oss-security - Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20150327234640.B2FE942E03C@smtpvbsrv1.mitre.org>
Date: Fri, 27 Mar 2015 19:46:40 -0400 (EDT)
From: cve-assign@...re.org
To: ch3root@...nwall.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Aren't you usually combine similar issues into one CVE anyway? Same
> reported type ("stack corruption"

In this context, we don't look at stack corruption as a "type."

In general, the number of assigned CVE IDs can depend on both the
inline text of the oss-security request message as well as other
information that may be available at relatively low cost.

Here's are two examples. (We'll use "integer underflow" in the
examples even though that can be vague as discussed in the
http://cwe.mitre.org/data/definitions/191.html Alternate Terms.)

Real example in open-source FreeXL code:

  #1:  A flaw was found in the way FreeXL reads sectors from the input
  file. A specially crafted file could possibly result in stack
  corruption

  #3: A flaw was found in the way FreeXL handles a premature EOF. A
  specially crafted input file could possibly result in stack corruption

  Both of these say "stack corruption." However, #1 is about
  "workbook->sector_end <= (workbook->p_in - workbook->sector_buf)" -
  the unpatched code omitted a necessary test for an integer
  underflow. #3 is not related to an integer underflow.

Hypothetical example:

  ClosedSourceProduct 1.1 changelog

  1.1 is a mandatory security update to address these two
  stack-corruption issues:

  - fixed an integer underflow vulnerability (Bug #123)

  - fixed an EOF handling vulnerability (Bug #456)

If reasonably possible, we want the number of CVE IDs to be the same
in the open-source example and the closed-source example.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVFetpAAoJEKllVAevmvmsUJMH/3KHjKjnHuImmwWv5iYgi5tG
+PeUg+IdgDDdgOgbtX0zYSDghlQBu5oqVWXtetpCM1Kp8E7PaX5QiZGj23qQHS24
E2ipxyi6dWTH3dD6vw1kgPGg3n+neqe2sBii7AZru5S6jKsxcv398y4Xh2aF0h9S
H3uVHb+AOaXr85Zt2mwgCPesYhxnds5vo1U80yWi5jHW+52RaSIAwCLYs8UaDnv6
sflKup1D+t2Prj3QTfjk7o+c7iBhGaCgIQEwOlVLqwnUpgTWHbopiDrQe3y6eR7n
FlwWRkCRYPyDNvuwLnV+IlGmPI25vrZ7cH1bHZEFhwjepiikuBPFyO9d4C9DRhU=
=Jm7d
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.