[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20120419164122.GB23313@inutil.org>
Date: Thu, 19 Apr 2012 18:41:22 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
officesecurity@...ts.freedesktop.org,
David Tardon <dtardon@...hat.com>, Miklos Vajna <vmiklos@...e.cz>,
Carlo Di Dato <shinnai@...istici.org>
Subject: Re: Re: [Officesecurity] CVE Request (minor) --
LibreOffice (X >= v3.5.0): DoS (excessive CPU use) in the RTF
tokenizer
On Thu, Apr 19, 2012 at 01:33:07PM +0100, Caolán McNamara wrote:
> > [8] https://bugs.freedesktop.org/show_bug.cgi?id=48640#c1 ('DoS PoC')
> >
> > This one (on LibreOffice >= v.3.5.0 using the new RTF tokenizer implementation)
> > truly leads to denial of service (excessive CPU consumption and hang) while
> > trying to process that RTF file. So this case might be applicable
> > for CVE-2012-* identifier assignment.
>
> Dunno about this, I mean if we're going to go around assigning CVEs to
> every busy-hang we'd be knee deep in CVEs by the end of a week.
I agree. For an application profile such as an office suite handing out CVE
IDs to crash/CPU overload bug w/o potential of code injection is a waste
of time and impractical.
Cheers,
Moritz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
