Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 15 Jan 2013 18:49:12 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Curl insecure usage

On Tue, Jan 15, 2013 at 01:22:09AM -0700, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 12/25/2012 04:07 AM, Moritz M´┐╝hlenhoff wrote:
> > On Thu, Nov 29, 2012 at 02:49:58PM -0700, Kurt Seifried wrote:
> >>>> Also can someone collate and post a list of all the other
> >>>> apps using curl insecurely and need CVE's with appropriate
> >>>> links to the upstreams/etc? Thanks.
> >>> 
> >>> There are some, which are potentially affected, but where 
> >>> discussion with upstream is still pending.
> >>> 
> >>> Shall we go ahead and post them or do you prefer to have them 
> >>> sorted out with upstream first?
> >>> 
> >>> Cheers, Moritz
> >>> 
> >> I trust you. Course if you mess up and I assign a bad CVE Steve
> >> beats me with a stick... ;)
> > 
> > Sorry for the late followup and merry christmas to you!
> > 
> > There are two more issues related to this, which require CVE IDs
> > (both also discovered by Alessandro Ghedini <ghedo@...ian.org>:
> > 
> > 1. In the implementation of the Falcon programming language: 
> > (http://www.falconpl.org/)
> > 
> > 2. In nuSOAP (http://sourceforge.net/projects/nusoap/)
> > 
> > I'll post links with details to the Debian bugs once they've been
> > filed.

Here we go:

CVE-2012-6070 (falconpl):
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696681

CVE-2012-6071 (nusoap)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696707

Cheers,
        Moritz

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.