[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20141126074624.DB5BE336017@smtpvbsrv1.mitre.org>
Date: Wed, 26 Nov 2014 02:46:24 -0500 (EST)
From: cve-assign@...re.org
To: cherepan@...me.ru
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: LibreOffice -- several issues
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://bugs.freedesktop.org/show_bug.cgi?id=86449
> Crash importing malformed .rtf -- potentially exploitable for RCE
Use CVE-2014-9093 for bug 86449.
(For reference, http://openwall.com/lists/oss-security/2014/11/19/3 is
about finding a series of bugs in version 3.5.4 on Debian stable -- in
other words, a version based on a mid-2012 codebase -- and reporting
them directly upstream without commenting on 4.2.x or 4.3.x.)
For the others, in addition to the
http://openwall.com/lists/oss-security/2014/11/19/18 post, "Michael
Meeks from officesecurity@...ts.freedesktop.org indicated that they
are not interested in CVEs for DoS-only crashers" is also relevant.
This has multiple possible interpretations, e.g., "not interested"
because their security team won't track the issues using CVEs, or "not
interested" because they are not vulnerabilities. The "is a security
issue because it takes down all other windows with it" is often
relevant to CVE because it represents a default security policy if
there is no information from a vendor about their security policy.
However, a vendor is free to establish a security policy such as "if
you are working with a potentially untrusted file, you MUST NOT have
any other windows open in which you are maintaining state about your
other editing work." In other words, they can define all DoS-only
crashers to be applicable only in unsupported use cases.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUdYFGAAoJEKllVAevmvmsaSUH/3uQpWpaK6vMVpN3BrWaj/uS
IqjmfqeeyHpUtrOC+zYmFI+1gMXwj4jQvmWz9RB2LFWLWbsn9gLt5xG+0D8CTX6m
VWk9PnNnIbfKToWfEu1m0JsvZNolihIiGMwITx8YeSEF4s1DfwkSZIwCx/WBm1/m
yRRSJPmyrYlMKA9985c6FphnTQ/+6IteypvdwdX5gfs0L1OEB0UeDbQCqe+0SY3N
rnkSZAPLtUDIjUplAI1UlVeh35dCJ1nWuBG+1yUmzJlaz+QSaMR6iUQWcYbpdNfy
tBPr+Fhh1ep8SyrLVhjEGGU+sFKJCEUD0iN0J0AC1iRklYOqKOtI4T8VNh2UCOY=
=dyEX
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
