Date: Tue, 17 Nov 2015 08:04:46 -0800 From: Alan Coopersmith <alan.coopersmith@...cle.com> To: oss-security@...ts.openwall.com CC: "X.Org Security Team" <xorg-security@...ts.x.org> Subject: Re: suckless sent and libxft-dev 2.3.2-1 crash On 11/16/15 02:47 PM, Simon . wrote: > please review, whether this needs a CVE. I can't speak for Mitre or any other CNA's, but I can speak for the security team at X.Org, which is responsible for libXft and would need to put out a security advisory if there is a CVE in it. From our point of view, there's too little information here to determine, and that's after I went out and tracked down what the hell "sent" does (when asking for CVE's for programs that aren't very popular and have names that are hard to google because they're also common words, it helps to provide some background). It's also generally useful to have a root cause determined first, so someone knows which software to track the CVE against - would this be a CVE against libXft for mishandling data, or a CVE againt the "sent" program or some other library for not adequately verifying data from a source it shouldn't have trusted? Is libXft actually at fault or is it the victim of memory corruption that happened before the call? Is there any trust or privilege boundary being crossed here? If a user can crash a program running as themselves, it's a bug, but they can also kill -SEGV it, so it's not letting them do anything they shouldn't be able to. Why do you think this might deserve a CVE? -- -Alan Coopersmith- alan.coopersmith@...cle.com X.Org Security Response Team - xorg-security@...ts.x.org
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.