[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120519184707.GA8073@kludge.henri.nerv.fi>
Date: Sat, 19 May 2012 21:47:07 +0300
From: Henri Salo <henri@...v.fi>
To: Touko Korpela <touko.korpela@....fi>
Cc: fabrice.fontaine@...nge.com, oss-security@...ts.openwall.com
Subject: Re: libupnp buffer overflows
On Fri, May 18, 2012 at 10:22:52PM +0300, Touko Korpela wrote:
> On Fri, May 18, 2012 at 08:43:52PM +0200, Florian Weimer wrote:
> > * Touko Korpela:
> >
> > > Upstream changelog for libupnp (/usr/share/doc/libupnp6/changelog.gz) lists
> > > many fixes for buffer overflows in version 1.6.16. Should this be added to
> > > tracker and check if CVE number is allocated?
> >
> > It seems that the list of issues is fairly long. Have you got a list
> > of source code commits?
>
> Unfortunately, no. I only noticed this from the changelog.
> Maybe maintainer and/or upstream can tell if this can be exploited.
Fabrice replied:
"""
Those issues were found by Coverity (http://www.coverity.com). Coverity affects CWE identifiers like CWE-170 but I haven't kept the CWE identifiers of all the fixed bugs.
"""
Did you Fabrice verify if these had security impact? I can try to help if needed.
- Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
