Date: Mon, 11 May 2015 10:31:28 +0200 From: Remi Collet <remi@...oraproject.org> To: oss-security@...ts.openwall.com Subject: Re: About PHP and CVE-2015-1353 - please REJECT -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Can you please reject this CVE. Thanks, Remi. Le 05/05/2015 10:07, Remi Collet a écrit : > Hi, > > Can someone explain how this can be a security issue, and why > scored as "high" risk ? > > > On bad input, the call will produce a bad output. > > I don't see any way to exploit this for any bad thing. > > I really think we should reject this CVE. Upstream doesn't even > consider this as a bug. > > > Remi. > > > P.S. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1353 > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlVQaOAACgkQYUppBSnxahhDBACfS+avTYdrTvAy7pUrhZFTmDxw OMgAnA860MMJK7j24lWmK9bqkfn/2Q6a =l2P8 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.