Date: Mon, 9 Dec 2013 18:45:20 -0500 (EST) From: cve-assign@...re.org To: pinkbyte@...too.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request: ClamAV vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > I know that there are no details provided here, but secunia advisory > also points on 'unspecified vulnerabilities'. It is possible to have a CVE ID for multiple unspecified vulnerabilities but this can usually only occur when the expectation is that no details will be available. In this case, a previous message said: >> From: Kurt Seifried <kseifried@...hat.com> >> >> Just a heads up I know at least one person is trying to get details >> from SourceFire (they bought ClamAV some time back). Until I can match >> issues up I can't assign CVEs. suggesting that some information gathering may be in progress. Although these items: >> 1) A double-free error exists within the "unrar_extract_next_prepare()" >> function (libclamunrar_iface/unrar_iface.c) when parsing a RAR file. >> >> 2) An unspecified error within the "wwunpack()" function >> (libclamav/wwunpack.c) when unpacking a WWPack file can be exploited to >> corrupt heap memory. can have CVE IDs, we can't correctly define the scope of any CVE ID until more is known about what was fixed in 0.9.7. For example, in some cases, two different double-free issues fixed in 0.9.7 would be covered by a single CVE ID. So, it is probably best to wait a short time for the information gathering. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSplJmAAoJEKllVAevmvms+dkH/inM5aP+TvcychU/CygZUIBo eCaMOYwaoCgq1PIAKAIHkSxe8RQMvcZqF4W4V2YzXMDYFGRDOocOv7celNz213tJ Ur2vbIBN7eq9ZenenYZ4kr1mv9E84tRpVIm69Th5tBwEbPKbQiJcCVFsmHmMKQ80 C/aDHpVngu6gCkcEdgUX2GTaC7xAc+QkHlFFcaDbxdr860lpiJB7FaF5BysCs69M 035c9SQEr0S/eiRJnNFRFNu+rcJvLSCK+NBsiPXGZqS0u9riUx2//0V0ilXNZzt1 K7dPazHgVvb5cwWMqfVHCwOGN5Nk/xqCOgDNBffNjGC+SaZggCWq/NLM+5foeMM= =hkx8 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.