Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 13 Apr 2010 07:23:35 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request: irssi 0.8.15


----- "Steven M. Christey" <coley@...us.mitre.org> wrote:

> On Mon, 12 Apr 2010, Josh Bressers wrote:
> 
> >> "This release fixes two security issues: The first being that Irssi
> >> didn't check hostname on SSL connections and the other being a hard to
> >> exploit remote crash bug."
> >>
> 
> > The crash bits mentioned in the changelog are very ambiguous. The git
> > tree isn't any more clear than that. There appear to be two crashes,
> > both sound like NULL pointer dereferences that cannot be triggered by
> > an attacker. If I'm wrong, please speak up.
> 
> Josh, I think we should assign another CVE anyway.  The upstream vendor
> has explicitly labeled this as a security issue, so even if it seems of
> limited severity, that's enough to trigger creation of a CVE.  The use of
> the "remote crash" term also reinforces the need for a CVE.
> 
> This might be juse a plain old crasher from the perspective of many
> downstream vendors, but it's still worthy of inclusion in CVE because
> there is a significant population that would treat it as a "security"
> problem even if it's low severity.
> 
> Should I assign one or should you?
> 

Your reasoning makes sense, I'm happy to assign an ID. Thanks.

CVE-2010-1156 irssi 0.8.15 remote DoS

-- 
    JB

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.