Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <200910291218.21686.oeriksson@mandriva.com>
Date: Thu, 29 Oct 2009 12:18:21 +0100
From: Oden Eriksson <oeriksson@...driva.com>
To: oss-security@...ts.openwall.com
Subject: Re:  Re: ghostscript CVE for multiple NULL dereferences in JBIG2 decoder

onsdagen den 28 oktober 2009 13.58.56 skrev  Mark J Cox:
> > The same PoC crashes xpdf. I'm not aware of any CVE id being assigned for
> > this issue other than the one for Adobe Reader.
> 
> So I've deliberately not allocated one because we generally do not
> consider a crash of a user application like a PDF reader to be a security
> issue.  However CVE does have a few cases where CVE names were allocated
> for such cases, so if any vendor here is going to treat this as a security
> issue let me know and I'll allocate a name for tracking purposes.
> 
> Thanks, Mark
> 

I was actually planning to but as currently done in cooker where jbig2dec is 
broken out in a new jbig2dec-0.10 package (with the patch applied). This makes 
it easier for future borkiness. This was also done with jasper earlier for the 
same reason.

-- 
Regards // Oden Eriksson

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.