[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 20 Sep 2012 15:54:44 +0200
From: Tomas Hoger <thoger@...hat.com>
To: coley@...us.mitre.org
Cc: oss-security@...ts.openwall.com, Florian Weimer <fweimer@...hat.com>,
Oracle Security Team <secalert_us@...cle.com>
Subject: Re: CVE Request (minor) -- JVM: heap memory
disclosure (possibly various JDKs)
On Tue, 11 Sep 2012 17:37:11 -0400 (EDT) Steven M. Christey wrote:
> The bug report appears to be describing a narrow class of
> vulnerability that could affect multiple codebases that implement
> Java Virtual Machines, not just Oracle's; if so, then a separate CVE
> would be needed for each REPORTED codebase, and CVE-2012-4416 is ONLY
> for bug id 7196857 for the Oracle-supported JVM.
Out of curiosity, what is the definition of "reported codebase" here?
I'm asking as 2 CVEs were assigned, one for Oracle JVM and one for
OpenJDK JVM. Those codebases are not unrelated though, both problems
are quite likely to exist because of a bug in a shared code, which
usually implies single CVE.
The current practice is that Java CVEs assigned by Oracle and used for
Oracle Java SE are also used to refer to fixes applied to the
open-sourced (OpenJDK) or licensed (IBM Java) JDK versions that share
the vulnerable code. For example, a single CVE-2012-4681 was used for
the recent 0day flaw in Oracle Java SE 7, IBM Java SE 7 and OpenJDK 7.
Is the use of CVE-2012-4681 for all 3 considered wrong?
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
