oss-security - Re: CVE Request: exim STARTTLS fix

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 24 May 2011 07:24:03 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: exim STARTTLS fix

----- Original Message -----
> Hi,
> 
> while reviewing EXIM git for the last security issues, I also found the
> STARTTLS fix:
> 
> http://git.exim.org/exim.git/commitdiff/da80c2a8ed49427334af613c00df65ae301cacdd
> 
> Is fixed with exim 4.76 apparently.
> 

That commit suggests it's not an issue, but rather some extra paranoid
buffer wiping. Is there a reason to believe this is a problem?

I'd rather not assign an ID if it's not needed.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.