oss-security - Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130227200813.GC23388@kroah.com>
Date: Wed, 27 Feb 2013 12:08:13 -0800
From: Greg KH <greg@...ah.com>
To: Solar Designer <solar@...nwall.com>, oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based
 buffer overflow

On Wed, Feb 27, 2013 at 07:26:39PM +0100, Petr Matousek wrote:
> On Wed, Feb 27, 2013 at 10:05:20AM -0800, Greg KH wrote:
> > On Wed, Feb 27, 2013 at 05:13:06PM +0100, Petr Matousek wrote:
> > > On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> > > > On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > > > > For starters, security@...nel.org submissions should be posted to
> > > > > oss-security or any other security related public mailing list when
> > > > > the
> > > > > patch is being committed.
> > > > 
> > > > That's not going to happen, and you know that, to do so would be
> > > > totally
> > > > irresponsible of us and directly harm your users.  That's what
> > > > vendor-sec (or whatever it is called now) is for.
> > > 
> > > linux-distros [1] is vendor-sec replacement for Linux related issues.
> > > 
> > >   [1] http://oss-security.openwall.org/wiki/mailing-lists/distros
> 
> Greg, FYI. The linux-distros mailing list has strict rules about the
> maximum embargo period. It is ~14 days. I hope that ~14 days are
> acceptable as a grace period for you when the commit goes public. At the
> end of the embargo period the info is always sent to oss-sec with CVE id
> assigned. 

That's fine with me.

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.