|
Message-ID: <4FDB77F6.90209@redhat.com> Date: Fri, 15 Jun 2012 19:59:18 +0200 From: Stefan Cornelius <scorneli@...hat.com> To: oss-security@...ts.openwall.com CC: Kurt Seifried <kseifried@...hat.com>, Jan Lieskovsky <jlieskov@...hat.com>, "Steven M. Christey" <coley@...us.mitre.org>, Behdad Esfahbod <behdad@...dad.org> Subject: Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in terminal dispatcher -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/22/2012 07:39 PM, Kurt Seifried wrote: >> B) vte issue: ============= >> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673871#5 > >> there is similar issue in vte too (Gnome bug private for now): >> https://bugzilla.gnome.org/show_bug.cgi?id=676090 > >> Cc-ed Behdad Esfahbod on this post to clarify, what are the >> upstream plans regarding this report in vte and if the CVE id has >> been already assigned for it. > > Will wait for confirmation. > Hi, I think http://www.openwall.com/lists/oss-security/2012/05/23/6 is a reasonable confirmation. Additionally, upstream fixed this in 0.32.2: http://ftp.gnome.org/pub/GNOME/sources/vte/0.32/vte-0.32.2.news In case you agree that all requirements are fulfilled, could you please assign a CVE to the B) part? Thanks in advance and kind regards, - -- Stefan Cornelius / Red Hat Security Response Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJP23f1AAoJEETwiYCjVSmPUN0H/1NUI3DHZkJkm3wTR36/YBd1 huq4Hxbtidvj/rm1ojXNkBNU+oyYLHV1fID79jt9y5TuQZs6erkHQXjsw8LzoGbl Oc71epwlnon5sE7SFOJ8AvEBRzHXldeBOHkTKd2J7YkSu+RK4oM+qUh6ZWxVA0Ac vdlhYkdHZZIpodOIXV281qNkM9SGG1UmQ5uKQaUGmEfH2AuvqyIq4+RdZb3howSw mlniH5k1uGUNKGCwXaeaz8Oza6qhXJz3pTvv/09ZQJqApHd7BSkOyyGIAgNLk5FQ KO5u+WBpJRoTzgw5cqyVVGWTtP0GM/O/zlgYR2shuOHEXvGLcqMP/Hd+E/PblRY= =qBFl -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.