[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH8yC8kG=8ciELe8K+Po9xpaq=gpdeKqUz5rx2KvLccV2zz9vQ@mail.gmail.com>
Date: Fri, 14 Nov 2025 09:31:48 -0500
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Questionable CVE's reported against dnsmasq
On Fri, Nov 14, 2025 at 1:44 AM Peter Gutmann <pgut001@...auckland.ac.nz> wrote:
>
> Jacob Bachmeyer <jcb62281@...il.com> writes:
>
> >Ah yes, the universal arbitrary code execution exploit: simply replace the
> >program text with malicious code. :-)
> >
> >Can we call it CVE-Zero? :-P
>
> The best one I've run into is enabling an undocumented internal build option
> that turns on extra code for coverage/fuzz testing, then reporting it as a
> vuln while ignoring the fact that the debug code also implements SSLKEYLOGFILE
> which dumps the plaintext TLS master secret to the diagnostic output.
>
> Aside from the OpenSSH pseudovulnerability that started all this, anyone else
> have any interesting stories?
Crypto++ earned a CVE for documentation: CVE-2016-7420,
<https://seclists.org/oss-sec/2016/q3/520>.
Folks outside the project ported the Crypto++ library to another build
system, but did not use the same build flags that Crypto++ uses. Then
an assert fired because the ported build was a debug build. Crypto++
caught a CVE for a DoS. The CVE folks told the Crypto++ library that
the behavior should have been documented.
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
