Cve issue discussion

[ne xo <nexo123 () outlook kr>]

Hello,


I am curious about issuing CVEs.

I can see that a "NULL pointer dereference" or a bug where the exploit has not been verified also get a CVE.


heap-overflows may or may not be exploitable.


It takes a lot of time to analyze the exploit and create the exploit code.


Is it right to be assigned a CVE only if it is exploitable?


Or do you think all bugs need to get a CVE?


Thanks.

---

ref

---

[1]http://www.openwall.com/lists/oss-security/2017/04/10/17 - NULL pointer dereference
[2]http://www.openwall.com/lists/oss-security/2017/04/10/15 - memory allocation failure