oss-security - Re: CVE request for webkit js engine javascriptcore

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160718073312.GA29485@openwall.com>
Date: Mon, 18 Jul 2016 10:33:12 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request for webkit js engine javascriptcore

Hi,

On Mon, Jul 18, 2016 at 02:25:17PM +0800, jun3 June wrote:
> Please can I have CVE IDs assigned to the following vulnerabilities:
> 
> 1.javascriptcore vulnerability:
> 
> https://bugs.webkit.org/show_bug.cgi?id=158411
> 
> 2.the fix has landed in r201787: <http://trac.webkit.org/r201787>

As a list moderator, I already regret having (reluctantly) accepted your
message.  I thought it was just lacking detail in message body, which is
against oss-security list content guidelines:

http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines

"At least the most essential part of your message (e.g., vulnerability
detail or a PoC exploit) should in fact be in the message itself (and in
plain text), rather than only included by reference to an external
resource.  Posting links to relevant external resources as well is
acceptable, but posting only links is not."

So I thought I'd just point out this to you like I do now (but
off-list), for further occasions.  However, as it turns out the URL
https://bugs.webkit.org/show_bug.cgi?id=158411 says "You are not
authorized to access bug #158411. To see this bug, you must first log in
to an account with the appropriate permissions." and the other URL is
lacking direct detail on the bug as well (only talking about the fix).

BTW, is it one vulnerability or more?  You wrote "vulnerabilities".

Please post the detail in a "reply" to this message, and please
include detail (not only URLs) in your postings going forward.  This
last request/reminder applies to everyone posting to oss-security.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.