[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150429222524.9F17634E054@smtpvbsrv1.mitre.org>
Date: Wed, 29 Apr 2015 18:25:24 -0400 (EDT)
From: cve-assign@...re.org
To: martijn@...aard.eu
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request libaxl <= 0.6.9
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I'm coordinating this together with the developers of libaxl (which
> will release a fix later today).
>
> Because of a bug in the memory allocator of libaxl can the parsing of
> a specially crafted xml document result in a heap overflow.
>
> There is at least 1 known case where an application uses libaxl to
> parse incoming user supplied xml data, unauthenticated and over the
> network. In the best situation this results in DoS by memory
> corruption, but RCE is for a (skilled) attacker most likely within
> range.
Use CVE-2015-3450.
> I hope this is all the information you need, as this is my first CVE
> request
As suggested at the end of the
http://openwall.com/lists/oss-security/2015/04/16/17 post, the
approach you're using (writing to oss-security about a case where the
source-code details of the bug remain private) typically should be
accompanied by a link between the oss-security thread and any later
disclosure.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVQVnOAAoJEKllVAevmvmsbUQH/RE8R3e2JFAQ/qYE+aDjquWT
zvtVGevx+rpjdQewbkZ6d4G1g7YhKtDzwq9I3lfGLo/expVZ/Zjynb7+hr8G+8V8
c5hb/IcQ/4ieTn9avVxwDIdbRJsqAcULpeEek2nMUT9eZAdY7VfjVEzjZG2HTvB9
MXr6oAU4Q0pV/lb4TLZkKfYh79NkXKP5EQCnK0WASqtfEABvSJfz1lPSP7FazlMu
Fl4zNlJ9m2Er3xCCNQNb5x5gFGIyoFHLKyyrzzw1Jy1tPUKrdD8tbGLjftMzsK9E
HazmqoNgwiBw/jnXpzdMggU3LYk5t2hN0A6DScgI1agIWXnot3Kbvpny1fGYjpU=
=NDXC
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
