oss-security - Re: Re: TORCS 1.3.2 xml buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAB9ZNAyjGOkUjT-ehDxiWVC1vvdqrGGbj86fvzHdThEg3v8NrQ@mail.gmail.com>
Date: Fri, 9 Mar 2012 09:13:26 -0500
From: Andres Gomez <agomez@...idsignal.com>
To: Tomas Hoger <thoger@...hat.com>
Cc: oss-security@...ts.openwall.com, Kurt Seifried <kseifried@...hat.com>, 
	"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: Re: TORCS 1.3.2 xml buffer overflow - CVE-2012-1189

2012/3/6 Tomas Hoger <thoger@...hat.com>

>
> Their code bases may differ significantly in other parts, but it seems
> the affected vulnerable code is still identical between the two.
> Following are versions shortly before fixes got committed:
>
>
> http://torcs.cvs.sourceforge.net/viewvc/torcs/torcs/torcs/src/modules/graphic/ssggraph/grsound.cpp?revision=1.31.2.2&view=markup
>
> http://speed-dreams.svn.sourceforge.net/viewvc/speed-dreams/trunk/src/modules/graphic/ssggraph/grsound.cpp?revision=4146&view=markup
>
> In cases like this, same CVE is used for all project that use / embed
> the same affected code.
>

 Ok, understood, thanks.



> Write up the description and send it to Mitre =).
>
>   I already did, I sent details but they have not disclosed them in web
> page http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1189, maybe i
> used a wrong email address (cve-assign@...re.org).
>
>

 So, what Mitre's email could I send CVE-2012-1189 details?

Regards

Andres Gomez

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.