LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.

1. ffmpeg/libav out of array write in AMV parsing

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624339 http://seclists.org/bugtraq/2011/Apr/257 http://git.videolan.org/?p=ffmpeg.git;a=commit;h=89f903b3d5ec38c9c5d90fba7e626fa0eda61a32 Use CVE-2011-1931 2. widelands directory traversal

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617960 http://bazaar.launchpad.net/~widelands-dev/widelands/build-15/revision/5021 Use CVE-2011-1932 3. SQL injection in Jifty::DBI

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622919 http://lists.jifty.org/pipermail/jifty-devel/2011-April/002426.html Use CVE-2011-1933 4. lilo: lilo-uuid-diskid makes lilo.conf world-readable

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615103 Use CVE-2011-1934 5. libpcap packet truncation

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=623868 http://thread.gmane.org/gmane.network.tcpdump.devel/5018 Use CVE-2011-1935

Thanks.

-- JB