[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <54C2BF6D.8020901@mozilla.com>
Date: Fri, 23 Jan 2015 16:38:53 -0500
From: David Lawrence <dkl@...illa.com>
To: security@...zilla.org,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: CVE request for BZ
Sorry not explicit in the sec adv but you are correct. No exploit has been reported
regarding the webservices changes and was just to prevent such problems in the
future. The methods that were unintentionaly accessible were all relatively harmless.
We added the safeguard in case other modules were imported in the future which could
possibly give out sensitive data unintentionally.
Thanks
dkl
On 01/23/2015 04:29 PM, Kurt Seifried wrote:
> http://www.bugzilla.org/security/4.0.15/
>
> one has a CVE, and this one does not:
>
> Class: Information Leak
> Versions: 2.23.3 to 4.0.15, 4.1.1 to 4.2.11, 4.3.1 to 4.4.6, 4.5.1 to
> 4.5.6
> Fixed In: 4.0.16, 4.2.12, 4.4.7, 5.0rc1
> Description: Using the WebServices API, a user can possibly execute imported
> functions from other non-WebService modules. A whitelist
> has now
> been added that lists explicit methods that can be executed
> via the
> API.
> References: https://bugzilla.mozilla.org/show_bug.cgi?id=1090275
>
> was this classed as hardening hence no CVE? E.g. has no exploit been
> found, or?
>
--
David Lawrence
dkl@...illa.com
bugzilla.mozilla.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
