[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20140314191724.GB19956@suse.de>
Date: Fri, 14 Mar 2014 20:17:24 +0100
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request for a bug in gnu coreutils 8.22
Hi,
Can this be used in any form where people will put in untrusted data?
In my feeling ... not really.
Ciao, Marcus
On Fri, Mar 14, 2014 at 11:35:40PM +0800, Qixue Xiao wrote:
> I am not sure whether this needs a CVE.
>
>
> this bug will result an illegal memory access, which may be leak
> information without authority.
>
> and the author had fixed it after my report.
>
> please see:
> http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16855
>
>
> ### Bug overview
>
> shuf -er or shuf -eer [ segment fault]
> impact [coreutils 8.22 ]
>
> ```
> [15:03:59]xqx <at> server:~/data/xqx/projects/coreutils-8.22$
> ./obj-gcov/src/shuf -er
> Segmentation fault (core dumped)
>
> ```
>
> thanks
> .
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
