Date: Fri, 2 Sep 2011 11:39:12 -0400 (EDT) From: "Steven M. Christey" <coley@...-smtp.mitre.org> To: oss-security@...ts.openwall.com Subject: Re: ffmpeg issues For context, CVE-2011-2162 was assigned because of Mandriva's reference to "several additional vulnerabilites originally discovered by Google Chrome developers were also fixed with this advisory" without any reference to a CVE identifier. For CVE-2011-2160, http://ffmpeg.mplayerhq.hu/ includes a changelog. CVE-2011-2160 was built from the March 17, 2011 entry: "Reinhard Tartler backported several security fixes to the 0.5 release branch and made another point release, that is 0.5.4. Note, 0.5 is quite old and this release is mostly for those stuck with the 0.5 branch, and not so interesting for end users. ... Changelog between 0.5.3 and 0.5.4 ... Fix invalid reads in VC-1 decoding (related to CVE-2011-0723)." This suggests that the vendor may have fixed an issue related to CVE-2011-0723, but not CVE-2011-0723 itself. The other items in the 20110317 changelog map directly the CVE names, without a "related to" qualifier. This triggers a SPLIT. - Steve On Fri, 2 Sep 2011, Michael Gilbert wrote: > Hi, > > We're trying to figure out the status of ffmpeg in debian . Does > anyone have any real info on CVE-2011-2160 (whose CVE page is in > essence completely empty) . BTW, how is a link to the software's > homepage considered a confirmation of the issue? > > Also, CVE-2011-2162  seems to be a rehash of a bunch of CVE ids > that happened to be in the recent dump of Mandriva advisories. > Shouldn't this get REJECTED since its just a collection of already > known and tracked issues? > > Thanks, > Mike > >  http://lists.debian.org/debian-security-tracker/2011/08/msg00009.html >  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2160 >  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2162 >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.