[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1109021135030.7465@faron.mitre.org>
Date: Fri, 2 Sep 2011 11:39:12 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: ffmpeg issues
For context, CVE-2011-2162 was assigned because of Mandriva's reference to
"several additional vulnerabilites originally discovered by Google Chrome
developers were also fixed with this advisory" without any reference to a
CVE identifier.
For CVE-2011-2160, http://ffmpeg.mplayerhq.hu/ includes a changelog.
CVE-2011-2160 was built from the March 17, 2011 entry:
"Reinhard Tartler
backported several security fixes to the 0.5 release branch and made
another point release, that is 0.5.4. Note, 0.5 is quite old and this
release is mostly for those stuck with the 0.5 branch, and not so
interesting for end users. ... Changelog between 0.5.3 and 0.5.4 ...
Fix invalid reads in VC-1 decoding (related to CVE-2011-0723)."
This suggests that the vendor may have fixed an issue related to
CVE-2011-0723, but not CVE-2011-0723 itself. The other items in the
20110317 changelog map directly the CVE names, without a "related to"
qualifier. This triggers a SPLIT.
- Steve
On Fri, 2 Sep 2011, Michael Gilbert wrote:
> Hi,
>
> We're trying to figure out the status of ffmpeg in debian [0]. Does
> anyone have any real info on CVE-2011-2160 (whose CVE page is in
> essence completely empty) [1]. BTW, how is a link to the software's
> homepage considered a confirmation of the issue?
>
> Also, CVE-2011-2162 [2] seems to be a rehash of a bunch of CVE ids
> that happened to be in the recent dump of Mandriva advisories.
> Shouldn't this get REJECTED since its just a collection of already
> known and tracked issues?
>
> Thanks,
> Mike
>
> [0] http://lists.debian.org/debian-security-tracker/2011/08/msg00009.html
> [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2160
> [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2162
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
