Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20201120021528.pduwcibewbab47he@moyka>
Date: Thu, 19 Nov 2020 18:15:28 -0800
From: Ian Zimmerman <itz@...y.loosely.org>
To: oss-security@...ts.openwall.com
Subject: Re: libass ass_outline.c signed integer overflow

On 2020-11-19 11:54, David A. Wheeler wrote:

> I read through the issue discussion. As best as I can tell, no one
> filed for a CVE, so there was no CVE.  Did I misunderstand something?
> 
> If my understanding is correct, that is *NOT* a failure of the CVE
> process.

As it often happens to me, what I wrote was too brief to be clear to
everyone.

The longer version would be something like:

  This is an example of a situation where no one filed for a CVE because
  of perceived hurdles in the process, even if the facts didn't justify
  the perception.

Now of course Moritz tells us there is in fact a CVE and indeed I can
locate the issue in Debian's security tracker. I guess it has been
judged not serious enough to need fixing in buster. I disagree but
clearly that is up to the maintainers.

-- 
Ian

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.