[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87zf9c2fnm.fsf@gmail.com>
Date: Mon, 27 Oct 2025 14:33:49 -0700
From: Collin Funk <collin.funk1@...il.com>
To: Moritz Mühlenhoff <jmm@...til.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: Questionable CVE's reported against dnsmasq
Moritz Mühlenhoff <jmm@...til.org> writes:
> On Mon, Oct 27, 2025 at 09:34:03AM -0700, Alan Coopersmith wrote:
>> Among the new CVE's published this weekend were these from the VulDB CNA:
>>
>> For all three bugs, the documented "exploit" requires "Replace the default
>> configuration file (/etc/dnsmasq.conf) with the provided malicious file."
>> and if you can replace the server's configuration file you don't need to
>> play games with putting invalid contents in to break the parser, but can
>> simply change the configuration directly.
>
> The same nonsense also happened for the Kamailio SIP server (CVE-2025-12204,
> CVE-2025-12205, CVE-2025-12206 and CVE-2025-12207).
GNU Bison got 2 CVEs assigned that are bogus, CVE-2025-8734 and
CVE-2025-8733.
The report for CVE-2025-8733 has a stack trace that references files
that do not exist in Bison. I'm pretty sure it is some AI hallucination
mixing up Gnulib and glibc, since the stack trace looks like an ancient
glibc version which had assertions there.
Collin
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
