Date: Sun, 4 Jan 2015 17:44:30 -0500 (EST) From: "Steven M. Christey" <coley@...re.org> To: oss-security@...ts.openwall.com cc: Dan McDonald <danmcd@...iti.com>, cve-assign@...re.org Subject: Re: CVE Request for illumos distributions On Sat, 3 Jan 2015, Christos Zoulas wrote: > On Jan 3, 6:57pm, cve-assign@...re.org (cve-assign@...re.org) wrote: > -- Subject: Re: [oss-security] CVE Request for illumos distributions > > | > Illumos bug #5421 - http://illumos.org/issues/5421 which is now fixed in > | > the upstream illumos-gate, is an innocuous fix to a serious problem that > | > allows an arbitrary user in the global zone (non-global zones are not > | > able to panic the machine) to panic the machine. > | > | Use CVE-2014-9491. > > Shouldn't we be using CVE-2015-XXXX by now? This ID (and others) used a 2014 date because the bug report was technically public in 2014. The year portion of a CVE ID typically reflects when the CVE was requested for non-public issues; or for already-public issues, the year portion typically reflects the year of disclosure. The disclosure date itself can be a subject of interpretation, such as when an issue is disclosed at a publicly-accessible URL but only likely to be noticed by a limited audience ("technically public") versus when the issue becomes "widely public" to the infosec industry. Especially in the transition from the end of one year to the beginning of the next year, there can be a mixture of dates. Also, CVE (and every other vulnerability "database" or repository) frequently add entries for earlier years. Accordingly, there is still a chance that CVE-2014-xxxx IDs will reach 5 digits, either in 2015 or later, as we continue to cover older issues that we discover or did not prioritize in earlier years. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ