Date: Thu, 13 Aug 2015 21:53:42 -0400 (EDT) From: cve-assign@...re.org To: mprpic@...hat.com, siddharth@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Duplicate Wireshark CVEs? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Any information available on why both Wireshark CVEs > CVE-2015-3811 CVE-2015-2188 point to one fix ? These two URLs: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2188 currently do not point to the same fix, and never have pointed to the same fix. The first URL has existed since May, and the second has existed since March. >> Is there a reason two CVEs were assigned for this The two CVEs were assigned to two different issues. Our perspective is that multiple sources, including the upstream vendor, currently have an error in which wnpa-sec-2015-14 refers to bug number 10844, and that the intended bug number for wnpa-sec-2015-14 (after that error is corrected) is 10978. We will check with the upstream vendor and see whether they can confirm that bug number 10978 actually does refer to a non-identical security problem that was addressed months after 10844. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCAAGBQJVzUkhAAoJEKllVAevmvmsblIIAJUpf8g7W9D+WJmD0AGgTqaO Wb0K7n1q8GwLcR+kucLqAyMruXu0hqliuc0lZGkylIqllL6h/yPbDAjE3TxYCavf GPquPCJyV5SenrIjJLNq7tNAMA4MDUZF23UoR3wI1a/SEpVLzLXgadMpsGZ1Q4CZ pydcttGTgnQGX9oc//PCMahIAMzA/lJcvASu4XnqlSayZ6yVvzKogF51nsqFK+zD sQzSI0Vhrv/p9Ycn7FVcJYI7LRbw+yM5tS+TibgjPM6p7OKPrNJzVzSnpDs+UhkZ EWOaOl8Qdy/+aWsagMWSCz52Kqo0jJ2LMsW8ulhqgyL2JfmKdWL1ZBx5N0+9cyk= =eI8T -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ