[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <30653c2b-5754-e3a1-94d4-9ead3e9ca65b@redhat.com>
Date: Thu, 14 Jul 2016 11:44:33 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com,
Mitre CVE assign department <cve-assign@...re.org>
Subject: CVE Requests: HarfBuzz - Chromium CVE issues
Hello,
Google released a chromium advisory[0], in which a bunch of harfbuzz
issues were mentioned. However only one CVE was assigned to multiple
issues as per https://bugs.chromium.org/p/chromium/issues/detail?id=544270
Looking a bit into the attached bug and going a few links down, i
realized that there are atleast 3 issues in here which are CVE worthy.
Details as follows:
1. Heap based buffer overflow:
https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679
2. Fix hmtx wrong table length check:
https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957
3. heap-buffer-overflow in hb_ot_face_metrics_accelerator_t::get_advance
https://github.com/behdad/harfbuzz/issues/156
Can MITRE please assign CVEs to these issues?
Also, assuming we still have a policy of one issue one CVE, how does
MITRE plan to handle vendors who assign one CVE to multiple non-related
issues?
[0]
http://googlechromereleases.blogspot.in/2016/01/stable-channel-update_20.html
--
Huzaifa Sidhpurwala / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
