[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20141107010033.3B1586C0029@smtpvmsrv1.mitre.org>
Date: Thu, 6 Nov 2014 20:00:33 -0500 (EST)
From: cve-assign@...re.org
To: oss@...ernot.info
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> A format string vulnerability vuln has been found in the latest version
> of dpkg.
> https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135
>> package 'backup:01f15700.00431828.00000001.00000001.0000001a':
>> '%08x.%08x.%08x.%08x.%08x
> The vulnerable function, warningv([..]), is called in many other places,
> and is not limited to '-i'.
Use CVE-2014-8625. We're aware of "does not show evidence of allowing
attackers to cross privilege boundaries" in
https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135/comments/2 --
we'll certainly look for any discussion on this list that disputes the
CVE.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUXBjtAAoJEKllVAevmvmsQ0sH/19C6CPOWWM6y6vWaomyuflF
qyYSj/6bfNCzlruNKgD+WvHehhNd1L3VgmWHzjGAmOAvBAlyLHvUVRaFaQ7idk4B
+D42vblcsM4vHg8tSg3RLyDjEU9ptn0VbYPZJdOW54ByOhhadIMtj2r5MW/vgdDq
2FIeezr1WGENliUMxGCakYeReGh5LOL/djG6ZIXjOjazkjzyWXkuSU48jysQRu43
gBo5jv6GFPHIknNvhrCTOFApfc2eh6WcAPkwaivywzCc0its52wrxFopphp0KPFl
bN69HEKAcJ/dNBEeQLry4Bpe1XD2CrVVv64zKRCPPf3ZLxZ/pIHjhWQgO04I7No=
=AzqO
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
