Date: Thu, 29 Oct 2015 20:26:28 -0400 (EDT) From: cve-assign@...re.org To: hanno@...eck.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Two out of bounds reads in Zstandard / zstd -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > https://blog.fuzzing-project.org/26-Two-out-of-bounds-reads-in-Zstandard-zstd.html Although this research is enormously helpful to Zstandard development (e.g., see the https://github.com/Cyan4973/zstd/issues/49#issuecomment-150550342 comment), we feel that it may be outside the scope of CVE because Zstandard cannot yet be considered a "product." > https://github.com/Cyan4973/zstd/blob/master/README.md > Zstd has not yet reached "stable" status. Specifically, it doesn't > guarantee yet that its current compressed format will remain stable > and supported in future versions. ... "Stable Format" is projected > sometimes early 2016 > you can now safely test zstd > http://fastcompression.blogspot.com/2015/01/zstd-stronger-compression-algorithm.html?showComment=1423604634493#c3703448798429358177 > this format is not yet considered stable. > The objective is to make it stable by year end. > When it will be, the library number will become 1.0. Also, we think that Zstandard is, for example, not shipped in any well-known Linux distribution. When a piece of code is offered primarily for testing, discoveries of exploitable problems often have low interest among CVE consumers. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWMrghAAoJEL54rhJi8gl5jG8QAKCtCDxmIg6rOIa0STH/Oub5 +WyiNy2Zb5Soo7H1BqfNYlKQw/zqzqWuRwirh2B6smE8UlC4aRhLZOZ0tMcjejc+ xYcb5LAHu/TAutHGBRijc/Y5Uq/0MHTNGpinoeKePhnVimoEiWA80ogg01EbGKKz Opdth3qkIuxGno3eVPfu6aqiGxNSH9eLbP+x9EHKKAUOXni2+MxyzDr4wMfCclow 9MRGGza0wmdKU+WDFZVjTehUX73Y84iE4FXROomujTJpmcK2dE28Oxojv5wMqQQ6 ++z/EjRnr5AJNwD7NPUxO1EItLl2LRHrtFkQSz4XMZ9qE2VVuuL/0BOKPZyAvGrj LKRdOi5yz7tOJvGTqDY4YhoY71qPn0N9OHPEjTzlWcSl4AH3VC+FiDUGaf2hlvqP pZv0OIUxVKAtVXtpYTzH+HFmT7Ipt/hoouQ/uZ8WWQYDNDU2Xt5xvV77kL5RfXI2 7suqCVm7gahbsSeUu6ar3a+OGUeDRAkdgkGqio4Vvq8bGv/nmPdvJ09Ic/HiDfKB qB326B44jSWJHT3WSqZHMhe7z2qB4E8Ig4koImTJIqAjZ6FpIMdNoeTZoYHPYZWi pJL6XMmDZh9nbdGoFjWEmd9aRlNeXa2xJe3voKH4apP2KJoEZvvGwesfreM9824q 9GG9dNISuT0LZvDknrYN =o5EY -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.