oss-sec mailing list archives
Re: suckless sent and libxft-dev 2.3.2-1 crash
From: Alan Coopersmith <alan.coopersmith () oracle com>
Date: Tue, 17 Nov 2015 08:04:46 -0800
On 11/16/15 02:47 PM, Simon . wrote:
please review, whether this needs a CVE.
I can't speak for Mitre or any other CNA's, but I can speak for the security team at X.Org, which is responsible for libXft and would need to put out a security advisory if there is a CVE in it. From our point of view, there's too little information here to determine, and that's after I went out and tracked down what the hell "sent" does (when asking for CVE's for programs that aren't very popular and have names that are hard to google because they're also common words, it helps to provide some background). It's also generally useful to have a root cause determined first, so someone knows which software to track the CVE against - would this be a CVE against libXft for mishandling data, or a CVE againt the "sent" program or some other library for not adequately verifying data from a source it shouldn't have trusted? Is libXft actually at fault or is it the victim of memory corruption that happened before the call? Is there any trust or privilege boundary being crossed here? If a user can crash a program running as themselves, it's a bug, but they can also kill -SEGV it, so it's not letting them do anything they shouldn't be able to. Why do you think this might deserve a CVE? -- -Alan Coopersmith- alan.coopersmith () oracle com X.Org Security Response Team - xorg-security () lists x org
Current thread:
- suckless sent and libxft-dev 2.3.2-1 crash Simon . (Nov 16)
- Re: suckless sent and libxft-dev 2.3.2-1 crash Tim (Nov 16)
- Re: suckless sent and libxft-dev 2.3.2-1 crash Agostino Sarubbo (Nov 17)
- Re: suckless sent and libxft-dev 2.3.2-1 crash Alan Coopersmith (Nov 17)