Date: Thu, 27 Nov 2014 02:08:25 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: Re: CVE Request: buffer overflow in ksba_oid_to_str in Libksba On Wed, 26 Nov 2014 02:38:50 -0500 (EST) cve-assign@...re.org wrote: > > Due to the unsigned integer this results in a pretty long value > > which won't fit anymore into the allocated buffer. > > Use CVE-2014-9087. Please note that this affects both libksba and gnupg (only version 2.1.0 and betas). They share the code, but it's in different products, I don't know if this means 2 CVEs should be assigned. -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.