Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 30 Dec 2014 17:13:37 +1100
From: Joshua Rogers <>
Subject: Re: Re: CVE Request: Double Free in PHP

On 30/12/14 17:02, wrote:
> No, CVE-2014-9425 is only for the Zend/zend_ts_hash.c issue with:
>   142        tsrm_mutex_free(ht->mx_reader);
>   143        tsrm_mutex_free(ht->mx_reader);
> We generally can't change the scope of a CVE ID to include additional
> bugs after that CVE ID has been sent to oss-security. Otherwise,
> anyone developing a remediation for a CVE would typically see their
> remediation suddenly become incomplete because the meaning of the CVE
> changed.
Yes, that's my bad, sorry.
For some reason I saw CVE-2014-9425 as the
/ext/fileinfo/libmagic/apprentice.c CVE-ID, too, that you provided in a
private email.(For reference on the mailing list, this bug:

> Also, for example, information showing a double-free issue (aka
> CWE-415) would not be combined with information showing a
> use-after-free issue (aka CWE-416). That situation would have two CVE
> IDs even if the reports were sent together and were, say, specifically
> about PHP 5.6.4.
OK, great.

-- Joshua Rogers <>

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.