Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 17 Apr 2008 12:34:26 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: CVE request: firefox 2.0.14 ( Crash in JavaScript
 garbage collector)

On Thu, 17 Apr 2008, Hanno [utf-8] Böck wrote:

> And again, are pure browser crashers considered security relevant?

CVE chooses to include them because:

1) In some cases, the crash is evidence of a more serious issue - but we
do not have the resources to perform a deep investigation every time, and
often, there are insufficient details.

2) While many users don't think it's important, some do.  Since a typical
browser/client is carrying multiple sessions at once, an attacker can
cause a loss of data or loss of connectivity to unrelated sessions.
While perhaps minor, it is technically a security problem because an
attacker should only be able to impact the attacker's own session.

3) when even NULL pointer dereferences are sometimes exploitable, it seems
safer to include them.

CVE leaves it up to vendors to decide if a crasher is important enough for
them to post an advisory.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.