[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201402041440.s14EeakG002993@linus.mitre.org>
Date: Tue, 4 Feb 2014 09:40:36 -0500 (EST)
From: cve-assign@...re.org
To: mmcallis@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com,
737385@...s.debian.org
Subject: Re: CVE request: a2ps insecure temporary file use
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://bugzilla.redhat.com/show_bug.cgi?id=1060630#c5
>
> * Fri Jan 05 2001 Preston Brown <pbrown@...hat.com>
> - security patch for tmpfile creation from Olaf Kirch <okir@....de>
>
> followed the next month by a fix to that patch:
>
> * Mon Feb 12 2001 Tim Waugh <twaugh@...hat.com>
> - Fix tmpfile security patch so that it actually _works_ (bug #27155).
Does anyone have information indicating that two CVE-2001-#### IDs are
needed to cover the discoveries by Olaf Kirch and Tim Waugh 13 years
ago? This would be the case if, for example, there was a January 2001
a2ps package that fixed part of the problem with temporary files.
Admittedly, the practical value of two CVE-2001-#### IDs at present
may be extremely small.
The information does not seem to be in a2ps.git because data before
2004 is unavailable, e.g.,
http://pkgs.fedoraproject.org/cgit/a2ps.git/log/?ofs=100
Also:
https://bugzilla.redhat.com/show_bug.cgi?id=27155
You are not authorized to access bug #27155.
If (as we would expect) nobody is interested in checking that, we will
assign one CVE-2001-#### ID.
Finally, the earlier abstraction question is no longer relevant
because Jakub Wilk is apparently not the original discoverer of any
part of the problem. Specifically, this question:
The original report notes there are calls to tempname_ensure(). If any
of those are found to be vulnerable, would they use the same CVE number,
or require a different one?
would only apply to a situation in which the spyname problem was a new
discovery in 2014.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS8PuRAAoJEKllVAevmvmsavAH/35erOpFeVh3fjUXXGdlJBVN
XzXwdKV6e+joCBJ2hYQ8+os5c19zFNdYcoAz8ay4DKdD9wEHUUiDjZDAhG1rWmDW
ji3I8Bbi3aMmZwaKqJwv3GYWVAOr6QzTuvKJoPVl835jF7Od1FUWeEaMPPqZmI9s
mwPp4eC4CjlVz8ldCgZdU+tiUZojJjl5wFBn/lnYsdfLisJ5mCi1YScMt3p5zZVE
FkXNu5MhFLEtfeQF2BUe3HLsk/UtNEq8T0cMsaNdIbckkFGKxiNiRfK8QGBHGRIp
KuFEoEufFAT0BNRMvHix4MFbYT+a2SKuC5lbrRa7jbyMWh9meRxze/s9UePtEno=
=cx5F
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
