[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 Feb 2010 16:13:54 +0000 (GMT)
From: Mark J Cox <mjc@...hat.com>
To: oss-security@...ts.openwall.com
cc: Greg KH <greg@...ah.com>, "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: ima: fix null pointer
dereference
>> Do we need CVE numbers for issues that never showed up in a released
>> kernel version? I don't see how this could affect anyone, unless they
>> were foolish enough to ship a product on a non-released kernel :)
>
> You got a point there, but I requested this in order to keep track of
> security issues that we might need to backport in our future kernels.
It shouldn't get a CVE name. If someone at some point in the future ships
a vulnerable version (by selective backporting, or similar) then it would
get a name. Cheers, Mark
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
