![]() |
|
Message-ID: <20170303141719.4608fbb0@redhat.com> Date: Fri, 3 Mar 2017 14:17:19 +0100 From: Tomas Hoger <thoger@...hat.com> To: Dawid Golunski <dawid@...alhackers.com> Cc: oss-security@...ts.openwall.com Subject: Re: MySQL / MariaDB / Percona - Root Privilege Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ] Hi Dawid! On Fri, 17 Feb 2017 12:03:44 -0200 Dawid Golunski wrote: > Yes, I have reported the insufficient fixes to Oracle and related vendors. > > I wanted to allow some more time for patching before making these public. > I will make my advisories and exploits public soon. Can you clarify if the "soon" above is supposed to mean days, weeks, or months? Two weeks have passed since the above, and I've not seen any update from you. Note that I'm only asking for CVE mappings for issues that were publicly fixed and mentioned in release notes mid-Dec, listed in Oracle CPU mid-Jan, and had enough technical details noted in this thread or other public bug reports. Only giving CVE names to known issues does not hurt anyone, and it actually helps downstreams and users already hurt by upstream's proprietary attitude towards this open-source project. Of course, it's up to your discretion if and when to release working exploits, videos, etc. Thank you! -- Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.