Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 27 Nov 2015 13:41:54 -0700
From: Kurt Seifried <>
To: oss-security <>, CVE ID Requests <>, 
	cve-editorial-board-list <>
Subject: Major outstanding CVE requests

So we have a number of PCRE issues that need CVE's and a git issue that
needs a CVE (at this point we've actually shipped an update for it, most of
these requests are more than a month old, and several are 2-3 months old.
Red Hat needs CVE's for these, as do other vendors I'm sure. I know it's
thanksgiving in the USA right now, but the backlog is becoming a problem.
Can I have permission from Mitre to assign CVE's to these issues?

asked for Oct 5, pinged recently, still no answer.


Appart from that a couple of other vulnerabilities found by other
people have been fixed in this
Heap overflow in compile_regex
Stack overflow in compile_regex
Heap overflow in compile_regex


More PCRE:


The other unassigned issues already have open CVE requests:



Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.