[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <FC72FC641B949240B947AC6F1F83FBAF33E86965@IMCMBX01.MITRE.ORG>
Date: Thu, 9 Jan 2014 19:05:18 +0000
From: "Christey, Steven M." <coley@...re.org>
To: P J P <ppandit@...hat.com>, Assign a CVE Identifier <cve-assign@...re.org>
CC: oss security list <oss-security@...ts.openwall.com>
Subject: RE: CVE split and a missed file
Some people may be wondering why these CVEs were even split at all, as many of them appear to have exactly the same vulnerability type, affected version, and commit.
For example, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269, CVE-2013-7270, and CVE-2013-7271 are fixed in the same version and are the same type: "updates a certain length value without ensuring that an associated data structure has been initialized."
However, we had information that these files were introduced to the kernel at different times. While we don't list a specific minimum-version in the description, it's apparent that each affects a slightly different range of kernel versions.
CVE-2013-7266 also comes from the same commit, but it's a length inconsistency, so on the surface it's a different vuln type than the others, which could be characterized as a length-calculation and/or initialization error.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
