Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 16 Apr 2015 14:05:57 +0200
From: Stefan Cornelius <>
Subject: Re: net-snmp snmp_pdu_parse() function incompletely
 initializaition vulnerability

On Mon, 13 Apr 2015 13:44:04 +0800
罗大龙 <> wrote:

> HI there,
> Greeting! This is Qinghao Tang from QIHU 360  company, China. I am a
> security researcher there.
> I'm writing to apply for a CVE ID, for a 0day vulnerability in
> net-snmp. Please refer to below report.

The upstream patch is here:

As linked from the commit, the (currently restricted) upstream bug is:

Although this leads to crashes at different locations, all of them can
be attributed to snmp_pdu_parse() leaving stale netsnmp_variable_list
items in the list, so I think one CVE should be enough.

In case anyone is interested, the Red Hat bug is:

Stefan Cornelius / Red Hat Product Security

Come talk to Red Hat Product Security at the Summit!
Red Hat Summit 2015 -

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ