Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Jan 2011 12:47:59 -0500 (EST)
From: "Steven M. Christey" <>
To: Moritz Mühlenhoff <>
Subject: Re: CVE requests: ftpls, xdigger, lbreakout2, calibre,

On Fri, 14 Jan 2011, Moritz Mühlenhoff wrote:

> We're still missing CVE assignments for several issues from 2009.
> These have been requested on oss-security before, but couldn't be
> processed by Josh/Red Hat, since RH doesn't have 2009 IDs. As such,
> they need to be handled by MITRE:
> 1. Overkill (this should be a CVE-2009 ID)

Use CVE-2009-5041

> 2. Emacs mode for reStructuredText (from DocUtils) (this should be a CVE-2009 ID)

Use CVE-2009-5042

> 3. FireGPG (this should be a CVE-2008 ID)

There are 2 CVEs needed:

CVE-2008-7272 - storage of cleartext/passphrase on disk
CVE-2008-7273 - symlink following

> 4. Burn (Homepage: (That's a CVE-2009 ID)


> 5. pdfroff (from GNU groff) (That's a CVE-2009 ID)


> 6. Jetty (That's a CVE-2009 ID)

There are a number of CVEs to assign here.

>A) "Dump Servlet" information leak
>   (Affected versions: Any)


>B) "FORM Authentication demo" information leak
>   (Affected versions: Any)

No CVE assigned - ability to detect presence of a particular
application is not CVE-worthy unless the app's design intends to allow
it to be hidden.

>C) "JSP Dump" reflected XSS
>    (Affected versions: Any)
>D) "Session Dump Servlet" stored XSS
>   (Affected versions: Any)


>E) "Cookie Dump Servlet" escape sequence injection
     (Affected versions: Any)
>F) Http Content-Length header escape sequence injection
>   (Affected versions: Any)


>G) "Cookie Dump Servlet" stored XSS
>   (Affected versions: =<6.1.20)


>H) WebApp JSP Snoop page XSS
>(Affected versions: =<6.1.21)


> 7. Konversation (That's a CVE-2009 ID)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.