Date: Wed, 16 Jul 2014 17:04:38 +0200 From: Tomas Hoger <thoger@...hat.com> To: cve-assign@...re.org Cc: rdecvalle@...are.com, oss-security@...ts.openwall.com, mmcallis@...hat.com Subject: Re: Re: [ruby-core:63604] [ruby-trunk - Bug #10019] [Open] segmentation fault/buffer overrun in pack.c (encodes) On Wed, 16 Jul 2014 02:04:37 -0400 (EDT) cve-assign@...re.org wrote: > > Ruby 1.9.3, 2.0, and 2.1 are affected by the off-by-one. We're still > > not sure about the presence of a different issue affecting Ruby 2.0 > > and 2.1. I left a comment on the report pointing out that 1.9.3 is > > also affected by the off-by-one > > Yesterday, > > https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/46778 > > and > > https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/46778/diff/pack.c > > were publicly readable, but today both of them result in a "Ruby Issue > Tracking System" login screen. We're not sure how to interpret this, > e.g., maybe all of 46778 has become private because the "different > issue affecting Ruby 2.0 and 2.1" is now embargoed? That's probably unrelated change / regression in the Ruby bug tracker. Checking some other random bug report, when logged in using a completely unprivileged account, I see: - revision strings (rXXXX) are clickable links pointing to URLs as above - actual revisions / diff are accessible While doing the same while not logged in: - revision strings (rXXXX) are not turned to links - revision / diff pages redirect to login Anyway, you can view the above commit / diff via: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=46778 -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.