[VIM] Symantec advisory CVE question/confusion

[security curmudgeon]

In reference to the following advisory, the revision history doesn't 
include dates, and it doesn't indicate which information was wrong now:

http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html

Revision History
Removed invalid CVE information

--

The advisory above is for "two vulnerabilities" in the Decomposer 
component. The following two CVE entries seem to match:

CVE-2007-3801
CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html
RAR archive file header infinite loop DoS

CVE-2007-3802
CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html
CAB archive arbitrary code execution

The following two ZDI advisories also seem to match, but list two 
different CVE numbers, both in reserved status. I have a hunch that these 
numbers were the ones removed from the Symantec advisory and are now 
essentially duplicates (or will be rejected in favor of the ones above):

http://www.zerodayinitiative.com/advisories/ZDI-07-040.html
CVE-2007-0447
http://www.symantec.com/avcenter/security/Content/2007.07.11f.html
CAB parsing heap overflow

http://www.zerodayinitiative.com/advisories/ZDI-07-039.html
CVE-2007-3699
http://www.symantec.com/avcenter/security/Content/2007.07.11f.html
RAR archive DoS


Can Symantec or CVE confirm this?

Brian
OSVDB.org