Date: Fri, 27 Mar 2015 19:46:40 -0400 (EDT) From: cve-assign@...re.org To: ch3root@...nwall.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Aren't you usually combine similar issues into one CVE anyway? Same > reported type ("stack corruption" In this context, we don't look at stack corruption as a "type." In general, the number of assigned CVE IDs can depend on both the inline text of the oss-security request message as well as other information that may be available at relatively low cost. Here's are two examples. (We'll use "integer underflow" in the examples even though that can be vague as discussed in the http://cwe.mitre.org/data/definitions/191.html Alternate Terms.) Real example in open-source FreeXL code: #1: A flaw was found in the way FreeXL reads sectors from the input file. A specially crafted file could possibly result in stack corruption #3: A flaw was found in the way FreeXL handles a premature EOF. A specially crafted input file could possibly result in stack corruption Both of these say "stack corruption." However, #1 is about "workbook->sector_end <= (workbook->p_in - workbook->sector_buf)" - the unpatched code omitted a necessary test for an integer underflow. #3 is not related to an integer underflow. Hypothetical example: ClosedSourceProduct 1.1 changelog 1.1 is a mandatory security update to address these two stack-corruption issues: - fixed an integer underflow vulnerability (Bug #123) - fixed an EOF handling vulnerability (Bug #456) If reasonably possible, we want the number of CVE IDs to be the same in the open-source example and the closed-source example. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVFetpAAoJEKllVAevmvmsUJMH/3KHjKjnHuImmwWv5iYgi5tG +PeUg+IdgDDdgOgbtX0zYSDghlQBu5oqVWXtetpCM1Kp8E7PaX5QiZGj23qQHS24 E2ipxyi6dWTH3dD6vw1kgPGg3n+neqe2sBii7AZru5S6jKsxcv398y4Xh2aF0h9S H3uVHb+AOaXr85Zt2mwgCPesYhxnds5vo1U80yWi5jHW+52RaSIAwCLYs8UaDnv6 sflKup1D+t2Prj3QTfjk7o+c7iBhGaCgIQEwOlVLqwnUpgTWHbopiDrQe3y6eR7n FlwWRkCRYPyDNvuwLnV+IlGmPI25vrZ7cH1bHZEFhwjepiikuBPFyO9d4C9DRhU= =Jm7d -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.