[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <50E139C0.2070209@redhat.com>
Date: Mon, 31 Dec 2012 00:07:44 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Marko Lindqvist <cazfi74@...il.com>
Subject: Re: About CVE-2012-5645
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/30/2012 04:05 AM, Marko Lindqvist wrote:
> On 30 December 2012 05:48, Kurt Seifried <kseifried@...hat.com>
> wrote:
>> Hmm I'm waffling here. The issues are the same version/reporter,
>> roughly the same, can you post the http://cwe.mitre.org/
>> identifiers for these two issues? If they are different enough
>> this might warrant a CVE split but for now I'm leaving it
>> merged.
>
> Yes, had it fixes for both parts listed from the start, there
> would be no problem. The problem is the confusion over where
> CVE-2012-5645 is really fixed. Based on the original description
> here some distributions claim CVE-2012-5645 fixed now that they
> have applied one patch only. If you just add second fix to
> CVE-2012-5645, there will be no way of telling if particular logmsg
> about "CVE-2012-5645 fixed" means it's fixed completely, or only
> half of it.
>
>
> - ML
Please continue to use CVE-2012-5645 for
http://svn.gna.org/viewcvs/freeciv?view=revision&revision=21701
Added return value indicating success or failure for all dio_get_xxx()
functions, and check that value to avoid infinite loop in reading arrays
from network when there's no more data even though it's expected.
For
http://svn.gna.org/viewcvs/freeciv?view=revision&revision=21672
Sanity check packet length received over network against values
less than header length alone to avoid situation where body length
is considered negative.
Please use CVE-2012-6083 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQ4Tm/AAoJEBYNRVNeJnmT76UP/RP0N5OotsXH9xFCM8L2iNGF
oTd7NoC9Z+XKi+VDoAs+EEJnd1FLZi/D6NlavqSThQRXrDEWPILvwYFUMx/BwHav
WCt0pwHnj4u+mF0bEMmqgqHjvNjMSQBJTldml29+2rtIHRw9RVr8FDJCzGa7jaKG
UoQNYCEI7NMZMTgmVIYdH4lXzRYaROE6JgEjRHL3PblNqsTd0NWZcJsFMzEDuoco
2yvDpbabHbW8tjPxYvlZwTJkxwr35PSCAA0qQYLCyf++KE907j57vwzdQ11V7A5h
3035JFAErLOt6LxxXwbpBtvTsdF4glvBZcwSI6eUA6LJA/w03iX+YiR/HGjoSOg3
tMEow8ZUAeZagZjzBf1ErUS8Caoqldr6jv0pVw0+wpABlhCM7KcYjmqx42/9rlt3
ceaRXWMJFtnHlD4Hw1YS+KTMovuFLYWXyIIOqlxUkMSXpKjBpxwXCS5OVPjuHwd2
Oy28dQy9i0l0ceCstK2amx453f7aR7JL+LuOc4c9Zrm/FPcViX7ZNpFGgV9N6Kr/
kpz3QlNQVfPNp4yNTOT/AfyoseWIYFlEbjva7g1FbMadyFsCijJfqTyWLL8apQqR
XKQXt+xrhtpLyqCKlQmN/S8kXowdFQEnTXtsJ/Z7yQKGHK/BSC355JXYRXiib5I3
a9RSRwP3Yswh5rHoFht/
=oRcq
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
