[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3719551.uSXB2Z6hFG@wanheda>
Date: Thu, 01 Jun 2017 08:47:43 +0200
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: Moritz Muehlenhoff <jmm@...ian.org>
Subject: Re: Information on recent sqlite3 issues?
On Wednesday 31 May 2017 22:30:37 Moritz Muehlenhoff wrote:
> Hi,
> one of the latest Apple advisories mentions several vulnerabilities in
> sqlite: https://support.apple.com/en-us/HT207798
>
> CVE-2017-2513: found by OSS-Fuzz
> CVE-2017-2518: found by OSS-Fuzz
> CVE-2017-2520: found by OSS-Fuzz
> CVE-2017-2519: found by OSS-Fuzz
> CVE-2017-6983: Chaitin Security Research Lab (@ChaitinTech) working with
> Trend Micro's Zero Day Initiative CVE-2017-6991: Chaitin Security Research
> Lab (@ChaitinTech) working with Trend Micro's Zero Day Initiative
>
> Does anyone have additional information on those and whether that
> applies to the standard sqlite releases or Apple-specific changes?
>
> Cheers,
> Moritz
Hi.
I don't know about apple itself but in the clusterfuzz reports I see 4 public
bugs about sqlite.
However they have a very small (2 days) range of regression, i.e. a commit
made in those two days causes the problem.
I didn't check, but I suspect they didn't go in any release.
FTR, the time you are seeing in the regression range is UTC:
https://github.com/google/oss-fuzz/issues/563
At this point I don't know if apple referer to those issues or the mentioned
issues are not public.
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
