sid	1.6.5-1.1	fixed	alpha, amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc
	squeeze	1.6.5-1.1	fixed	amd64, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390, sparc

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
audacity	source	(unstable)	1.3.2-1	unimportant		560919
ayttm	source	(unstable)	0.6.1-2	low		560924
cableswig	source	(unstable)	(unfixed)	unimportant		560925
cadaver	source	(unstable)	(unfixed)	unimportant		560926
cmake	source	(unstable)	2.6.0-6	unimportant		560927
coin3	source	(unstable)	(unfixed)	unimportant		560928
expat	source	(unstable)	2.0.1-5	low		551936
expat	source	etch	1.95.8-3.4+etch1	unknown	DSA-1921-1
expat	source	lenny	2.0.1-4+lenny1	unknown	DSA-1921-1
gdcm	source	(unstable)	2.0.14-2	low		560929
ghostscript	source	(unstable)	(unfixed)	unimportant		560930
grmonitor	source	(unstable)	(unfixed)	unimportant		560931
gs-gpl	source	(unstable)	(unfixed)	unimportant
iceape	source	(unstable)	(unfixed)	unimportant		560932
iceweasel	source	(unstable)	(not affected)
insighttoolkit	source	(unstable)	3.16.0-1	unimportant		560933
kompozer	source	(unstable)	1:0.8~b1-2	unimportant		560944
matanza	source	(unstable)	(unfixed)	unimportant		560920
paraview	source	(unstable)	3.6.2-1	unimportant		560935
poco	source	(unstable)	1.3.6p1-1	unimportant		560936
python-4suite	source	(unstable)	(unfixed)	low		560914
python-xml	source	(unstable)	(unfixed)	low		560951
python-xml	source	lenny	0.8.4-10.1+lenny1	unknown
python2.4	source	(unstable)	(unfixed)	low		560913
python2.4	source	etch	2.4.4-3+etch3	unknown	DSA-1977-1
python2.4	source	lenny	2.4.6-1+lenny1	unknown	DSA-1977-1
python2.5	source	(unstable)	2.5.4-3.1	low		560912
python2.5	source	etch	2.5-5+etch2	unknown	DSA-1977-1
python2.5	source	lenny	2.5.2-15+lenny1	unknown	DSA-1977-1
simgear	source	(unstable)	(unfixed)	unimportant		560937
smart	source	(unstable)	1.2-5	low		560953
tdom	source	(unstable)	0.8.3~20080525-1	low		560921
texlive-bin	source	(unstable)	(not affected)
tla	source	(unstable)	1.3.5+dfsg-15	unimportant		560940
udunits	source	(unstable)	2.1.8-4	unimportant		560922
vnc4	source	(unstable)	(unfixed)	low		560949
vxl	source	(unstable)	1.13.0-2	low		560945
w3c-libwww	source	(unstable)	(unfixed)	low		551938
wxwidgets2.6	source	(unstable)	2.6.3.2.2-4	unimportant		560916
wxwidgets2.8	source	(unstable)	2.8.10.1-2	unimportant		560917
wxwindows2.4	source	(unstable)	(unfixed)	unimportant		560915
xmlrpc-c	source	(unstable)	(unfixed)	low		560942
xotcl	source	(unstable)	1.6.5-1.1	low		560950
xulrunner	source	(unstable)	(unfixed)	unimportant		560946

Notes

[etch] - w3c-libwww <no-dsa> (Minor issue, only used by fringe apps)
[etch] - python-xml <no-dsa> (minor issue)
[etch] - python-4suite <no-dsa> (Minor issue)
[lenny] - python-4suite <no-dsa> (Minor issue)
[etch] - tdom <no-dsa> (minor issue)
[etch] - ayttm <no-dsa> (minor issue)
[lenny] - ayttm <no-dsa> (minor issue)
[etch] - smart <no-dsa> (minor issue)
[lenny] - smart <no-dsa> (minor issue)
[etch] - xmlrpc-c <no-dsa> (minor issue)
[lenny] - xmlrpc-c <no-dsa> (minor issue)
- iceweasel <not-affected> (uses xulrunner; bug #560943)
- texlive-bin <not-affected> (Files are not compiled in, see #560948)
[etch] - vnc4 <no-dsa> (minor issue)
[lenny] - vnc4 <no-dsa> (minor issue)
[lenny] - xotcl <no-dsa> (minor issue)

Home - Testing Security Team - Debian Security - Imprint