Date: Fri, 27 Nov 2015 13:41:54 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com>, CVE ID Requests <cve-assign@...re.org>, cve-editorial-board-list <cve-editorial-board-list@...ts.mitre.org> Subject: Major outstanding CVE requests So we have a number of PCRE issues that need CVE's and a git issue that needs a CVE (at this point we've actually shipped an update for it, most of these requests are more than a month old, and several are 2-3 months old. Red Hat needs CVE's for these, as do other vendors I'm sure. I know it's thanksgiving in the USA right now, but the backlog is becoming a problem. Can I have permission from Mitre to assign CVE's to these issues? Git: http://seclists.org/oss-sec/2015/q4/37 asked for Oct 5, pinged recently, still no answer. PCRE: ====== https://blog.fuzzing-project.org/29-Heap-Overflow-in-PCRE.html http://seclists.org/oss-sec/2015/q4/363 Appart from that a couple of other vulnerabilities found by other people have been fixed in this release:https://bugs.exim.org/show_bug.cgi?id=1672 Heap overflow in compile_regexhttps://bugs.exim.org/show_bug.cgi?id=1515 Stack overflow in compile_regexhttps://bugs.exim.org/show_bug.cgi?id=1667 Heap overflow in compile_regex ====== More PCRE: ====== http://seclists.org/oss-sec/2015/q4/364 The other unassigned issues already have open CVE requests: https://bugs.exim.org/show_bug.cgi?id=1503 -> http://www.openwall.com/lists/oss-security/2015/05/31/5 https://bugs.exim.org/show_bug.cgi?id=1672 -> http://www.openwall.com/lists/oss-security/2015/08/24/1 https://bugs.exim.org/show_bug.cgi?id=1515 -> http://www.openwall.com/lists/oss-security/2015/05/31/4 https://bugs.exim.org/show_bug.cgi?id=1667 -> http://www.openwall.com/lists/oss-security/2015/08/05/3 ====== -- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.