oss-security - Re: CVE Request -- Squid v3.1.16 -- Invalid free by processing CNAME DNS record pointing to another CNAME record pointing to an empty A-record

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1320093282.17057.3.camel@henriknordstrom.net>
Date: Mon, 31 Oct 2011 21:34:42 +0100
From: Henrik Nordström <henrik@...riknordstrom.net>
To: kseifried@...hat.com
Cc: oss-security@...ts.openwall.com, Jan Lieskovsky <jlieskov@...hat.com>,
        "Steven M. Christey"
	 <coley@...us.mitre.org>,
        Jiri Skala <jskala@...hat.com>
Subject: Re: CVE Request -- Squid v3.1.16 -- Invalid free by
 processing CNAME DNS record pointing to another CNAME record pointing to an
 empty A-record

mån 2011-10-31 klockan 14:20 -0600 skrev Kurt Seifried:

> > Could you allocate a CVE id for this? (cc-ed Henrik and Jiri 
> > for their opinion / comments too, if this should be considered 
> > a security issue or not) 
> 
> I'd say so, in the past we have: CVE-2010-2951, CVE-2010-0639,
> CVE-2009-3700, etc. Lots of similar ones.

Agreed.

Regards
Henrik

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.