[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTi=-3vCNGVnJW1XCsKUm0MH2+a_iQUmrt4OgSPRU@mail.gmail.com>
Date: Mon, 23 Aug 2010 16:24:53 +0200
From: Pierre Joye <pierre.php@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: PHP MOPS-2010-56..60
hi,
Can you send me a list of the MOPS CVE please? I'm missing some and I
would like to update the NEWS file accordingly.
Cheers,
On Fri, Aug 20, 2010 at 6:59 PM, Steven M. Christey
<coley@...us.mitre.org> wrote:
>
> Apologies to everyone, especially Moritz who pinged me on this privately a
> while ago.
>
> Some of these CVEs are SPLIT based on very narrow distinctions between types
> of buffer overflows, where others might have merged. This is one area where
> there can be some variability in CVE assignments depending on the amount of
> available information.
>
>
> CVE-2010-3062
>
> - MOPS-2010-056, MOPS-2010-057
> - buffer overflow with untrusted length
>
> CVE-2010-3063
>
> - MOPS-2010-058
> - buffer overflow with calculation error
>
> CVE-2010-3064
>
> - MOPS-2010-059
> - classic overflow
>
> CVE-2010-3065
> - MOPS-2010-060
> - session deserializer data injection
>
>
>
> - Steve
>
--
Pierre
@pierrejoye | http://blog.thepimp.net | http://www.libgd.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
