Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 24 Nov 2011 17:32:36 +0100
From: Petr Matousek <>
To: Tavis Ormandy <>
Subject: Re: Re: Please REJECT CVE-2011-4112

On Thu, Nov 24, 2011 at 05:21:01PM +0100, Tavis Ormandy wrote:
> Petr Matousek <> wrote:
> > Hi,
> > 
> > could you please reject CVE-2011-4112 as it is not a security bug.
> > 
> > Reference:
> > 
> > Thank you,
> Unrelated, but if it did not require CAP_NET_ADMIN, would you have
> considered it a security bug?


> I was under the impression that there was general agreement that NULL derefs
> that are handled gracefully are not security bugs any more.
> Is this because you're setting panic_on_oops?

Yes. That's the default in RHEL.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.