|
|
Date: Thu, 29 Oct 2015 20:26:28 -0400 (EDT) From: cve-assign@...re.org To: hanno@...eck.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Two out of bounds reads in Zstandard / zstd -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > https://blog.fuzzing-project.org/26-Two-out-of-bounds-reads-in-Zstandard-zstd.html Although this research is enormously helpful to Zstandard development (e.g., see the https://github.com/Cyan4973/zstd/issues/49#issuecomment-150550342 comment), we feel that it may be outside the scope of CVE because Zstandard cannot yet be considered a "product." > https://github.com/Cyan4973/zstd/blob/master/README.md > Zstd has not yet reached "stable" status. Specifically, it doesn't > guarantee yet that its current compressed format will remain stable > and supported in future versions. ... "Stable Format" is projected > sometimes early 2016 > you can now safely test zstd > http://fastcompression.blogspot.com/2015/01/zstd-stronger-compression-algorithm.html?showComment=1423604634493#c3703448798429358177 > this format is not yet considered stable. > The objective is to make it stable by year end. > When it will be, the library number will become 1.0. Also, we think that Zstandard is, for example, not shipped in any well-known Linux distribution. When a piece of code is offered primarily for testing, discoveries of exploitable problems often have low interest among CVE consumers. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWMrghAAoJEL54rhJi8gl5jG8QAKCtCDxmIg6rOIa0STH/Oub5 +WyiNy2Zb5Soo7H1BqfNYlKQw/zqzqWuRwirh2B6smE8UlC4aRhLZOZ0tMcjejc+ xYcb5LAHu/TAutHGBRijc/Y5Uq/0MHTNGpinoeKePhnVimoEiWA80ogg01EbGKKz Opdth3qkIuxGno3eVPfu6aqiGxNSH9eLbP+x9EHKKAUOXni2+MxyzDr4wMfCclow 9MRGGza0wmdKU+WDFZVjTehUX73Y84iE4FXROomujTJpmcK2dE28Oxojv5wMqQQ6 ++z/EjRnr5AJNwD7NPUxO1EItLl2LRHrtFkQSz4XMZ9qE2VVuuL/0BOKPZyAvGrj LKRdOi5yz7tOJvGTqDY4YhoY71qPn0N9OHPEjTzlWcSl4AH3VC+FiDUGaf2hlvqP pZv0OIUxVKAtVXtpYTzH+HFmT7Ipt/hoouQ/uZ8WWQYDNDU2Xt5xvV77kL5RfXI2 7suqCVm7gahbsSeUu6ar3a+OGUeDRAkdgkGqio4Vvq8bGv/nmPdvJ09Ic/HiDfKB qB326B44jSWJHT3WSqZHMhe7z2qB4E8Ig4koImTJIqAjZ6FpIMdNoeTZoYHPYZWi pJL6XMmDZh9nbdGoFjWEmd9aRlNeXa2xJe3voKH4apP2KJoEZvvGwesfreM9824q 9GG9dNISuT0LZvDknrYN =o5EY -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.