[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <555068E0.4050904@fedoraproject.org>
Date: Mon, 11 May 2015 10:31:28 +0200
From: Remi Collet <remi@...oraproject.org>
To: oss-security@...ts.openwall.com
Subject: Re: About PHP and CVE-2015-1353 - please REJECT
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Can you please reject this CVE.
Thanks,
Remi.
Le 05/05/2015 10:07, Remi Collet a écrit :
> Hi,
>
> Can someone explain how this can be a security issue, and why
> scored as "high" risk ?
>
>
> On bad input, the call will produce a bad output.
>
> I don't see any way to exploit this for any bad thing.
>
> I really think we should reject this CVE. Upstream doesn't even
> consider this as a bug.
>
>
> Remi.
>
>
> P.S.
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1353
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlVQaOAACgkQYUppBSnxahhDBACfS+avTYdrTvAy7pUrhZFTmDxw
OMgAnA860MMJK7j24lWmK9bqkfn/2Q6a
=l2P8
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
