Date: Wed, 26 Nov 2014 02:46:24 -0500 (EST) From: cve-assign@...re.org To: cherepan@...me.ru Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: LibreOffice -- several issues -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > https://bugs.freedesktop.org/show_bug.cgi?id=86449 > Crash importing malformed .rtf -- potentially exploitable for RCE Use CVE-2014-9093 for bug 86449. (For reference, http://openwall.com/lists/oss-security/2014/11/19/3 is about finding a series of bugs in version 3.5.4 on Debian stable -- in other words, a version based on a mid-2012 codebase -- and reporting them directly upstream without commenting on 4.2.x or 4.3.x.) For the others, in addition to the http://openwall.com/lists/oss-security/2014/11/19/18 post, "Michael Meeks from officesecurity@...ts.freedesktop.org indicated that they are not interested in CVEs for DoS-only crashers" is also relevant. This has multiple possible interpretations, e.g., "not interested" because their security team won't track the issues using CVEs, or "not interested" because they are not vulnerabilities. The "is a security issue because it takes down all other windows with it" is often relevant to CVE because it represents a default security policy if there is no information from a vendor about their security policy. However, a vendor is free to establish a security policy such as "if you are working with a potentially untrusted file, you MUST NOT have any other windows open in which you are maintaining state about your other editing work." In other words, they can define all DoS-only crashers to be applicable only in unsupported use cases. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUdYFGAAoJEKllVAevmvmsaSUH/3uQpWpaK6vMVpN3BrWaj/uS IqjmfqeeyHpUtrOC+zYmFI+1gMXwj4jQvmWz9RB2LFWLWbsn9gLt5xG+0D8CTX6m VWk9PnNnIbfKToWfEu1m0JsvZNolihIiGMwITx8YeSEF4s1DfwkSZIwCx/WBm1/m yRRSJPmyrYlMKA9985c6FphnTQ/+6IteypvdwdX5gfs0L1OEB0UeDbQCqe+0SY3N rnkSZAPLtUDIjUplAI1UlVeh35dCJ1nWuBG+1yUmzJlaz+QSaMR6iUQWcYbpdNfy tBPr+Fhh1ep8SyrLVhjEGGU+sFKJCEUD0iN0J0AC1iRklYOqKOtI4T8VNh2UCOY= =dyEX -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.