Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 20 Jun 2023 15:47:28 -0700
From: Alan Coopersmith <>
Subject: CVE-2023-31975: memory leak in yasm is freaking out scanners
since it claims this bug has a CVSS of 9.8.

 From what I see at though, I can't
see any CVSS higher than 0.0 being relevant here and think the CVE should
be withdrawn.  Am I missing something here?  All I see is 2 objects of
16 bytes each not being freed in the fraction of a second before the
command exits and automatically frees the memory - in a command the user
deliberately chooses to run, which runs as themselves with no raised
privileges, on an input file they provide, and which exits after processing
the file and doesn't hang around keeping that memory allocated - not a bit
of security risk at all there.  (Yes, it's a small bug and is good to fix,
but not to raise security alarms for.)

         -Alan Coopersmith-       
          Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.