[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 2 Sep 2011 17:36:29 -0400
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...-smtp.mitre.org>
Subject: Re: ffmpeg issues
Steven M. Christey wrote:
>
> For context, CVE-2011-2162 was assigned because of Mandriva's reference to
> "several additional vulnerabilites originally discovered by Google Chrome
> developers were also fixed with this advisory" without any reference to a
> CVE identifier.
Isn't this just CVE-2011-1198 then (which is suspiciously missing from
that set of security announcements)? CVE-2011-1198 was assigned on
March 30th, which certainly could have been referenced in the Mandriva
advisories, they just missed it I guess? Given this kind of
carelessness, I think we should err on the side of not issuing new
ids based on ill-defined text like this future Mandriva advisories.
> For CVE-2011-2160, http://ffmpeg.mplayerhq.hu/ includes a changelog.
> CVE-2011-2160 was built from the March 17, 2011 entry:
>
> "Reinhard Tartler
> backported several security fixes to the 0.5 release branch and made
> another point release, that is 0.5.4. Note, 0.5 is quite old and this
> release is mostly for those stuck with the 0.5 branch, and not so
> interesting for end users. ... Changelog between 0.5.3 and 0.5.4 ...
> Fix invalid reads in VC-1 decoding (related to CVE-2011-0723)."
>
> This suggests that the vendor may have fixed an issue related to
> CVE-2011-0723, but not CVE-2011-0723 itself. The other items in the
> 20110317 changelog map directly the CVE names, without a "related to"
> qualifier. This triggers a SPLIT.
This may just be a wording choice. We have more discussion going on
right now [0], so hopefully we'll get it resolved there.
Best wishes,
Mike
[0] http://lists.debian.org/debian-security-tracker/2011/08/msg00009.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
