Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Jul 2014 02:04:37 -0400 (EDT)
From: cve-assign@...re.org
To: rdecvalle@...are.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, thoger@...hat.com,
        mmcallis@...hat.com
Subject: Re: [ruby-core:63604] [ruby-trunk - Bug #10019] [Open] segmentation fault/buffer overrun in pack.c (encodes)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Ruby 1.9.3, 2.0, and 2.1 are affected by the off-by-one. We're still
> not sure about the presence of a different issue affecting Ruby 2.0 and
> 2.1. I left a comment on the report pointing out that 1.9.3 is also
> affected by the off-by-one

Yesterday,

https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/46778

and

https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/46778/diff/pack.c

were publicly readable, but today both of them result in a "Ruby Issue
Tracking System" login screen. We're not sure how to interpret this,
e.g., maybe all of 46778 has become private because the "different
issue affecting Ruby 2.0 and 2.1" is now embargoed?

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTxhUcAAoJEKllVAevmvmsuxsIAMh4WJncuqucnYqEkrTheEd4
qlW9Zl7aliCm1ZA0K9Vs5Vg1MVN/Bi194vBuOp/S3Bh+MDYNjmpU4BcbzePAk0W4
kg1iuVaKfyqzyfO+wv+0oJqQ8oDNQWv0EtK4+3XjAieJX7Ozgv11rXe9mZpmft0m
8+YSSIBOAZ5+lRsndyXBL9EUOq703aUHNw3KbA4qzkXu6FRs5LjxOPgt/BUm6hTE
9Oa5f/XWF64vcqk3H9rJDfOboc6N/h2qQe/2PHDBOrwW4yzFlvr/IwNirhB+BPTJ
9gpa6d3fuLXvzE735PbvBt63tII12kiEZkpvPGFwTtMXhAyoMVDFLOT3ryFm++U=
=B1ha
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ