[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50503B3E.6000004@redhat.com>
Date: Wed, 12 Sep 2012 09:35:26 +0200
From: Florian Weimer <fweimer@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com,
Oracle Security Team <secalert_us@...cle.com>
Subject: Re: CVE Request (minor) -- JVM: heap memory disclosure
(possibly various JDKs)
On 09/11/2012 11:37 PM, Steven M. Christey wrote:
> I wonder about the severity of the issue, but given the possibility that
> applications might access an array before a fill, and applications may
> depend on there being "empty" elements after initialization, this seems
> reasonable for a CVE.
My main concern is that untrusted code (in an applet or application
server) could use this issue to access private data which was previously
stored at the same location.
--
Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
