Date: Thu, 5 Feb 2015 12:20:17 -0500 (EST) From: cve-assign@...re.org To: hanno@...eck.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > There are more such issues, I haven't tested them in php: > http://bugs.gw.com/view.php?id=409 > http://mx.gw.com/pipermail/file/2014/001649.html Our initial thought is that the 001649.html disclosure occurred first, and has a single root cause that also applies to id=409. So, we don't think that id=409 can have its own separate CVE ID, even though the id=409 report contained additional detail. Use CVE-2014-9653 for the entire "readelf.c uses pread() ... it's happy with partial reads and valgrind show various errors" report fixed by "file has been changed to bail out when pread() returns partial buffers." - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJU06XtAAoJEKllVAevmvms2QQIAIxDhtDG27FFsr8hsZQMJYqa 4Jk9r2vXKb8hmM/xenVWmCwHxz67UjZ3wgL5lU6z5hJMRaLfR4tddIhhgK+I+9p/ MslcATfZyBzal1uXaiiN81sYs+PPUdWYf9wCaI/j+F8O9sl2690OeSUOn+S3T8vf ZyMV2DIJnDYVo4TK+6xjuYnk1Tcq2sqvWO5BK07+pNAbtsWk4TikurSEuBc1KLSD TJ6LBOgf/HZPGqCx3PX+oKP/oN/OPP5mp31qM5A8RNjt3gYoqNhDQQ4uo7lYTUCH xy14S2XfNwvD+YNhBam1Vn+5+MxNqiEjuoOQ1ztP5Jb86A8fQdyfxS0lyVWSn18= =WfCL -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.