Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 8 Feb 2018 22:23:10 +0100
From: Solar Designer <>
Cc: SEC Consult Vulnerability Lab <>
Subject: Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip

On Thu, Feb 08, 2018 at 08:19:20AM +0100, SEC Consult Vulnerability Lab wrote:
> 2018-01-17: Informing about the upcoming advisory.
> 2018-02-01: Received CVE numbers.
> 2018-02-07: Publication of the advisory

Thanks for including the timeline.

So this is a violation of the distros list policy on maximum embargo
time.  Per list policy the reporter must have made the issue public in
at most 14 days, and per the tasks the distros had volunteered for
Gentoo (primary) and Amazon (backup) should have been posting reminders
for this to happen.  Instead, other distros posted such reminders
(thanks!) when it was already too late.

As list admin, I apologize for allowing this delay.  Yet I am not going
to watch the watchers all the time, which would be quite pointless (if I
were to do that, I could as well be taking care of all the tasks myself,
without asking the distros to volunteer for any).

Gentoo have already acknowledged the omission, and are taking measures.
I haven't heard from Amazon on this yet.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.