[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Jul 2011 13:50:40 -0700
From: Jeffrey Czerniak <jeffcz@...le.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: libxml security fix from apple ... any
information?
On Jul 29, 2011, at 1:56 AM, Moritz Muehlenhoff wrote:
> Thomas Biege wrote:
>
>> Hello,
>> if the code executed is the same on Windows and on Linux I would assume
>> this affects Linux too. That the bug is not "seen" during fuzzing
>> means nothing.
>
> Grepping through the codebase show quite a few _WIN32 ifdefs, though.
>
> But of course we need to see the patch applied by Apple.
>
> Cheers,
> Moritz
Hello Moritz,
The patch we applied has been shared with Daniel Veillard of the libxml2 project.
We understand this issue may affect other distributors of libxml2, and we have not seen evidence that our patch has been applied upstream. We do not feel it is prudent to share the patch on a public mailing list such as oss-security, as we do not wish to inadvertently facilitate exploitation of the issue if other distributors are affected.
We would like to cooperate with other downstream distributors of free and open source software on security issues, as Apple is a major distributor of such software. However, our previous attempts to engage the community have not been successful. One-way disclosure of information related to security issues subjects our customers to non-trivial risk without providing any added security benefit. This is particularly pertinent if the disclosure were to occur in advance of the release of fixed software.
Best regards,
----------------
Jeffrey Czerniak
Apple Product Security Response
jeffcz@...le.com
----------------
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
