[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+KTh2wi+=Wda7+DzuBDigcGJDokK1R7xfCN9UZeMwncfAiT+g@mail.gmail.com>
Date: Wed, 19 Oct 2016 09:39:59 +1300
From: Emmanuel Law <emmanuel.law@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE assignment for PHP 5.6.27 and 7.0.12
What about local escalations? They can be used to bypass disable_functions,
a security feature, in PHP.
IMO they should be assigned CVEs so that they can be tacked and back-ported
if desired.
I've came across php distros where these would have been patched, but
didn't because CVE was not assigned and the maintainers were not aware that
it was a security issue.
On Wed, Oct 19, 2016 at 1:14 AM, Remi Collet <remi@...oraproject.org> wrote:
> Le 18/10/2016 à 14:06, Adam Maris a écrit :
> > On 18/10/16 09:42, Lior Kaplan wrote:
> >> Hi,
> >>
> >> Please assign a CVE for the following issue:
> >>
> >> Bug #73147 Use After Free in unserialize()
> >> https://bugs.php.net/bug.php?id=73147
> >> http://git.php.net/?p=php-src.git;a=commit;h=
> 0e6fe3a4c96be2d3e88389a5776f878021b4c59f
> >>
> >>
> >> Thanks,
> >>
> >> Kaplan
> >>
> > 16 bugs marked as 'security' were fixed in php 5.6.27 of which only one
> > has CVE assigned.
> > Here you request CVE for another one issue (even the documentation says
> > it's unsafe to use
> > unserialize on untrusted input).
> >
> > Are you planning to obtain CVEs also for other security bugs or do you
> > treat the rest as
> > CVE-unworthy? Or are reporters/community supposed to do it?
>
> All the remaining bugs, despite reported as security issue, involved
> some very big strings to reproduce (~2GB)
>
> Which is prevented by any decent memory_limit value
> And by max_input_size for remote access.
>
>
> Remi
>
>
> P.S. just my 0,02€, but indeed, CVE-unworthy
>
> > Thanks!
> >
>
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
