Date: Wed, 16 Jul 2014 02:04:37 -0400 (EDT) From: cve-assign@...re.org To: rdecvalle@...are.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, thoger@...hat.com, mmcallis@...hat.com Subject: Re: [ruby-core:63604] [ruby-trunk - Bug #10019] [Open] segmentation fault/buffer overrun in pack.c (encodes) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Ruby 1.9.3, 2.0, and 2.1 are affected by the off-by-one. We're still > not sure about the presence of a different issue affecting Ruby 2.0 and > 2.1. I left a comment on the report pointing out that 1.9.3 is also > affected by the off-by-one Yesterday, https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/46778 and https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/46778/diff/pack.c were publicly readable, but today both of them result in a "Ruby Issue Tracking System" login screen. We're not sure how to interpret this, e.g., maybe all of 46778 has become private because the "different issue affecting Ruby 2.0 and 2.1" is now embargoed? - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTxhUcAAoJEKllVAevmvmsuxsIAMh4WJncuqucnYqEkrTheEd4 qlW9Zl7aliCm1ZA0K9Vs5Vg1MVN/Bi194vBuOp/S3Bh+MDYNjmpU4BcbzePAk0W4 kg1iuVaKfyqzyfO+wv+0oJqQ8oDNQWv0EtK4+3XjAieJX7Ozgv11rXe9mZpmft0m 8+YSSIBOAZ5+lRsndyXBL9EUOq703aUHNw3KbA4qzkXu6FRs5LjxOPgt/BUm6hTE 9Oa5f/XWF64vcqk3H9rJDfOboc6N/h2qQe/2PHDBOrwW4yzFlvr/IwNirhB+BPTJ 9gpa6d3fuLXvzE735PbvBt63tII12kiEZkpvPGFwTtMXhAyoMVDFLOT3ryFm++U= =B1ha -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.