Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 4 Nov 2012 19:39:29 -0800
From: Reed Loden <>
To: Kurt Seifried <>
Cc:, Steven Christey <>
Subject: Re: YUI 2.x security issue regarding embedded SWF
 files -- or, How Not To Handle A Security Disclosure

Hash: SHA1

On Sun, 04 Nov 2012 17:13:28 -0700
Kurt Seifried <> wrote:

> > Might want to go ahead and get a CVE assigned to whatever this
> > issue is, and hope more details come out of this soon so YUI 2
> > users can actually get patched instead of having to request access
> > to the fix...
> Have any CVE's been issued for this issue? I can't find any. More to
> the point does this kind of issue (is it a service strictly?) even get
> a CVE? Steve?

YUI is not a service at all. It's a JavaScript helper library, similar
to jQuery, Mootools, Dojo, etc. CVEs have been assigned to YUI before
(CVE-2010-4207, CVE-2010-4710).

Version: GnuPG v1.4.11 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.