Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 24 Nov 2010 08:28:33 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Petr Matousek <pmatouse@...hat.com>, coley@...us.mitre.org
Subject: Re: CVE request: kernel: L2TP send buffer allocation
 size overflows


----- "Dan Rosenberg" <dan.j.rosenberg@...il.com> wrote:

> There are not overflows in every send/recv call.  The fix that
> addresses these issues in l2tp also addresses any other possible
> examples of this problem in other protocols, including CVE-2010-3859
> (heap overflow in TIPC).
> 

The way CVE handles this is by flaw, not by fix. So if more flaws are found
in other modules, but one fix cover them all, each individual flaw gets its
own ID.

Let me know if this isn't clear.

Thanks.

-- 
    JB

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ