[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 3 Mar 2017 14:17:19 +0100
From: Tomas Hoger <thoger@...hat.com>
To: Dawid Golunski <dawid@...alhackers.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: MySQL / MariaDB / Percona - Root Privilege
Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ]
Hi Dawid!
On Fri, 17 Feb 2017 12:03:44 -0200 Dawid Golunski wrote:
> Yes, I have reported the insufficient fixes to Oracle and related vendors.
>
> I wanted to allow some more time for patching before making these public.
> I will make my advisories and exploits public soon.
Can you clarify if the "soon" above is supposed to mean days, weeks, or
months? Two weeks have passed since the above, and I've not seen any
update from you.
Note that I'm only asking for CVE mappings for issues that were
publicly fixed and mentioned in release notes mid-Dec, listed in Oracle
CPU mid-Jan, and had enough technical details noted in this thread or
other public bug reports. Only giving CVE names to known issues does
not hurt anyone, and it actually helps downstreams and users already
hurt by upstream's proprietary attitude towards this open-source
project. Of course, it's up to your discretion if and when to release
working exploits, videos, etc.
Thank you!
--
Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
