[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 4 Jun 2016 13:04:42 -0400 (EDT)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: three vulnerabilities in ImageMagick before 7.0.1-2
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
In case anyone needs background information about:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4562
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4563
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4564
The person who requested these CVE IDs from MITRE provided a security
advisory showing three independent problems (also with quite different
attack methodologies) that each happens to have a resultant buffer
overflow. However, they do not plan to make their security advisory
public. The CVE descriptions are based only on the surface-level
code-change information that is public in GitHub. For open-source
software, it is relatively rare for someone to compose a detailed
advisory about multiple CVEs and keep it permanently non-public, but
this can happen. One of the effects of non-public advisories is that
the number of CVEs may seem unrelated to the commit message.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJXUwPnAAoJEHb/MwWLVhi291MP/3wV+ZGCP8XJftP9nZez4apC
VtgFMu00wh19tQDJoskUhagfuc0D74KSo0c9o/rrTpNVAIpxaPsEkjCqTCicThEv
C55FqsDPIQo+XN8docdNFteYuuIwgt+thjMgmV1IuEdm4wbSCg0Ddm6vJGUUK9i7
F965FZ2S8B10kDG3soX43VsRiRmJnyhJ+MhcyGyuaAKGqmtLUnw8rFm91qvhghD3
abAV6PENb1abvBNzztYs1iWDtzCM/whIEVoRpH0qm/yTGin3/+Mo3SIcDVQ9/UQj
VvpBhpzURoLJOrzVqrPWrQO4vOD8BYE0hwfn878//qKVPp0TfnPPqUzLpBTN9eZQ
wv76w6/+1hoTKeuSrMfdAgqO/15pvB2iLWxBPjJcVVCyY32IalS1562LQxeVxqlC
250OZWu4APlvXjoKos56WuV0CPohVEFhBtbmQ9qxoudkjejcDoWhmi/Z+Fh2ElHp
n/LNiPWttWrrPzKb+s9GNvxXo2z9dDHbxVrBEOqppNwuynocCbmR4UGZc1vp9PQ7
UhXFQ/y1guWTvOGw/NZR9kYJthN2o7p5P0ceHWRpPfqMQlTQEn0CTjShLCtXrZ2G
nUiu3QT58FlP5hUfbjCQ+XGYj0lMcpBoN52AgiDxZL1BjKf15VIRsOLqwDSs144J
UX+2kIOAvJIMLky69RL9
=lITg
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
