[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20151030002628.DBC7F3AE002@smtpvbsrv1.mitre.org>
Date: Thu, 29 Oct 2015 20:26:28 -0400 (EDT)
From: cve-assign@...re.org
To: hanno@...eck.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Two out of bounds reads in Zstandard / zstd
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> https://blog.fuzzing-project.org/26-Two-out-of-bounds-reads-in-Zstandard-zstd.html
Although this research is enormously helpful to Zstandard development
(e.g., see the
https://github.com/Cyan4973/zstd/issues/49#issuecomment-150550342
comment), we feel that it may be outside the scope of CVE because
Zstandard cannot yet be considered a "product."
> https://github.com/Cyan4973/zstd/blob/master/README.md
> Zstd has not yet reached "stable" status. Specifically, it doesn't
> guarantee yet that its current compressed format will remain stable
> and supported in future versions. ... "Stable Format" is projected
> sometimes early 2016
> you can now safely test zstd
> http://fastcompression.blogspot.com/2015/01/zstd-stronger-compression-algorithm.html?showComment=1423604634493#c3703448798429358177
> this format is not yet considered stable.
> The objective is to make it stable by year end.
> When it will be, the library number will become 1.0.
Also, we think that Zstandard is, for example, not shipped in any
well-known Linux distribution. When a piece of code is offered
primarily for testing, discoveries of exploitable problems often have
low interest among CVE consumers.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJWMrghAAoJEL54rhJi8gl5jG8QAKCtCDxmIg6rOIa0STH/Oub5
+WyiNy2Zb5Soo7H1BqfNYlKQw/zqzqWuRwirh2B6smE8UlC4aRhLZOZ0tMcjejc+
xYcb5LAHu/TAutHGBRijc/Y5Uq/0MHTNGpinoeKePhnVimoEiWA80ogg01EbGKKz
Opdth3qkIuxGno3eVPfu6aqiGxNSH9eLbP+x9EHKKAUOXni2+MxyzDr4wMfCclow
9MRGGza0wmdKU+WDFZVjTehUX73Y84iE4FXROomujTJpmcK2dE28Oxojv5wMqQQ6
++z/EjRnr5AJNwD7NPUxO1EItLl2LRHrtFkQSz4XMZ9qE2VVuuL/0BOKPZyAvGrj
LKRdOi5yz7tOJvGTqDY4YhoY71qPn0N9OHPEjTzlWcSl4AH3VC+FiDUGaf2hlvqP
pZv0OIUxVKAtVXtpYTzH+HFmT7Ipt/hoouQ/uZ8WWQYDNDU2Xt5xvV77kL5RfXI2
7suqCVm7gahbsSeUu6ar3a+OGUeDRAkdgkGqio4Vvq8bGv/nmPdvJ09Ic/HiDfKB
qB326B44jSWJHT3WSqZHMhe7z2qB4E8Ig4koImTJIqAjZ6FpIMdNoeTZoYHPYZWi
pJL6XMmDZh9nbdGoFjWEmd9aRlNeXa2xJe3voKH4apP2KJoEZvvGwesfreM9824q
9GG9dNISuT0LZvDknrYN
=o5EY
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
