Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 19 May 2015 09:05:59 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Cc: Pedro Ribeiro <pedrib@...il.com>
Subject: CVE reject request CVE-2015-8146/8147 (was:
 [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL)

On Tue, 5 May 2015 09:19:20 +0100 Pedro Ribeiro wrote:

> tl;dr heap and integer overflows in ICU, many packages affected,
> unknown if these can be exploited or not - everyone names vulns
> nowadays, so I name these I-C-U-FAIL.

...

> #1 Vulnerability: Heap overflow
> CVE-2014-8146

...

> #2 Vulnerability: Integer overflow
> CVE-2014-8147

Apparently a typo was made when fixing these issues in Ubuntu and
subsequently in Debian when ids with year 2015 were used instead of
2014.  Incorrect ids are used in patch names and changelogs, but e.g.
USN-2605-1 was released with correct ids.  I assume it's still prudent
to consider 2015 ids for rejection, it's likely they have not been
allocated yet.

http://www.ubuntu.com/usn/usn-2605-1/
https://launchpad.net/ubuntu/+source/icu/52.1-3ubuntu0.3
https://launchpad.net/ubuntu/+source/icu/52.1-6ubuntu0.3
https://launchpad.net/ubuntu/+source/icu/52.1-8ubuntu0.1

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784773

-- 
Tomas Hoger / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.