[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 May 2016 01:25:07 -0400 (EDT)
From: cve-assign@...re.org
To: max@...felsnetz.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: atheme: security fixes
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Multiple security issues were found in Atheme, an IRC services package
> Fix:
> https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b
> Description: A remote attacker could change Atheme's behavior by
> registering/dropping certain accounts/nicks.
> Reference: https://github.com/atheme/atheme/issues/397
Use CVE-2014-9773. We don't completely understand issues/397. We think
"This is rejected for Atheme, please consider reporting it to a
downstream fork instead" means that the vulnerability report was
originally rejected, but that decision was reconsidered many months
later.
> Fix:
> https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e
> Description: Under certain circumstances, a remote attacker could cause
> denial of service due to a buffer overflow in the XMLRPC response
> encoding code.
Use CVE-2016-4478.
(Incidentally, our understanding is that this code, or at least related
code, is available in the Debian atheme-services package.)
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJXKDXOAAoJEHb/MwWLVhi2ZogP+QHDhnJ4pYRn19Fx9FOp3azJ
sFuB4gxtWYTej04JDBJuM8cx8TywJnWrJezIElofLDM0xLcbfYhUyTT69qUKn1sf
8SfWZimDQvNTbUW1a3hdEd7NbJhtFU1BruzXQZ1GF9kxVUCLIVOYpctQVVImRcpA
EZ5V4cBK8nBZwpegCI/c0jp6X37QTFrfgar08VV1tB66Ch2CrXfG7QL0ecu7mQxL
3hYmj83rl8Lc//lHRR7lV/L+coapgsJju/z7btB2rz9RvQERO9QWojhYiG3CL3aO
/yJ+9yHrIdoFJFC5GRN/jaAFnltbxvowKcCcaznZGDepTnmiVY4UBuGYwaHofEAS
1Vw+9U9oPNrYBN4emgyuonnGgeG5dEoHUCBb8+gTYuktNkdR+MmKgoh3/JUmHj4F
F7urIFTV4rxj1jK+jQCYs1gVwbyjU9KOwNek8roOhou7SGMKWz+klj6roSSDZkDx
RBnYvPS5A1Yr9thcpx5Wq19FLxBs4jxLkzPggQSKxxz9f+i45GVnFz2j30LnDjQv
nHEksTj/Az1eYIj7PYkZ8VKbcuRnuUPQrUo/p82EHBGLev/x7fC8xA/WLyDSLRw6
b6oiLcOUKbAdrigumyYF9rJlm37kdGufdeczWlk8UCf2NM5DbzLK2QeugnlzjYXk
5onF2vOKMXseEckA7VtD
=skOF
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
