Re: CVE request: PHP MOPS-2010-56..60

["Steven M. Christey" <coley () linus mitre org>]

On Tue, 24 Aug 2010, Tomas Hoger wrote:

> Standard practice is to use new CVE.  As all 5 phar MOPS were covered
> under single CVE, and not all of them were fixed in 5.3.3, I'd expect a
> new "incomplete fix" CVE.

That's appropriate in this case.  I'll let Josh assign a CVE to avoid the 
possibility of dupes.

General practice (subject to modification on a case-by-case basis) is:

- issue was never fixed and never claimed to be fixed: use original CVE
  (probably triggers an update to description for affected versions)

- issue was claimed fixed but the fix was incomplete: use new CVE

- issue was never fixed but claimed to be fixed: ??? (it's happened a few
  times)



- Steve