[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEsznC5BCaqRXQo1=SfvhgZTDfk=XJ2bwP05B6=qKW7mWTcNMg@mail.gmail.com>
Date: Tue, 18 Oct 2016 15:18:55 +0300
From: Lior Kaplan <kaplanlior@...il.com>
To: Adam Maris <amaris@...hat.com>
Cc: oss-security@...ts.openwall.com, Stanislav Malyshev <stas@....net>
Subject: Re: CVE assignment for PHP 5.6.27 and 7.0.12
Hi Adam,
On behalf of the PHP security team, I intend to request only one CVE.
(in addition to #73003 that, as you mentioned, already had CVE assigned by
libgd)
The rest of the bugs weren't assessed as "CVE needed". You're welcome to
contact
the PHP security list for further discussion.
Kaplan
On Tue, Oct 18, 2016 at 3:06 PM, Adam Maris <amaris@...hat.com> wrote:
> On 18/10/16 09:42, Lior Kaplan wrote:
>
>> Hi,
>>
>> Please assign a CVE for the following issue:
>>
>> Bug #73147 Use After Free in unserialize()
>> https://bugs.php.net/bug.php?id=73147
>> http://git.php.net/?p=php-src.git;a=commit;h=0e6fe3a4c96be2d
>> 3e88389a5776f878021b4c59f
>>
>> Thanks,
>>
>> Kaplan
>>
>> 16 bugs marked as 'security' were fixed in php 5.6.27 of which only one
> has CVE assigned.
> Here you request CVE for another one issue (even the documentation says
> it's unsafe to use
> unserialize on untrusted input).
>
> Are you planning to obtain CVEs also for other security bugs or do you
> treat the rest as
> CVE-unworthy? Or are reporters/community supposed to do it?
>
> Thanks!
>
> --
> Adam Mariš, Red Hat Product Security
> 1CCD 3446 0529 81E3 86AF 2D4C 4869 76E7 BEF0 6BC2
>
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
