Date: Wed, 18 Mar 2015 21:24:53 +0100 From: Timo Warns <Timo.Warns@...il.com> To: cve-assign@...re.org Cc: emmanuel.law@...il.com, oss-security@...ts.openwall.com Subject: Re: Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary On 2015-03-18, cve-assign@...re.org wrote: > > > https://bugs.php.net/bug.php?id=69253 > > https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5 > > > PHP <= 5.6.6 has a Integer overflow vulnerability when opening a > > ZipArchive with a large number of entries. This results in writing > > past the heap boundary and crashing PHP. > > Use CVE-2015-2331. Can you please clarify the scope of CVE-2015-2331? Does it only cover the vulnerability in PHP or does it also cover upstream libzip? Thanks, Timo
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.