Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161031151149.4waow4btnxoevnax@eldamar.local>
Date: Mon, 31 Oct 2016 16:11:49 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: Handful of libass issues

Hi

Apologies for the late reply.

On Thu, Oct 27, 2016 at 08:24:24AM -0500, Brandon Perry wrote:
> 
> > On Oct 27, 2016, at 3:39 AM, Salvatore Bonaccorso <carnil@...ian.org> wrote:
> > 
> > Hi,
> > 
> > On Tue, Oct 04, 2016 at 10:23:22PM -0400, cve-assign@...re.org wrote:
> >>> The third is a huge memory allocation leading to a crash that wasn't
> >>> fixed because a good solution is unavailable at the moment.
> >> 
> >> Use CVE-2016-7971.
> > 
> > It looks from the discussion in
> > https://github.com/libass/libass/pull/240 that this issue is disputed
> > to be actually in libass.
> > 
> 
> For context, while the input caused a crash with AFL (not fuzzing
> with ASAN) and it crashes with ASAN, I was unable to reproduce the
> crash with libass externally. I was only able to take up a hug
> amount of memory and take a long time to finish parsing the input.
> 
> I asked if they dev wanted to reject the CVE but got no strong
> response either way, so I decided to not pursue it.

Sure understand that. Currently, still the CVE is associated with libass.

@MITRE CVE team, could you clarify the above? Is it still desired to
have the CVE associated with libass, or shoult it be rejected?

Regards,
Salvatore

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.