[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141127020825.11783b95@pc>
Date: Thu, 27 Nov 2014 02:08:25 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request: buffer overflow in
ksba_oid_to_str in Libksba
On Wed, 26 Nov 2014 02:38:50 -0500 (EST)
cve-assign@...re.org wrote:
> > Due to the unsigned integer this results in a pretty long value
> > which won't fit anymore into the allocated buffer.
>
> Use CVE-2014-9087.
Please note that this affects both libksba and gnupg (only version
2.1.0 and betas).
They share the code, but it's in different products, I don't know if
this means 2 CVEs should be assigned.
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
