Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Sep 2012 09:35:26 +0200
From: Florian Weimer <fweimer@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com,
        Oracle Security Team <secalert_us@...cle.com>
Subject: Re: CVE Request (minor) -- JVM: heap memory disclosure
 (possibly various JDKs)

On 09/11/2012 11:37 PM, Steven M. Christey wrote:

> I wonder about the severity of the issue, but given the possibility that
> applications might access an array before a fill, and applications may
> depend on there being "empty" elements after initialization, this seems
> reasonable for a CVE.

My main concern is that untrusted code (in an applet or application 
server) could use this issue to access private data which was previously 
stored at the same location.


-- 
Florian Weimer / Red Hat Product Security Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.