[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100824163948.75248326@redhat.com>
Date: Tue, 24 Aug 2010 16:39:48 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: pierre.php@...il.com, Thomas Biege <thomas@...e.de>,
Moritz Muehlenhoff
<jmm@...ian.org>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: PHP MOPS-2010-56..60
On Tue, 24 Aug 2010 11:34:42 +0200 Pierre Joye wrote:
> >> Done: http://svn.php.net/viewvc?view=revision&revision=302565
> >
> > Does it need a new CVE-ID?
[ .. ]
> Not sure as #24 was never fixed, but I don't know what is the policy
> in this case. I can use CVE-2010-2094 or a new one if it is more
> appropriate or cleaner.
Standard practice is to use new CVE. As all 5 phar MOPS were covered
under single CVE, and not all of them were fixed in 5.3.3, I'd expect a
new "incomplete fix" CVE.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
