oss-security - Re: Two out of bounds reads in Zstandard / zstd

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 29 Oct 2015 20:26:28 -0400 (EDT)
From: cve-assign@...re.org
To: hanno@...eck.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Two out of bounds reads in Zstandard / zstd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> https://blog.fuzzing-project.org/26-Two-out-of-bounds-reads-in-Zstandard-zstd.html

Although this research is enormously helpful to Zstandard development
(e.g., see the
https://github.com/Cyan4973/zstd/issues/49#issuecomment-150550342
comment), we feel that it may be outside the scope of CVE because
Zstandard cannot yet be considered a "product."

> https://github.com/Cyan4973/zstd/blob/master/README.md

> Zstd has not yet reached "stable" status. Specifically, it doesn't
> guarantee yet that its current compressed format will remain stable
> and supported in future versions. ... "Stable Format" is projected
> sometimes early 2016

> you can now safely test zstd


> http://fastcompression.blogspot.com/2015/01/zstd-stronger-compression-algorithm.html?showComment=1423604634493#c3703448798429358177

> this format is not yet considered stable.
> The objective is to make it stable by year end.
> When it will be, the library number will become 1.0.

Also, we think that Zstandard is, for example, not shipped in any
well-known Linux distribution. When a piece of code is offered
primarily for testing, discoveries of exploitable problems often have
low interest among CVE consumers.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWMrghAAoJEL54rhJi8gl5jG8QAKCtCDxmIg6rOIa0STH/Oub5
+WyiNy2Zb5Soo7H1BqfNYlKQw/zqzqWuRwirh2B6smE8UlC4aRhLZOZ0tMcjejc+
xYcb5LAHu/TAutHGBRijc/Y5Uq/0MHTNGpinoeKePhnVimoEiWA80ogg01EbGKKz
Opdth3qkIuxGno3eVPfu6aqiGxNSH9eLbP+x9EHKKAUOXni2+MxyzDr4wMfCclow
9MRGGza0wmdKU+WDFZVjTehUX73Y84iE4FXROomujTJpmcK2dE28Oxojv5wMqQQ6
++z/EjRnr5AJNwD7NPUxO1EItLl2LRHrtFkQSz4XMZ9qE2VVuuL/0BOKPZyAvGrj
LKRdOi5yz7tOJvGTqDY4YhoY71qPn0N9OHPEjTzlWcSl4AH3VC+FiDUGaf2hlvqP
pZv0OIUxVKAtVXtpYTzH+HFmT7Ipt/hoouQ/uZ8WWQYDNDU2Xt5xvV77kL5RfXI2
7suqCVm7gahbsSeUu6ar3a+OGUeDRAkdgkGqio4Vvq8bGv/nmPdvJ09Ic/HiDfKB
qB326B44jSWJHT3WSqZHMhe7z2qB4E8Ig4koImTJIqAjZ6FpIMdNoeTZoYHPYZWi
pJL6XMmDZh9nbdGoFjWEmd9aRlNeXa2xJe3voKH4apP2KJoEZvvGwesfreM9824q
9GG9dNISuT0LZvDknrYN
=o5EY
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.