Date: Mon, 16 Apr 2012 15:54:21 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com Subject: CVE Request (minor) -- Two Munin graphing framework flaws Hello Kurt, Steve, vendors, the following three problems has been recently reported against Munin:  Insecure temp file use in the qmailscan plug-in: https://bugzilla.redhat.com/show_bug.cgi?id=812889 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668778  Possibility to inject escape sequences into Munin's log file: https://bugzilla.redhat.com/show_bug.cgi?id=812885 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668666  Remote users can fill /tmp filesystem: Red Hat would not consider this to be a security flaw => no RH BTS entry. Original report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668667 For the first two -- though both of them having minor security impact, under suitable circumstances they could lead to trust boundary crossing => under our opinion they should get a (CVE-2012-*) identifiers. For the third issue -- we wouldn't consider it to be a security flaw. Just as something, which on improperly configured machine could allow to fill in /tmp filesystem (just another way how to do it, when the particular service isn't properly configured). Could you allocate CVE ids for the first two issues? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.