Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Nov 2014 02:08:25 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request: buffer overflow in
 ksba_oid_to_str in Libksba

On Wed, 26 Nov 2014 02:38:50 -0500 (EST)
cve-assign@...re.org wrote:

> > Due to the unsigned integer this results in a pretty long value
> > which won't fit anymore into the allocated buffer.
> 
> Use CVE-2014-9087.

Please note that this affects both libksba and gnupg (only version
2.1.0 and betas).

They share the code, but it's in different products, I don't know if
this means 2 CVEs should be assigned.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: BBB51E42

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.