Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 3 Mar 2017 14:17:19 +0100
From: Tomas Hoger <>
To: Dawid Golunski <>
Subject: Re: MySQL / MariaDB / Percona - Root Privilege
 Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ]

Hi Dawid!

On Fri, 17 Feb 2017 12:03:44 -0200 Dawid Golunski wrote:

> Yes, I have reported the insufficient fixes to Oracle and related vendors.
> I wanted to allow some more time for patching before making these public.
> I will make my advisories and exploits public soon.

Can you clarify if the "soon" above is supposed to mean days, weeks, or
months?  Two weeks have passed since the above, and I've not seen any
update from you.

Note that I'm only asking for CVE mappings for issues that were
publicly fixed and mentioned in release notes mid-Dec, listed in Oracle
CPU mid-Jan, and had enough technical details noted in this thread or
other public bug reports.  Only giving CVE names to known issues does
not hurt anyone, and it actually helps downstreams and users already
hurt by upstream's proprietary attitude towards this open-source
project.  Of course, it's up to your discretion if and when to release
working exploits, videos, etc.

Thank you!

Tomas Hoger / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.