Re: 1.2k bug reports for Debian, some may be security

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/26/2013 11:56 PM, Russ Allbery wrote:
> Kurt Seifried <kseifried () redhat com> writes:
>
> > I will of course be doing CVEs for these (*sob*). In order to
> > make this possible though I'm going to need some help in the form
> > of good CVE requests in this case I will be fascist.
>
> I suspect you will not want to be doing CVEs for most of these.
> The ones I've seen so far aren't really security issues.  They're
> cases of command-line programs crashing on input, but usually input
> that is not feasibly under the control of an attacker (command-line
> options provided by the user, etc.).
>
> My guess is that the vast majority of these problems are
> robustness issues, but are not security issues under any reasonable
> threat model that I can think of.

Yup. hence the "Attack outcome (is this a security vulnerability in
other words)". I'm hoping <10% of these are security vulnerabilities.
But anything setuid/setgid, etc.... all sorts of potential for problems.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRy9gNAAoJEBYNRVNeJnmTJuQP/3MxneL9auzCGqT156Qu0A40
njwYBrJBoMXNi8hPyIMJT1USGIWGpYwW4nMi2cGYWZIZU0w+sfuBpKjqtb6VtNp8
tB53S2+5/J3Cnjo0JJWI3EULDD6dh0pExz6YOKKlPv83Hpu7z3w5foSkVCM7ZT+n
TIOIPVnZiwvNxowxe8VdcZN4bwdkbH5GwI7M7O18Mosg+cjBVmTbnUG4UdUQSxk0
6CDYYIm4B6JSssV9Ow1AcDnTe1jcNUWNjhhVOWyp65hYeOgkNQpeoI7jdNl7uad+
hfFrqHXkREDs1nft9RAzqKIFYzHQe/tns0teGZB5dFBh43tZX2XUXKUxsRftyEZw
PWJSCcUB8usaDqcRL3EYg0l5TntyUohV+9ehX2fDHyBmzSdlJoN0OPpyD2ZDH3D4
Y7NA9uQGwakI7+DvLyb3Nxzyo7qEpkO+24z0ZyisiKLaolxeHediQpZE2mYNh31k
+gYYV/20m2/hBwJhLsMgHw811MB2z8fxdxMBL+0WwryFhcjQklLCmrU2aMDh14Wm
8fsO8V8/G39qOepRx76j440vEdCulMOZkrepu+Nk5z/S34FT+joMOrl7iTKGW9WN
lWXy0dkE/3ta1YM3ddHhQumII5HVt01M7LnkzdmZpoGOaklZYG9P7O68eZT+wUFI
6mFMebi9ElH2DFOdTX1x
=HlQ4
-----END PGP SIGNATURE-----