[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20130716184934.AC832600E5@smtp.hushmail.com>
Date: Tue, 16 Jul 2013 18:49:34 +0000
From: "mancha" <mancha1@...h.com>
To: oss-security@...ts.openwall.com, jlieskov@...hat.com
Cc: coley@...us.mitre.org
Subject: Re: CVE Request -- kde-workspace 4.10.5 fixing two security flaws
On Tue, 16 Jul 2013 15:50:25 +0000 "Jan Lieskovsky" wrote:
>Hello Kurt, Steve, vendors,
>
> while not listed in the announcement:
> [1] http://www.kde.org/announcements/announce-4.10.5.php
>
>looks like kde-workspace v4.10.5 fixed two security flaws
>(the second one a minor one):
>
>* Issue #1 - Possible NULL pointer dereference in KDM and
>KCheckPass when glibc 2.17 (eglibc 2.17) or FIPS enabled system
>used
> Bug: https://git.reviewboard.kde.org/r/111261/
> Relevant patches:
> https://projects.kde.org/projects/kde/kde-
workspace/repository/revisions/45b7f137fbc0b942fd2c9b4e8d8c1f0293e64
ba7
> https://projects.kde.org/projects/kde/kde-
workspace/repository/revisions/7777194da6154375fc8103b8c4e29e385cd7a
e2e
Hi Jan et al.
Actually, issue #1's fix (CVE-2013-4132) just missed the
tag/release
deadline for 4.10.5 by a day or two. The FIXED-IN entry in the
revision comment is inaccurate.
Distribs, when upgrading to kde-workspace 4.10.5, should apply
https://projects.kde.org/projects/kde/kde-
workspace/repository/revisions/45b7f137fbc0b942fd2c9b4e8d8c1f0293e64
ba7.
Best,
--mancha
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
