Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 17 Nov 2015 08:04:46 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
CC: "X.Org Security Team" <xorg-security@...ts.x.org>
Subject: Re: suckless sent and libxft-dev 2.3.2-1 crash

On 11/16/15 02:47 PM, Simon . wrote:
> please review, whether this needs a CVE.

I can't speak for Mitre or any other CNA's, but I can speak for the
security team at X.Org, which is responsible for libXft and would
need to put out a security advisory if there is a CVE in it.

 From our point of view, there's too little information here to
determine, and that's after I went out and tracked down what the
hell "sent" does (when asking for CVE's for programs that aren't
very popular and have names that are hard to google because they're
also common words, it helps to provide some background).  It's also
generally useful to have a root cause determined first, so someone
knows which software to track the CVE against - would this be a CVE
against libXft for mishandling data, or a CVE againt the "sent"
program or some other library for not adequately verifying data from
a source it shouldn't have trusted?  Is libXft actually at fault or
is it the victim of memory corruption that happened before the call?

Is there any trust or privilege boundary being crossed here?
If a user can crash a program running as themselves, it's a bug,
but they can also kill -SEGV it, so it's not letting them do anything
they shouldn't be able to.

Why do you think this might deserve a CVE?

-- 
	-Alan Coopersmith-              alan.coopersmith@...cle.com
	  X.Org Security Response Team - xorg-security@...ts.x.org

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ