Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3025119.tSIlaHEIMQ@arcadia>
Date: Thu, 16 Mar 2017 21:15:28 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: Thuan Pham <thuanpv@...p.nus.edu.sg>
Subject: Re: CVE Request: multiple bugs found in BFD libraries and Binutils' utilities

On Friday 17 March 2017 00:58:05 Thuan Pham wrote:
> Could you please check whether these bugs are suitable for CVEs?

Thuan,
thanks for sharing.

Since few time the cve requests happens on https://cveform.mitre.org instead 
of here.

>From some time of fuzz experience, from multiple cve requests and multiple 
feedback from mitre I'd say:
- In any way you are able to crash a library, it needs a cve because it is 
supposed to receive multiple inputs.
- Undefined behavior in a library also needs a cve. 
- while the bug is in a command line tool:
1) if it is a simple crash like fpe / segv, it is considered just an 
inconvenience.
2) if it is an overflow with read of size 1 is also considered an inconveniece 
unless you can demostrate any evidence of damage.
The mentioned cases are not just an inconvenience unless there are common 
cases where you know that for example a webapp relies on this command line 
tool.
3) if it is an overflow with write access it should have a cve.


@everyone, if you think it is wrong or I missed something feel free to correct 
me. 
 
-- 
Agostino Sarubbo
Gentoo Linux Developer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.