Date: Tue, 24 Aug 2010 16:39:48 +0200 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Cc: pierre.php@...il.com, Thomas Biege <thomas@...e.de>, Moritz Muehlenhoff <jmm@...ian.org>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request: PHP MOPS-2010-56..60 On Tue, 24 Aug 2010 11:34:42 +0200 Pierre Joye wrote: > >> Done: http://svn.php.net/viewvc?view=revision&revision=302565 > > > > Does it need a new CVE-ID? [ .. ] > Not sure as #24 was never fixed, but I don't know what is the policy > in this case. I can use CVE-2010-2094 or a new one if it is more > appropriate or cleaner. Standard practice is to use new CVE. As all 5 phar MOPS were covered under single CVE, and not all of them were fixed in 5.3.3, I'd expect a new "incomplete fix" CVE. -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.