[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0803271831470.14208@faron.mitre.org>
Date: Thu, 27 Mar 2008 18:34:02 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>,
Jonathan Smith <smithj@...ethemallocs.com>
Subject: Re: firefox 2.0.0.13
On Thu, 27 Mar 2008, Josh Bressers wrote:
> > Any idea on what Mozilla means by using CVE-2008-1240 in MFSA 2008-18?
> > They already list CVE-2008-1195, which is associated with the Sun
> > advisory, and that seems like the only issue they're really trying to
> > address.
> >
>
> That's the one I mailed you about back when I was assigning the CVE ids ;)
Oh, that was like 300 CVE's ago ;-)
> The Mozilla advisory doesn't clarify that CVE-2008-1195 is the Sun CVE id
> for their java advisory:
> http://sunsolve.sun.com/search/document.do?assetkey=1-66-233326-1
The CVE itself clarifies this, so I guess that's kind of OK.
> This flaw is now fixed in both Java and Firefox (it's debatable who is at
> fault here, both the browser and the JRE were doing silly things).
>
>
> As you gave me the advice that since the codebases are different, they
> should get separate ids. We can always yank CVE-2008-1240 if you wish and
> I'll see about getting upstream to remove it from the advisory.
No, I'll keep them split, given the rationale that it's arguably both
their fault. I'll try to clarify that in the description for
CVE-2008-1240.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
