Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 7 Feb 2015 15:31:40 -0800
From: Reed Loden <>
Cc: Assign a CVE Identifier <>,, 
	Dan Veditz <>
Subject: Re: Mozilla: Use-after-free when doing multiple
 nesting using bad tags states "The
addresses look like it's hit our \"frame-poisoning\" mitigation which would
make that an unmapped and unexploitable address but that's off the top of
my head and needs investigation.", so if true, it's only a DoS, which
Mozilla doesn't assign CVEs for since it's not exploitable.

for more information about frame poisoning and how it works to make what
used to be always critical security bugs into just crash bugs.

Also, Mozilla is a CNA, so requests for CVEs for Mozilla products should be
directed to them. I've cc'd security@ and Dan Veditz to confirm the above,

(with his Mozilla Security Group hat on)

On Sat, Feb 7, 2015 at 10:29 AM, Kurt Seifried <> wrote:

> not sure why this never got a cve/security treatment
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.