Date: Mon, 23 Feb 2015 08:40:26 -0700 From: Kurt Seifried <kseifried@...hat.com> To: Jean-Baptiste Kempf <jb@...eolan.org> CC: oss-security@...ts.openwall.com, videolan@...eolan.org, Assign a CVE Identifier <cve-assign@...re.org> Subject: Re: [videolan] older issues in libbluray So the good news/bad news is I'm finished cleaning out about 20 older bugs that were embargoed and not properly handled (mostly due to them stalling and then being forgotten I guess, some were from 6 years ago, well before I even worked for Red Hat). Again my apologies for this mess. The good news is that all our current embargoed flaws (none against VLC currently =) are being actively handled (e.g. worked on in a current time frame) and moving forwards we should hopefully be able to avoid issues like this. Also one request (not just specific to VLC, but everyone with a project): please have a security@ email address for your project or a security web page that makes it obvious how to contact and report things privately, this is a common problem and easily solved (and will make it much easier for people to report issues). I just recently found myself emailing random security@ addresses at other projects to see if they bounce or not. I still have no idea if the projects received my security report (no bounce so here's hoping!). On 23/02/15 01:52 AM, Jean-Baptiste Kempf wrote: > We never were contacted. > This is not really cool. > > On 22 Feb, Kurt Seifried wrote : >> With apologies, I tracked down the original report and added it to our >> BZs. I was also under the impression VideoLan had been contacted but >> just to ensure this is the case adding them to the CC. >> >> On 22/02/15 11:43 AM, Moritz Mühlenhoff wrote: >>> On Fri, Feb 06, 2015 at 04:21:20PM -0700, Kurt Seifried wrote: >>>> https://bugzilla.redhat.com/show_bug.cgi?id=959434 >>>> https://bugzilla.redhat.com/show_bug.cgi?id=959433 >>>> >>>> these may warrant a cve >>> >>> Have these been reported to libbluray upstream? The >>> Bugzilla entries are rather scarce on details. >>> >>> Cheers, >>> Moritz >>> >> >> -- >> Kurt Seifried -- Red Hat -- Product Security -- Cloud >> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 >> > > > >> _______________________________________________ >> videolan mailing list >> videolan@...eolan.org >> https://mailman.videolan.org/listinfo/videolan > > -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.