Date: Tue, 05 May 2015 14:52:33 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com Subject: Silent security fixes in virtuoso-opensource virtuoso-opensource is a database used by the KDE desktop search: <http://virtuoso.openlinksw.com/dataspace/doc/dav/wiki/Main> A long time ago, we looked at the low-level data marshaling code in the database server, and found quite a few memory safety issues. We also encountered server crashes and problems which looked like race conditions, affecting server stability. KDE uses a private UNIX domain socket to communicate with a user-specific database server, but the database server can be accessed over TCP as well. Upstream did not release a security advisory, but alluded to the fixes in release announcement: <http://virtuoso.openlinksw.com/dataspace/doc/dav/wiki/Main/VOSNews#Client%20RPC> And in commit messages: <https://github.com/openlink/virtuoso-opensource/commits/develop/6/libsrc/Dk> We have not assigned CVE identifiers because the number of different crashes we saw was fairly large, and we could not completely understand how the RPC implementation is pieced together. I'm sorry that this message is not particularly helpful. -- Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.