[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 30 Oct 2009 19:35:34 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: MFSA 2009-63
Hi Reed!
On Fri, 30 Oct 2009 10:15:23 -0500 Reed Loden <reed@...dloden.com>
wrote:
> I think we used one CVE per library upgrade, so three in total
> (libvorbis, liboggz, liboggplay).
Correct. And the fixes brought in as part of those updates are
possible spread across multiple upstream versions, which is a common
reason to do a CVE split.
> Bug 499512 seems to be a liboggplay issue fixed by bug 512328.
It's listed among libvorbis bugs and I wasn't able to tell if there was
only liboggplay-side issue.
> However, if you notice any issues yourself with the advisory, please
> feel free to report any issues to me or to security@....
I've only added a comment to 515889, which seems to be a dupe of one
older vorbis CVE.
Thank you!
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
