[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150205172017.65F516C0032@smtpvmsrv1.mitre.org>
Date: Thu, 5 Feb 2015 12:20:17 -0500 (EST)
From: cve-assign@...re.org
To: hanno@...eck.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> There are more such issues, I haven't tested them in php:
> http://bugs.gw.com/view.php?id=409
> http://mx.gw.com/pipermail/file/2014/001649.html
Our initial thought is that the 001649.html disclosure occurred first,
and has a single root cause that also applies to id=409. So, we don't
think that id=409 can have its own separate CVE ID, even though the
id=409 report contained additional detail.
Use CVE-2014-9653 for the entire "readelf.c uses pread() ... it's
happy with partial reads and valgrind show various errors" report
fixed by "file has been changed to bail out when pread() returns
partial buffers."
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJU06XtAAoJEKllVAevmvms2QQIAIxDhtDG27FFsr8hsZQMJYqa
4Jk9r2vXKb8hmM/xenVWmCwHxz67UjZ3wgL5lU6z5hJMRaLfR4tddIhhgK+I+9p/
MslcATfZyBzal1uXaiiN81sYs+PPUdWYf9wCaI/j+F8O9sl2690OeSUOn+S3T8vf
ZyMV2DIJnDYVo4TK+6xjuYnk1Tcq2sqvWO5BK07+pNAbtsWk4TikurSEuBc1KLSD
TJ6LBOgf/HZPGqCx3PX+oKP/oN/OPP5mp31qM5A8RNjt3gYoqNhDQQ4uo7lYTUCH
xy14S2XfNwvD+YNhBam1Vn+5+MxNqiEjuoOQ1ztP5Jb86A8fQdyfxS0lyVWSn18=
=WfCL
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
