[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.1103301936350.10609@arwen.otp.ericsson.se>
Date: Wed, 30 Mar 2011 19:42:29 +0200
From: <pan@...ang.org>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP
R14B02 -- multiple security fixes
Hi!
I can only answer for my fixes, answers for the rest will come from the
respective developer (hopefully soon :))
OTP-7178: Not a security issue, just a "bugfix", the "underflow" is
floating point conversion underflow, not buffer related.
OTP-8827: Definitely a security fix
OTP-8943: Also a security fix
Cheers,
/Patrik, OTP
On Wed, 30 Mar 2011, Jan Lieskovsky wrote:
> Hello Steve, vendors,
>
> based on:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=619857
>
> and:
> [2] http://www.erlang.org/download/otp_src_R14B.readme
> [3] http://www.erlang.org/download/otp_src_R14B01.readme
> [4] http://www.erlang.org/download/otp_src_R14B02.readme
>
> performed some initial issues review -- erlang-CVE-request.txt
> attached. But since not sure, which of those are real security
> flaws and how many CVE ids will be needed for those, Cc-ing
> also Erlang upstream developers to shed more light into this.
>
> The distribution of OTPs is as follows:
> =======================================
> Rickard Green: OTP-8810, OTP-8781, OTP-8925, OTP-9005, OTP-8999
> Bjorn-Egil Dahlberg: OTP-8814, OTP-8827, OTP-8943
> Sverker Eriksson: OTP-8945, OTP-8716
> Patrik Nyblom: OTP-7178, OTP-8780, OTP-8993
> Raimo Niskanen: OTP-8729, OTP-8795
> Bjorn Gustavsson: OTP-8831, OTP-8892, OTP-9117
> Niclas Axelsson: OTP-9101
> Hans Bolinder: OTP-8898
>
> Rickard, Bjorn-Egil, Sverker, Patrik, Raimo, Bjorn, Niclas, Hans,
> could you please have a look at the attached review file
> and reply which of the #20 OTPs in the list are security flaws
> (so we would know the count of CVE identifiers needed) and which
> are just bugs? (since you know the Erlang code better than me)
>
> Help / guidance from your side is really appreciated to resolve
> this one.
>
> Thank you in advance for your time and cooperation.
>
> Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
