Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20120419164122.GB23313@inutil.org>
Date: Thu, 19 Apr 2012 18:41:22 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
	officesecurity@...ts.freedesktop.org,
	David Tardon <dtardon@...hat.com>, Miklos Vajna <vmiklos@...e.cz>,
	Carlo Di Dato <shinnai@...istici.org>
Subject: Re: Re: [Officesecurity] CVE Request (minor) --
	LibreOffice (X >= v3.5.0): DoS (excessive CPU use) in the RTF
	tokenizer

On Thu, Apr 19, 2012 at 01:33:07PM +0100, Caolán McNamara wrote:
> > [8] https://bugs.freedesktop.org/show_bug.cgi?id=48640#c1 ('DoS PoC')
> > 
> > This one (on LibreOffice >= v.3.5.0 using the new RTF tokenizer implementation)
> > truly leads to denial of service (excessive CPU consumption and hang) while
> > trying to process that RTF file. So this case might be applicable
> > for CVE-2012-* identifier assignment.
> 
> Dunno about this, I mean if we're going to go around assigning CVEs to
> every busy-hang we'd be knee deep in CVEs by the end of a week.

I agree. For an application profile such as an office suite handing out CVE
IDs to crash/CPU overload bug w/o potential of code injection is a waste
of time and impractical.

Cheers,
        Moritz

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.