oss-security - About PHP and CVE-2015-1353

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 05 May 2015 10:07:41 +0200
From: Remi Collet <remi@...oraproject.org>
To: oss-security@...ts.openwall.com
Subject: About PHP and CVE-2015-1353

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Can someone explain how this can be a security issue,
and why scored as "high" risk ?

On bad input, the call will produce a bad output.

I don't see any way to exploit this for any bad thing.

I really think we should reject this CVE.
Upstream doesn't even consider this as a bug.

Remi.

P.S. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1353
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlVIek0ACgkQYUppBSnxahj9KQCaAtMayd0kNR0s+HesD1f8Hh0X
UUgAoNloTFTdXoJZgTcwH1vUWVcDLjwS
=AEJ5
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.