[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 03 Jul 2014 01:49:42 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-0235 cleanup
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/07/14 01:40 AM, Solar Designer wrote:
> Kurt,
>
> On Thu, Jul 03, 2014 at 01:32:31AM -0600, Kurt Seifried wrote:
>> https://bugzilla.redhat.com/show_bug.cgi?id=1098222 is for a
>> single issue, an incomplete fix for CVE-2013-7345.
>>
>> Please use CVE-2014-3538 for
>> https://bugzilla.redhat.com/show_bug.cgi?id=1098222
>
> Kurt, please always include (at least one-sentence) CVE
> descriptions in your postings. Not everyone is into CVEs as much
> as you are, and not everyone will bother visiting URLs for an issue
> that is only potentially relevant to them. In this case, it's
> "file: extensive backtracking in awk rule regular expression".
>
> Thanks,
>
> Alexander
>
Ok
CVE-2014-3538 file: extensive backtracking in awk rule regular
expression (incomplete fix for CVE-2013-7345)
It was discovered the original upstream fix for the CVE-2013-7345
issue (bug 1079846) did not sufficiently address the problem. A
specially-crafted input file could still cause file to use an
excessive amount of CPU time when trying to detect file type using awk
regular expression rule.
- --
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJTtQsWAAoJEBYNRVNeJnmTojoP/iNFQMKEh8sk/xfdWpelfdGZ
Q7bDpQEL34DfdYU48URcHHHTfEZbsrqF89LnATFVQFRzP1YZQN8S5MbFgTZ8cQCz
tUjFXiz0IkfKc81ozZSFPYI+f6r3JZecKtYixgWunPnlSm48UTn3pQw/MS/Gt+ix
xjc1ZLeH7Ws4usOUgXc2jduFTRwUCSaiWKycAu9eY9KuuReHmPdEZ56f3D/g9EZu
XHXNUgtVpGpy9rkona3kgafTD3iyU3UFW4y857faG5QIea9W5Z6lm3l+vLJVrBs1
hPeD7m9DY93Ru4D156w8oxTSaqs4wZAIkJQgGZxvBFHYgbWQ2n2a0PeKZ4Uguwt4
g5PezQUoeAzW+4nOVb36wdR7ifuzHnqquuvvUPL5ERK+kgnZ83ujPgeOCoDBO7Bs
yK47Jvfe6gAmTnw6k+jzk7YxD+fSkYr84bwng3AEosH9mEXQIHMajdW726v8DZC9
tgdHxtx5V7fZYldEmQvYqWN6BcE/XZS5uFmQzfkTSkiANA1VifqOFD+dpBplsYrU
sTpcfZRpjGewmV7kE1upHH0vbTj8NUiWSoDjnmO4iNCdXcv3Ea0oL/CEEj0heZx5
HXAg/da1JwE4e9kI+A4Jm2mBNri3b3BHQOz74PRyRMZYRfBX21eccWKQm0Ec5NXe
v7DSJQd24wax8WzT0v2T
=FY8y
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
