[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140911163928.5c5c02a0@redhat.com>
Date: Thu, 11 Sep 2014 16:39:28 +0200
From: Tomas Hoger <thoger@...hat.com>
To: Ritwik Ghoshal <ritwik.ghoshal@...cle.com>
Cc: oss-security@...ts.openwall.com,
CVE Assignments MITRE
<cve-assign@...re.org>, secalert_us@...cle.com
Subject: Re: CVE Request: MySQL: MyISAM temporary file issue
On Wed, 10 Sep 2014 10:28:53 -0700 Ritwik Ghoshal wrote:
> Please use CVE-2014-4274 for this issue.
>
> Please send an email to secalert_us@...cle.com to contact Oracle for
> any security vulnerability related issues.
As pointed out in this Gentoo bug, release notes for the mentioned
MySQL versions list another issue that seems to be security:
https://bugs.gentoo.org/show_bug.cgi?id=518718
3) An off-by-one error related to certificate decoding in yaSSL can be
exploited to cause a buffer overflow.
BZR commit:
http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/4647
There are many other issues that deserve clarification. For example,
April CPU mentions client issue CVE-2014-2440. Is it the same issue
that got CVE-2014-0001 publicly assigned before? The versions that
fixed CVE-2014-2440 are the same that got CVE-2014-0001 fix, and there's
no mention of the CVE-2014-0001 in April CPU.
Actually, any CVE assigned to an open source project should have
sufficient details made available to make it possible to link it to
specific change or changes unambiguously. Despite previous requests,
Oracle seems to refuse that even when CVEs are public. At the same
time expecting advance notification with details. Maybe this should be
taken into account for e.g. distros membership?
--
Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
