[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 9 Dec 2013 18:45:20 -0500 (EST)
From: cve-assign@...re.org
To: pinkbyte@...too.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: ClamAV vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I know that there are no details provided here, but secunia advisory
> also points on 'unspecified vulnerabilities'.
It is possible to have a CVE ID for multiple unspecified
vulnerabilities but this can usually only occur when the expectation
is that no details will be available. In this case, a previous message
said:
>> From: Kurt Seifried <kseifried@...hat.com>
>>
>> Just a heads up I know at least one person is trying to get details
>> from SourceFire (they bought ClamAV some time back). Until I can match
>> issues up I can't assign CVEs.
suggesting that some information gathering may be in progress.
Although these items:
>> 1) A double-free error exists within the "unrar_extract_next_prepare()"
>> function (libclamunrar_iface/unrar_iface.c) when parsing a RAR file.
>>
>> 2) An unspecified error within the "wwunpack()" function
>> (libclamav/wwunpack.c) when unpacking a WWPack file can be exploited to
>> corrupt heap memory.
can have CVE IDs, we can't correctly define the scope of any CVE ID
until more is known about what was fixed in 0.9.7. For example, in
some cases, two different double-free issues fixed in 0.9.7 would be
covered by a single CVE ID.
So, it is probably best to wait a short time for the information
gathering.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJSplJmAAoJEKllVAevmvms+dkH/inM5aP+TvcychU/CygZUIBo
eCaMOYwaoCgq1PIAKAIHkSxe8RQMvcZqF4W4V2YzXMDYFGRDOocOv7celNz213tJ
Ur2vbIBN7eq9ZenenYZ4kr1mv9E84tRpVIm69Th5tBwEbPKbQiJcCVFsmHmMKQ80
C/aDHpVngu6gCkcEdgUX2GTaC7xAc+QkHlFFcaDbxdr860lpiJB7FaF5BysCs69M
035c9SQEr0S/eiRJnNFRFNu+rcJvLSCK+NBsiPXGZqS0u9riUx2//0V0ilXNZzt1
K7dPazHgVvb5cwWMqfVHCwOGN5Nk/xqCOgDNBffNjGC+SaZggCWq/NLM+5foeMM=
=hkx8
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
