Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Aug 2010 16:39:48 +0200
From: Tomas Hoger <>
Cc:, Thomas Biege <>,
        Moritz Muehlenhoff
        "Steven M. Christey" <>
Subject: Re: CVE request: PHP MOPS-2010-56..60

On Tue, 24 Aug 2010 11:34:42 +0200 Pierre Joye wrote:

> >> Done:
> >
> > Does it need a new CVE-ID?

[ .. ]

> Not sure as #24 was never fixed, but I don't know what is the policy
> in this case. I can use CVE-2010-2094 or a new one if it is more
> appropriate or cleaner.

Standard practice is to use new CVE.  As all 5 phar MOPS were covered
under single CVE, and not all of them were fixed in 5.3.3, I'd expect a
new "incomplete fix" CVE.

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.