[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 12 Dec 2008 19:45:17 -0600
From: Raphael Geissert <atomo64+debian@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request - roundcubemail
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
Jan Lieskovsky wrote:
> Hello Steve,
>
> this will need a new CVE identifier:
> http://trac.roundcube.net/ticket/1485618
> http://trac.roundcube.net/changeset/2148
>
I became aware of some sort of code execution vulnerability one day before that
ticket was reported. After reviewing the file I determined that it isn't a
vulnerability in roundcube, but in PHP itself; but I'm open to be proved wrong.
Note that I have not yet determined how exactly the vulnerability is being
exploited, but am working on it.
Cheers,
- --
Raphael Geissert - Debian Maintainer
www.debian.org - get.debian.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAklDE64ACgkQYy49rUbZzlpO+QCfWpIGeSzor9+Su4bKGB640jq/
mp8AoJ/7u4opntkHMBIUt8KomFXSW9Ts
=gYTB
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
