[gentoo-security] [GLVP 200403-01] Gentoo Linux Pending Vulnerabilities

[Tobias Weisserth]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Pending Vulnerabilities                     GLVP 200403-01
Unofficial Announcement
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                     glvp@×××××××××.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Abstract: This email is a compilation of known but unresolved
vulnerabilities and security issues in Gentoo Linux. This GLPV email
will be issued each Saturday as a reminder and warning for Gentoo users
about unresolved security critical bugs of packages in the Gentoo
Portage tree. This is an unofficial email, not associated with the
Gentoo Linux security team. Since I am far from perfect, this mail may
contain errors. Please report them if you spot them.

How to contribute: You can help make Gentoo an even better Linux
experience by contributing any bugs you notice to bugs.gentoo.org and
inform me about it. This is a guideline as how to contribute best:

Skim through security related channels like bugtraq, full-disclosure,
any announcements other distributions offer and security related media
and press reports.

Activate your curiosity: if you notice a package that might be included
in the Gentoo Linux Portage tree, confirm it's in Portage and check its
version in Portage (stable). Is an affected version in Portage? You may
need to check whether any patching has been done already. If in doubt,
assume that the bug still exists.

Browse the bugs in bugs.gentoo.org and see whether the issue is already
known. If the issue is already known but not included in any GLPV
announcement then please send me a mail at glpv@×××××××××.org and don't
forget to mention the bug identifier from Bugzilla. If the bug is not
yet in Bugzilla then enter it into Bugzilla. Include any external
reference in your Bugzilla entry and inform me about this new pending
vulnerability so I can include it here.

Comments, suggestions and reports about errors are welcome at
glpv@×××××××××.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

*****************
Package: Linux kernel
Versions: 2.2 up to and including 2.2.25, 2.4 up to to and including
2.4.24, 2.6 up to to and including 2.6.2
Subject: Linux kernel do_mremap VMA limit local privilege escalation
vulnerability
Risk: critical
Date: 01/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42024
Cross Reference:
http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

Description:

See the cross reference.

*****************

*****************
Package: Ethereal
Versions: 0.8.14 - 0.10.2
Subject: Multiple (13) Ethereal remote overflows discovered=20
Risk: critical
Date: 23/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45543
Cross Reference: http://security.e-matters.de/advisories/032004.html

Description:

See the cross reference.

*****************

*****************
Package: xfsdump
Versions: ?
Subject: xfsdump creates files insecurely
Risk: critical
Date: 10/04/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D19406
Cross Reference:
ftp://patches.sgi.com/support/free/security/advisories/20030404-01-P

Description:

xfsdq in xfsdump does not create quota information files securely, which
allows local users to gain root privileges.

*****************

*****************
Package: Firebird
Versions: ?
Subject: Environment Variable Buffer Overflow Vulnerability
Risk: critical
Date: 10/05/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D20837
Cross Reference: http://securityfocus.com/bid/7546/info/

Description:

Interbase is a database distributed and maintained by Borland. It is
available for Unix and Linux operating systems. As Firebird is based on
Borland/Inprise Interbase source code, it is very likely that Interbase
is prone to this issue also.

A buffer overflow has been discovered in the setuid root program
gds_inet_server, packaged with Firebird. This problem could allow a
local user to execute the program with strings of arbitrary length. By
using a custom crafted string, the attacker could overwrite stack
memory, including the return address of a function, and potentially
execute arbitrary code as root.

*****************

*****************
Package: imagemagick
Versions: ?
Subject: insecure temporary file
Risk: low/medium
Date: 27/06/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D24001
Cross Reference: http://www.debian.org/security/2003/dsa-331

Description:

See cross reference.

*****************

*****************
Package: OpenLDAP
Versions: ?
Subject: Denial of Service and other (non-security) fixes=20
Risk: critical
Date: 04/07/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D26728
Cross Reference: http://www.openldap.org/its/index.cgi?findid=3D2390

Description:

A failed password extended operation (password EXOP) can cause openldap
to, if using the back-ldbm backend, attempt to free memory which was
never allocated, resulting in a segfault. The back-bdb backend, on the
other hand, has a memory leak in the same code. Both conditions can be
triggered remotely.

See the Bugzilla entry for more information.

*****************

*****************
Package: Gentoo Portage
Versions: ?
Subject: emerge security - running as root and digital signatures
Risk: medium/high
Date: 08/02/2002
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D5902
Cross Reference: none

Description:

Running emerge as root is only necessary for the merge step. Unpacking,
setup and compilation should be done as a normal user (say, "nobody").
Merging should never overwrite an existing file without user
authorisation.

At the moment there are a couple of ways to get root from portage:

1) through a trojaned build process
2) through a trojaned source that gets installed and executed by root

Running the build process as a normal user avoids 1). Not overwriting
exist=
ing files avoids 2), unless the user is installing some new root
daemon/program, then they're screwed anyway.

*****************

*****************
Package: scorched3d
Versions: 36.2 and ?
Subject: format string crashes server and client
Risk: low/medium (denial of service)
Date: 24/01/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D39302
Cross Reference: none

Description:

games-strategy/scorched3d-36.2 suffers from a format string problem that
crashes   clients and servers. If this is used while playing standalone,
the client will crash. If this is used while playing on a server, the
server will crash, and all clients will be disconnected.

*****************

*****************
Package: 8139too driver
Versions: ?
Subject: 8139too driver icmp leak
Risk: high
Date: 01/06/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D24661
Cross Reference:
http://www.atstake.com/research/advisories/2003/a010603-1.txt

Description:

Multiple platform ethernet Network Interface Card (NIC) device
drivers incorrectly handle frame padding, allowing an attacker to view
slices of previously transmitted packets or portions of kernel memory.
This vulnerability is the result of incorrect implementations of RFC
requirements and poor programming practices, the combination
of which results in several variations of this information leakage
vulnerability.

*****************

*****************
Package: pam
Versions: ?
Subject: pam_console setup broken
Risk: critical
Date: 23/10/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D31877
Cross Reference: none

Description:

Reproducible: Always
Steps to Reproduce:
1. login in on on a virtual terminal as normal user
2. check permissions on pam_console managed devices
   for example:
   ls -l /dev/floppy/0
3. press <Ctrl><Alt><Del>
4. wait for comp to reboot
5. login on on any virtual terminal as root
6. repeat step 2

Actual Results:
/dev/floppy/0 is still owned by the last logged in user!
same problem with serial ports!
same problem with cdroms/zips/usb-storage devices/...
same prob with all devices managed by pam_console!!!

Expected Results:
devices should have ownership from devfsd.conf or root:root!

*****************

*****************
Package: FreeRadius
Versions: <=3D 0.9.3
Subject: rlm_smb module stack overflow vulnerability
Risk: critical
Date: 26/11/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D34424
Cross Reference: http://www.s-quadra.com/advisories/Adv-20031126.txt

Description:

See cross reference.

*****************

*****************
Package: irssi
Versions: 0.8.9 and ?, x86 not affected
Subject: remotely crash another user's irssi client
Risk: low/medium
Date: 11/12/2203
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D35614
Cross Reference: none

Description:

See Bugzilla entry.

*****************

*****************
Package: nscd
Versions: ?
Subject: nscd dns spoof attack
Risk: critical
Date: 01/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D40067
Cross Reference: none

Description:

nscd will reverse an IP address and later use the forward of it for
lookups allowing for spoof attack which can be used to gather passwords
and other data.

*****************

*****************
Package: xscreensaver
Versions: 4.14 and ?
Subject: file in /tmp, symlink attack
Risk: high/critical
Date: 11/02/2204
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D41253
Cross Reference: none

Description:

See Bugzilla entry.

*****************

*****************
Package: metamail
Versions: 2.2, 2.4, 2.5, 2.6, 2.7, possibly others
Subject: format string bugs and buffer overflows
Risk: critical
Date: 18/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42133
Cross Reference:
http://lists.netsys.com/pipermail/full-disclosure/2004-February/017539.html

Description:

See cross reference.

*****************

*****************
Package: msyslog
Versions: !=3D 1.09d or 1.08f
Subject: buffer overflows
Risk: critical
Date: 10/04/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42963
Cross Reference:
http://sourceforge.net/forum/forum.php?forum_id=3D267918

Description:

See Bugzilla entry.

*****************

*****************
Package: monit
Versions: < 4.1.1
Subject: remote vulnerability
Risk: critical
Date: 07/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D43967
Cross Reference: http://www.tildeslash.com/monit/

Description:

No description available.

*****************

*****************
Package: Unreal engine
Versions: ?
Subject: Format string bug in EpicGames Unreal engine
Risk: critical
Date: 10/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D44351
Cross Reference:
http://www.securityfocus.com/archive/1/356904/2004-03-08/2004-03-14/0

Description:

The problem is a format string bug in the Classes management.
Each time a client connects to a server it sends the names of the
objects it uses (called classes).

If an attacker uses a class name containing format parameters (as %n,
%s and so on) he will be able to crash or also to execute malicious
code on the remote server.

*****************

*****************
Package: clamav
Versions: < 0.70-rc
Subject: RAR DOS vulnerability
Risk: critical
Date: 22/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45357
Cross Reference: http://secunia.com/advisories/11177/

Description:

A vulnerability has been discovered in Clam AntiVirus, which can be
exploited by malicious people to cause a DoS (Denial-of-Service).

An unspecified error within the processing of certain RAR archives (e.g.
some of those generated by the Bagle virus) may cause a crash.

*****************

*****************
Package: GNU Automake
Versions: < 1.8.3
Subject: Insecure Temporary Directory Creation Symbolic Link
Vulnerability
Risk: high/critical
Date: 08/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45646
Cross Reference: http://www.securityfocus.com/bid/9816/info/

Description:

See cross reference.

*****************

*****************
Package: apache, mod_cgi
Versions: 2.0.47
Subject: Apache 2.0.47 & mod_cgi: denial of service
Risk: critical
Date: 31/07/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D29893
Cross Reference:
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=3D22030

Description:

If a cgi script under mod_cgi outputs more than 4096 bytes of stderr
before it finishes writing to and closing its stdout, the write() in the
cgi script containing the 4097th byte of stderr will hang indefinitely,
hanging the script's execution.

This appears to be cause by the fact that mod_cgi reads all stdout
output first, and then begins reading stderr output.  APR's file_io
which is handling the streams will only buffer 4096 characters before
further writes by the script to stderr will hang, waiting for mod_cgi to
read some of the data from the stream via APR file_io.

*****************

*****************
Package: courier-imap
Versions: see cross reference
Subject: Multiple Remote Buffer Overflow Vulnerabilities
Risk: critical
Date: 11/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45584
Cross Reference: http://www.securityfocus.com/bid/9845/info/

Description:

Multiple buffer overflow vulnerabilities have been identified in Courier
MTA, Courier SqWebMail, and Courier-IMAP. These vulnerabilities may
allow a remote attacker to execute arbitrary code on a vulnerable system
in order to gain unauthorized access.

*****************

*****************
Package: Mozilla
Versions: < 1.6
Subject: Cross-domain exploit on zombie document with event handlers
Risk: critical
Date: 25/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D43072
Cross Reference: http://www.securityfocus.com/archive/1/355233

Description:

When linking to a new page it is still possible to interact with the old
page before the new page has been successfully loaded (zombie document).
Any javascript events fired will be invoked in the context of the new
page, making cross site scripting possible if the pages belong to
different domains.

*****************

*****************
Package: fetchmail
Versions: <=3D 6.2.4
Subject: email denial of service
Risk: low/medium
Date: 16/10/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D37717
Cross Reference: http://xforce.iss.net/xforce/xfdb/13450

Description:

Fetchmail is a full-featured remote mail-retrieval and forwarding
utility for Unix that uses the POP3 and IMAP protocols. Fetchmail
version 6.2.4 is vulnerable to a denial of service attack. By sending a
specially-crafted email, a remote attacker can cause the program to
crash.

*****************

*****************
Package: RealOne Player and RealPlayer 8
Versions: ?
Subject: arbitrary code execution
Risk: critical
Date: 04/02/2004?
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D40469
Cross Reference:
http://www.service.real.com/help/faq/security/040123_player/EN/

Description:

RealNetworks, Inc. has recently been made aware of security
vulnerabilities that could potentially allow an attacker to run
arbitrary code on a user's machine.

The specific exploits were:

      * Exploit 1: To operate remote Javascript from the domain of the
        URL opened by a SMIL file or other file.
      * Exploit 2: To fashion RMP files which allow an attacker to
        download and execute arbitrary code on a user's machine.
      * Exploit 3: To fashion media files to create Buffer Overrun
errors.

While we have not received reports of anyone actually being attacked
with this exploit, all security vulnerabilities are taken very seriously
by RealNetworks. RealNetworks has found and fixed the problem.

*****************

*****************
Package: mpg123
Versions: ?
Subject: heap overflow, arbitrary code execution
Risk: high
Date: 06/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D40631
Cross Reference: http://www.debian.org/security/2004/dsa-435

Description:

A vulnerability was discovered in mpg123, a command-line mp3 player,
whereby a response from a remote HTTP server could overflow a buffer
allocated on the heap, potentially permitting execution of arbitrary
code with the privileges of the user invoking mpg123.  In order for
this vulnerability to be exploited, mpg321 would need to request an
mp3 stream from a malicious remote server via HTTP.

*****************

*****************
Package: Samba, Linux kernel
Versions: Samba 3.x, Linux kernel 2.6.x
Subject: Samba 3.x + kernel 2.6.x local root vulnerability
Risk: high
Date: 09/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D41800
Cross Reference: http://www.securityfocus.com/archive/1/353217

Description:

See cross reference.

*****************

*****************
Package: uudeview
Versions: < 0.5.20
Subject: buffer overflow vulnerabilities, remote arbitrary code
execution
Risk: high
Date: 02/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D44859
Cross Reference:
http://www.securitytracker.com/alerts/2004/Mar/1009291.html

Description:

It is reported that a remote user can create a malicious MIME file
(.mim, .uue, .uu, .b64, .bhx, .hqx, and .xxe extensions) that, when
processed by a target user, will cause UUDeview to crash or execute
arbitrary code. The code will run with the privileges of the target user
or application.

*****************

*****************
Package: MySQl
Versions: all
Subject: Symlink bug / tmpfile bug
Risk: low/medium
Date: 24/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45727
Cross Reference: http://nettwerked.mg2.org/advisories/mysqlbug

Description:

See cross reference.

*****************

*****************
Package: pwlib
Versions: < 1.6.0
Subject: multiple vulnerabilities allow remote DoS attacks and possibly
execution of arbitrary code
Risk: high
Date: 13/01/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45846
Cross Reference:
http://www.postincrement.com/openh323/nissc_vulnerabilty.html

Description:

See cross reference.

*****************

*****************
Package: iproute
Versions: ?
Subject: local denial of service attack
Risk: medium/high
Date: 24/11/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D34294
Cross Reference: http://rhn.redhat.com/errata/RHSA-2003-316.html

Description:

Herbert Xu reported that iproute can accept spoofed messages sent on the
kernel netlink interface by other users on the local machine. This could
lead to a local denial of service attack. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2003-0856 to
this issue.

*****************

*****************
Package: openhbci-plugin-ddvcard
Versions: ?
Subject: openhbci-plugin-ddvcard can destroy hbci-cards
Risk: critical
Date: 13/01/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D38201
Cross Reference:
http://sourceforge.net/mailarchive/forum.php?thread_id=3D3743892&forum_id=
=3D926

Description:

See cross reference (German) and Bugzilla entry.

*****************

*****************
Package: tcpdump
Versions: ?
Subject: denial of service, or possibly execute arbitrary
code as the 'pcap' user
Risk: medium/high
Date: 14/01/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D38206
Cross Reference: none

Description:

Tcpdump is a command-line tool for monitoring network traffic.

George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump
versions prior to 3.8.1.  The Common Vulnerabilities and Exposures
project
(cve.mitre.org) has assigned the name CAN-2003-0989 to this issue.

Jonathan Heusser discovered two additional flaws in the ISAKMP decoding
routines of tcpdump versions up to and including 3.8.1.

Remote attackers could potentially exploit these issues by sending
carefully-crafted packets to a victim.  If the victim uses tcpdump,
these
pakets could result in a denial of service, or possibly execute
arbitrary
code as the 'pcap' user.

Users of tcpdump are advised to upgrade to these erratum packages, which
contain backported security patches and are not vulnerable to these
issues.

*****************

*****************
Package: kdepim
Versions: from KDE 3.1.0 to 3.1.4
Subject: buffer overflow in the file information reader of VCF files
Risk: high/critical
Date: 14/01/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D38256
Cross Reference:
http://www.kde.org/info/security/advisory-20040114-1.txt

Description:

A carefully crafted .VCF file potentially enables local attackers to
compromise the privacy of a victim's data or execute arbitrary commands
with the victim's privileges.

By default, file information reading is disabled for remote files.
However, if previews are enabled for remote files, remote attackers may
be able to compromise the victim's account.

*****************

*****************
Package: dcron
Versions: 2.9
Subject: dcron installs init script suid 4755
Risk: medium
Date: 25/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42908
Cross Reference: http://dev.gentoo.org/~solar/misc/dcron-2.9-r2.diff

Description:

See Bugzilla entry.

*****************

*****************
Package: xine
Versions: ?
Subject: Symlink bug / tmpfile bug in xine-check and xine-bugreport
Risk: low/medium
Date: 19/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45448
Cross Reference: http://nettwerked.mg2.org/advisories/xinebug

Description:

See cross reference.

*****************

*****************
Package: phpBB
Versions: ?
Subject: Multiple vulnerabilities
Risk: critical
Date: 13/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45482
Cross Reference: http://www.securityfocus.com/bid/9865

Description:

See Bugzilla entry and cross reference.

*****************

*****************
Package: SquidGuard
Versions: <=3D 1.2.0
Subject: NULL URL Character Unauthorized Access Vulnerability
Risk: critical
Date: 19/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45491
Cross Reference: http://www.securityfocus.com/bid/9919/info/

Description:

Reportedly SquidGaurd is prone to a remote NULL URL character
unauthorized access vulnerability. This issue is due to a failure of the
application to properly filter out invalid URIs.

Successful exploitation of this issue may allow a remote attacker to
bypass access controls resulting in unauthorized access to
attacker-specified resources. This may allow the attacker to gain
unauthorized access to sensitive resources.

*****************

*****************
Package: Jetty
Versions: < 4.2.19
Subject: Unspecified Denial Of Service Vulnerability
Risk: high/critical
Date: 18/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45552
Cross Reference: http://www.securityfocus.com/bid/9917

Description:

See cross reference.

*****************

*****************
Package: oftpd
Versions: 0.3.6 and possibly others
Subject: remote DoS vulnerability
Risk: medium/high
Date: 04/03/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45738
Cross Reference: http://www.time-travellers.org/oftpd/oftpd-dos.html

Description:

Denial of service. An ftp server can be taken offline with a simple
telnet connection.

*****************

*****************
Package: libxml2
Versions: 2.6.x
Subject: URI Parsing Buffer Overflow Vulnerabilities
Risk: high/critical
Date: 24/02/2004
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42735
Cross Reference: http://secunia.com/advisories/10958/

Description:

Yuuichi Teranishi has discovered some vulnerabilities in libxml2, which
potentially can be exploited by malicious people to compromise a
vulnerable system.

The vulnerabilities are caused due to boundary errors in nanohttp and
nanoftp when parsing overly long URIs. This can be exploited to cause a
buffer overflow by supplying an overly long URI (about 4096 bytes).

Successful exploitation may potentially allow execution of arbitrary
code.

*****************

*****************
Package: inn
Versions: < 2.4.1?
Subject: ?
Risk: ?
Date: 17/09/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D29020
Cross Reference: none

Description:

See Bugzilla entry.

*****************

*****************
Package: mplayer
Versions: ?
Subject: /dev/misc/rtc permissions change & sysctl.conf addition
Risk: low/medium?
Date: 11/09/2003
Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D28486
Cross Reference: none

Description:

See Bugzilla entry.

*****************

If you spotted any errors or you're aware of additional
references/information, please drop me a note at glpv@×××××××××.org.

This list is far from complete. As of today it only contains entries
from Bugzilla that haven't been fixed yet. There are probably many
issues that haven't found their way into Bugzilla at all.


kind regards,
Tobias Weisserth


-- 
***************************************************
   ____  _____
  |  _ \| ____| Tobias Weisserth
  | | | |  _|   tobias@weisserth.[de|com|net|org]
 _| |_| | |___  http://www.weisserth.org
(_)____/|_____|
                
Encrypted mail is welcome.
Key and fingerprint: http://imprint.weisserth.org

***************************************************