Date: Thu, 19 Apr 2012 18:41:22 +0200 From: Moritz Muehlenhoff <jmm@...ian.org> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org>, officesecurity@...ts.freedesktop.org, David Tardon <dtardon@...hat.com>, Miklos Vajna <vmiklos@...e.cz>, Carlo Di Dato <shinnai@...istici.org> Subject: Re: Re: [Officesecurity] CVE Request (minor) -- LibreOffice (X >= v3.5.0): DoS (excessive CPU use) in the RTF tokenizer On Thu, Apr 19, 2012 at 01:33:07PM +0100, Caolán McNamara wrote: > >  https://bugs.freedesktop.org/show_bug.cgi?id=48640#c1 ('DoS PoC') > > > > This one (on LibreOffice >= v.3.5.0 using the new RTF tokenizer implementation) > > truly leads to denial of service (excessive CPU consumption and hang) while > > trying to process that RTF file. So this case might be applicable > > for CVE-2012-* identifier assignment. > > Dunno about this, I mean if we're going to go around assigning CVEs to > every busy-hang we'd be knee deep in CVEs by the end of a week. I agree. For an application profile such as an office suite handing out CVE IDs to crash/CPU overload bug w/o potential of code injection is a waste of time and impractical. Cheers, Moritz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.