[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <564B501E.5040401@oracle.com>
Date: Tue, 17 Nov 2015 08:04:46 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
CC: "X.Org Security Team" <xorg-security@...ts.x.org>
Subject: Re: suckless sent and libxft-dev 2.3.2-1 crash
On 11/16/15 02:47 PM, Simon . wrote:
> please review, whether this needs a CVE.
I can't speak for Mitre or any other CNA's, but I can speak for the
security team at X.Org, which is responsible for libXft and would
need to put out a security advisory if there is a CVE in it.
From our point of view, there's too little information here to
determine, and that's after I went out and tracked down what the
hell "sent" does (when asking for CVE's for programs that aren't
very popular and have names that are hard to google because they're
also common words, it helps to provide some background). It's also
generally useful to have a root cause determined first, so someone
knows which software to track the CVE against - would this be a CVE
against libXft for mishandling data, or a CVE againt the "sent"
program or some other library for not adequately verifying data from
a source it shouldn't have trusted? Is libXft actually at fault or
is it the victim of memory corruption that happened before the call?
Is there any trust or privilege boundary being crossed here?
If a user can crash a program running as themselves, it's a bug,
but they can also kill -SEGV it, so it's not letting them do anything
they shouldn't be able to.
Why do you think this might deserve a CVE?
--
-Alan Coopersmith- alan.coopersmith@...cle.com
X.Org Security Response Team - xorg-security@...ts.x.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
