Date: Wed, 24 Nov 2010 08:28:33 -0500 (EST) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: Petr Matousek <pmatouse@...hat.com>, coley@...us.mitre.org Subject: Re: CVE request: kernel: L2TP send buffer allocation size overflows ----- "Dan Rosenberg" <dan.j.rosenberg@...il.com> wrote: > There are not overflows in every send/recv call. The fix that > addresses these issues in l2tp also addresses any other possible > examples of this problem in other protocols, including CVE-2010-3859 > (heap overflow in TIPC). > The way CVE handles this is by flaw, not by fix. So if more flaws are found in other modules, but one fix cover them all, each individual flaw gets its own ID. Let me know if this isn't clear. Thanks. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ