[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51D78D5A.8090802@oracle.com>
Date: Fri, 05 Jul 2013 20:22:02 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
CC: Kurt Seifried <kseifried@...hat.com>, security@...e.de,
Sebastian Krahmer <krahmer@...e.de>
Subject: Re: Question about CVE for X!! DoS
On 07/ 5/13 01:50 PM, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> http://lists.opensuse.org/opensuse-updates/2013-07/msg00023.html
> https://bugzilla.novell.com/show_bug.cgi?id=815583
>
> Lists no CVE? I assume it needs one, or did upstream handle this?
Upstream discussion, including reps from both Red Hat & SuSE, determined
it didn't need a CVE, since it can only be triggered by a client authorized
to connect to the Xserver (via xauth, xhost, etc.) and such a client, by
design, can lock all other clients out from the server, kill clients, etc.
It would be like wanting a CVE for the fact that another process running
under your UID can kill your process.
Not sure why SuSE decided to go ahead and release it as a security fix
anyway - it's certainly a bug fix though.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - http://blogs.oracle.com/alanc
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
