Date: Thu, 20 Sep 2012 15:54:44 +0200 From: Tomas Hoger <thoger@...hat.com> To: coley@...us.mitre.org Cc: oss-security@...ts.openwall.com, Florian Weimer <fweimer@...hat.com>, Oracle Security Team <secalert_us@...cle.com> Subject: Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) On Tue, 11 Sep 2012 17:37:11 -0400 (EDT) Steven M. Christey wrote: > The bug report appears to be describing a narrow class of > vulnerability that could affect multiple codebases that implement > Java Virtual Machines, not just Oracle's; if so, then a separate CVE > would be needed for each REPORTED codebase, and CVE-2012-4416 is ONLY > for bug id 7196857 for the Oracle-supported JVM. Out of curiosity, what is the definition of "reported codebase" here? I'm asking as 2 CVEs were assigned, one for Oracle JVM and one for OpenJDK JVM. Those codebases are not unrelated though, both problems are quite likely to exist because of a bug in a shared code, which usually implies single CVE. The current practice is that Java CVEs assigned by Oracle and used for Oracle Java SE are also used to refer to fixes applied to the open-sourced (OpenJDK) or licensed (IBM Java) JDK versions that share the vulnerable code. For example, a single CVE-2012-4681 was used for the recent 0day flaw in Oracle Java SE 7, IBM Java SE 7 and OpenJDK 7. Is the use of CVE-2012-4681 for all 3 considered wrong? -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.