Date: Fri, 2 Sep 2011 17:36:29 -0400 From: Michael Gilbert <michael.s.gilbert@...il.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...-smtp.mitre.org> Subject: Re: ffmpeg issues Steven M. Christey wrote: > > For context, CVE-2011-2162 was assigned because of Mandriva's reference to > "several additional vulnerabilites originally discovered by Google Chrome > developers were also fixed with this advisory" without any reference to a > CVE identifier. Isn't this just CVE-2011-1198 then (which is suspiciously missing from that set of security announcements)? CVE-2011-1198 was assigned on March 30th, which certainly could have been referenced in the Mandriva advisories, they just missed it I guess? Given this kind of carelessness, I think we should err on the side of not issuing new ids based on ill-defined text like this future Mandriva advisories. > For CVE-2011-2160, http://ffmpeg.mplayerhq.hu/ includes a changelog. > CVE-2011-2160 was built from the March 17, 2011 entry: > > "Reinhard Tartler > backported several security fixes to the 0.5 release branch and made > another point release, that is 0.5.4. Note, 0.5 is quite old and this > release is mostly for those stuck with the 0.5 branch, and not so > interesting for end users. ... Changelog between 0.5.3 and 0.5.4 ... > Fix invalid reads in VC-1 decoding (related to CVE-2011-0723)." > > This suggests that the vendor may have fixed an issue related to > CVE-2011-0723, but not CVE-2011-0723 itself. The other items in the > 20110317 changelog map directly the CVE names, without a "related to" > qualifier. This triggers a SPLIT. This may just be a wording choice. We have more discussion going on right now , so hopefully we'll get it resolved there. Best wishes, Mike  http://lists.debian.org/debian-security-tracker/2011/08/msg00009.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.