Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Nov 2014 02:08:25 +0100
From: Hanno Böck <>
Subject: Re: Re: CVE Request: buffer overflow in
 ksba_oid_to_str in Libksba

On Wed, 26 Nov 2014 02:38:50 -0500 (EST) wrote:

> > Due to the unsigned integer this results in a pretty long value
> > which won't fit anymore into the allocated buffer.
> Use CVE-2014-9087.

Please note that this affects both libksba and gnupg (only version
2.1.0 and betas).

They share the code, but it's in different products, I don't know if
this means 2 CVEs should be assigned.

Hanno Böck


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.