[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9151rn19-0on4-96s6-p3oq-qq07188p9n0r@vanv.qr>
Date: Mon, 12 Jan 2026 10:42:33 +0100 (CET)
From: Jan Engelhardt <ej@...i.de>
To: oss-security@...ts.openwall.com
cc: Alan Coopersmith <alan.coopersmith@...cle.com>
Subject: Re: Null Pointer Dereference in HarfBuzz
On Monday 2026-01-12 04:09, Jacob Bachmeyer wrote:
>
> In short, this is a crash bug, but not a security issue. This is different
> from (for example) a parser bug that results in NULL being dereferenced if
> crafted input is processed.
>
> Are we now using CVE IDs as some kind of global bug tracker?
Isn't that how the Linux kernel works these days,
as per <https://docs.kernel.org/process/cve.html>:
"almost any bug might be exploitable to compromise the security of
the kernel, but the possibility of exploitation is often not evident
when the bug is fixed"
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
