[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 May 2015 11:28:29 -0400 (EDT)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: FreeRDP tmp flaws
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> This may need 2 CVE's
We think there should be zero CVEs because the report is apparently
about a developer's debugging code that was never shipped.
> ./channels/drdynvc/tsmf/tsmf_media.c
> "/tmp/FreeRDP_Frame_%d.ppm"
As far as we can tell, this code has been in an "#if 0" starting from
when the code was originally added to FreeRDP in:
https://github.com/FreeRDP/FreeRDP/commit/dadb94a1e343648503949094a50053d81212a153
In other words, we don't think this code would ever have been
reachable by an end user. The "#if 0" also apparently exists in the
freerdp-1.0.2.tar.gz that's included in the
freerdp-1.0.2-5.el7.src.rpm file.
> ./libfreerdp-gdi/gdi.c
> #ifdef DUMP_REMOTEFX_TILES
> sprintf(tile_bitmap, "/tmp/rfx/tile_%d.bmp",
As far as we can tell, there is no build option for
DUMP_REMOTEFX_TILES or documentation recommending that an end user
define DUMP_REMOTEFX_TILES, either in the upstream distribution or in
a source RPM.
> Actually it looks like upstream fixed both of them already so one CVE
> can do (I don't think it's important enough to SPLIT/MERGE properly).
Even if there were a different SPLIT/MERGE process for less important
cases, a single CVE ID for issues reported in different versions would
be among the harder process changes because it affects whether (or
how) the CVE ID could be used on the cve.mitre.org web site, and
complicates some types of patch-based remediation.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVZeE3AAoJEKllVAevmvms720H/3OH+XF1lBCs6kikJbS2NQHo
eNKWfDgTyme6hFXcE1/qtQ06ct/8+kPf2QkKg7/QvSLBdVYwjqOqTsj08PtTnOqU
XaRgoEAwB8rEvaH4f56hKT41XI4tF6lrERSMPeunktVV1vcvj57BG1QxK+4WPqQv
OPyJRQjzu0om6BRwU3gViF4LhkTBUkHpL8ehEwYyxs8AIBA0lz/NKYwfAfKmA0F0
2+i+Tc/wc6JGBoP6AfqrITaHAI3SV/mRnjcB1ZQdx3jENdUnZ2Pod08OFGreaVG2
84SgeIR/IWnEpOgGYglw5qDwa7/EVhICLRbtz9QAFmaVV1FHKuXy3w/GCE3YQE0=
=s9NW
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
