[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e5b16547-bf38-4312-8b8b-c5c230d39110@oracle.com>
Date: Sat, 21 Mar 2026 13:49:22 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Buffer overflow in /bin/su from UNIX v4
On 3/21/26 11:00, Solar Designer wrote:
> On Sat, Mar 21, 2026 at 01:13:47PM -0400, kf503bla@...k.com wrote:
>> why assign cve to something irrelvent?
I was just reporting that it had been assigned, and wasn't part of the
decision to issue it, but CVE's have never been limited to things that
are relevant, and there are many existing irrelevant CVE's already.
CVE's just require that the vulnerability be known - while many people
misuse CVE's as a "things that are important to fix" list, they were
always intended to just be a common name that can be used in discussion.
I'm actually a little surprised this one didn't get the "Unsupported when
assigned" tag that is often given to CVEs for out-of-date software.
> That said, I'm sure there are other cases of historical vulnerabilities
> that never got CVEs. Some were known prior to the CVE program start, so
> would need CVEs from before 1999. I think there's some value in that,
> but it would be a change. CVEs were not assigned for pre-1999 findings
> so far.
If you look at the early CVE-1999 entries you will see some issued for
pre-1999 findings, such as CVE-1999-0129 for a sendmail vulnerability
that CERT published an advisory for in 1996, or CVE-1999-0113 for the
classic rlogin -froot bug that CERT published an advisory for in 1994.
(You'll also find some that would never be issued today, as they're not
bugs in software, but weaknesses in configurations, like having rlogin
enabled, or X11 set to accept unauthenticated connections via 'xhost +'.)
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
