[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CANO=Ty1JVZUA4u-3cX4UgyfaZ5JMTowDeF_nmkRPKmzN0Ew9SQ@mail.gmail.com>
Date: Fri, 27 Nov 2015 13:41:54 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>, CVE ID Requests <cve-assign@...re.org>,
cve-editorial-board-list <cve-editorial-board-list@...ts.mitre.org>
Subject: Major outstanding CVE requests
So we have a number of PCRE issues that need CVE's and a git issue that
needs a CVE (at this point we've actually shipped an update for it, most of
these requests are more than a month old, and several are 2-3 months old.
Red Hat needs CVE's for these, as do other vendors I'm sure. I know it's
thanksgiving in the USA right now, but the backlog is becoming a problem.
Can I have permission from Mitre to assign CVE's to these issues?
Git:
http://seclists.org/oss-sec/2015/q4/37
asked for Oct 5, pinged recently, still no answer.
PCRE:
======
https://blog.fuzzing-project.org/29-Heap-Overflow-in-PCRE.html
http://seclists.org/oss-sec/2015/q4/363
Appart from that a couple of other vulnerabilities found by other
people have been fixed in this
release:https://bugs.exim.org/show_bug.cgi?id=1672
Heap overflow in compile_regexhttps://bugs.exim.org/show_bug.cgi?id=1515
Stack overflow in compile_regexhttps://bugs.exim.org/show_bug.cgi?id=1667
Heap overflow in compile_regex
======
More PCRE:
======
http://seclists.org/oss-sec/2015/q4/364
The other unassigned issues already have open CVE requests:
https://bugs.exim.org/show_bug.cgi?id=1503
-> http://www.openwall.com/lists/oss-security/2015/05/31/5
https://bugs.exim.org/show_bug.cgi?id=1672
-> http://www.openwall.com/lists/oss-security/2015/08/24/1
https://bugs.exim.org/show_bug.cgi?id=1515
-> http://www.openwall.com/lists/oss-security/2015/05/31/4
https://bugs.exim.org/show_bug.cgi?id=1667
-> http://www.openwall.com/lists/oss-security/2015/08/05/3
======
--
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
