[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20130115174912.GA15905@inutil.org>
Date: Tue, 15 Jan 2013 18:49:12 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Curl insecure usage
On Tue, Jan 15, 2013 at 01:22:09AM -0700, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 12/25/2012 04:07 AM, Moritz Mhlenhoff wrote:
> > On Thu, Nov 29, 2012 at 02:49:58PM -0700, Kurt Seifried wrote:
> >>>> Also can someone collate and post a list of all the other
> >>>> apps using curl insecurely and need CVE's with appropriate
> >>>> links to the upstreams/etc? Thanks.
> >>>
> >>> There are some, which are potentially affected, but where
> >>> discussion with upstream is still pending.
> >>>
> >>> Shall we go ahead and post them or do you prefer to have them
> >>> sorted out with upstream first?
> >>>
> >>> Cheers, Moritz
> >>>
> >> I trust you. Course if you mess up and I assign a bad CVE Steve
> >> beats me with a stick... ;)
> >
> > Sorry for the late followup and merry christmas to you!
> >
> > There are two more issues related to this, which require CVE IDs
> > (both also discovered by Alessandro Ghedini <ghedo@...ian.org>:
> >
> > 1. In the implementation of the Falcon programming language:
> > (http://www.falconpl.org/)
> >
> > 2. In nuSOAP (http://sourceforge.net/projects/nusoap/)
> >
> > I'll post links with details to the Debian bugs once they've been
> > filed.
Here we go:
CVE-2012-6070 (falconpl):
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696681
CVE-2012-6071 (nusoap)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696707
Cheers,
Moritz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
