[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1305110869.17177.267.camel@new-desktop>
Date: Wed, 11 May 2011 12:47:49 +0200
From: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request : client-side file creation via
XSLT in Webkit
Hi,
it seems that there's some confusion about these different CVE
identifiers. I'll try to clarify it :
- CVE-2011-1774 was affected to the Webkit bug #52688 by Josh Bressers
on May 9 (via oss-security and the private ticket). It seems to me to be
actually the best choice to track this vulnerability.
- CVE-2011-0195 was mistaken by Apple as affected internally to the
Webkit bug #52688. In fact, this CVE is affected to an information leak
about heap addresses, disclosed by Chris Evans. Unfortunately, this info
leak is also tracked as CVE-2011-1202. This is probably the
"Apple/Google confusion" Steve was talking about.
- CVE-2011-1425 was assigned on March 14 to a xmlsec vulnerability, at
my request. Both xmlsec and Webkit vulnerabilities have the same root
cause, which is unrestricted access to libxslt features like file
creation. In xmlsec, the vector is a "<ds:Transform>" tag in a signed
file. In Webkit, it could a XML file, a XHTML page or a SVG image.
In my opinion, having the same root cause isn't a sufficient reason to
affect the same CVE to both xmlsec and Webkit vulnerabilities.
Additionally, the fact that the xmlsec advisory about CVE-2011-1425
linked to a Webkit patch (in its **work-around** section) added some
more confusion.
So, i propose to :
- remove references to Webkit from the CVE-2011-1425 page
- affect CVE-2011-1774 to the Webkit bug #52688
Regards,
Nicolas Grégoire
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
