[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1334838787.23713.29.camel@Brinn>
Date: Thu, 19 Apr 2012 13:33:07 +0100
From: Caolán McNamara <caolanm@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
officesecurity@...ts.freedesktop.org,
David Tardon <dtardon@...hat.com>, Miklos Vajna <vmiklos@...e.cz>,
Carlo Di Dato <shinnai@...istici.org>
Subject: Re: [Officesecurity] CVE Request (minor) -- LibreOffice (X >=
v3.5.0): DoS (excessive CPU use) in the RTF tokenizer
On Thu, 2012-04-19 at 14:14 +0200, Jan Lieskovsky wrote:
> Though Caolán , Miklos or LibreOffice upstream can clarify further if
> this should be considered to be a security flaw (due to internal
> implementation details I am not aware of and might lead to memory
> corruption announced at [7]).
nah, insta-crash with a -1 passed to new(...) so throws bad_alloc,
"safe" crash.
> But as noted earlier, I don't think this is a security flaw, which
> should get a CVE identifier.
indeed.
> [8] https://bugs.freedesktop.org/show_bug.cgi?id=48640#c1 ('DoS PoC')
>
> This one (on LibreOffice >= v.3.5.0 using the new RTF tokenizer implementation)
> truly leads to denial of service (excessive CPU consumption and hang) while
> trying to process that RTF file. So this case might be applicable
> for CVE-2012-* identifier assignment.
Dunno about this, I mean if we're going to go around assigning CVEs to
every busy-hang we'd be knee deep in CVEs by the end of a week.
C.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
