[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150519101645.GB4245@kronk.local>
Date: Tue, 19 May 2015 12:16:45 +0200
From: Alessandro Ghedini <alessandro@...dini.me>
To: oss-security@...ts.openwall.com
Subject: Re: CVE reject request CVE-2015-8146/8147 (was:
[CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL)
On Tue, May 19, 2015 at 09:05:59AM +0200, Tomas Hoger wrote:
> On Tue, 5 May 2015 09:19:20 +0100 Pedro Ribeiro wrote:
>
> > tl;dr heap and integer overflows in ICU, many packages affected,
> > unknown if these can be exploited or not - everyone names vulns
> > nowadays, so I name these I-C-U-FAIL.
>
> ...
>
> > #1 Vulnerability: Heap overflow
> > CVE-2014-8146
>
> ...
>
> > #2 Vulnerability: Integer overflow
> > CVE-2014-8147
>
> Apparently a typo was made when fixing these issues in Ubuntu and
> subsequently in Debian when ids with year 2015 were used instead of
> 2014.
Note that as far as Debian is concerned, the only place where incorrect IDs
were used is the bug report you linked (which has now been fixed). The
changelog of the upload to Debian unstable had the correct IDs, and we haven't
released a DSA yet (the information on our security tracker is also correct).
Cheers
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
