Date: Thu, 9 Apr 2015 17:52:26 -0400 (EDT) From: cve-assign@...re.org To: fweimer@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: libX11: buffer overflow in MakeBigReq macro -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Does this assignment cover application code which has to be recompiled > because it included an expansion of broken macro? It might be worthwhile to answer this in two ways. First, the scope of the CVE-2013-7439 assignment does cover application code that was built with this macro, in the sense that applications cannot have their own unique CVE IDs for the same problem. In other words, if building with this macro is what is calling an application's security into question, then there wouldn't be a separate CVE ID for that application. Second, if an application's vendor wants to publish a security advisory mapping to CVE-2013-7439, then it is preferable for the vendor to verify that the existence of the macro actually has a security impact for that application. However, there is no reasonable way for the MITRE CVE team to require that. An application's vendor might not have the resources or expertise. For example, the application's vendor optionally could decide to map to CVE-2013-7439 based only on noticing that the macro is used. In any case, the information posted by others in this thread would be very useful for risk-assessment questions that go beyond "how can this CVE ID be used." - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVJvNSAAoJEKllVAevmvmsCdIH/A9SWB+8BaxQhyasFAXKz8Qg 0ikGPGWFOraNdbr46sLC4MhYfE80fNzcurlmTemEsN7xmnmnhRbLjmCPQifYHJ+7 PMs8eFQxVi91gNCptVn7YWpmtdwI+AzcQeJvezXvWwVsrVktf0/7KvXH5F9zeQ3l jk9z2nXTt42e/Kk8JcpIKixS1Em1oNt/YKHBIOz79ufjbCiM1UxAE1aMo2e04YKA YCYoPNgMB4eKUiHazTo2HBtm+6u+E2+/+lb008/mnh6fRl+XhVm3gPURpsGgJM+7 njrDI0eeO5iU6XFSR6pf/Qp+OHNts8hb0U2DKuKlxfMaUZvswlNAZsJHOcl1u/U= =DjB/ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.