oss-sec mailing list archives
Re: firefox 2.0.0.13
From: "Steven M. Christey" <coley () linus mitre org>
Date: Thu, 27 Mar 2008 18:34:02 -0400 (EDT)
On Thu, 27 Mar 2008, Josh Bressers wrote:
Any idea on what Mozilla means by using CVE-2008-1240 in MFSA 2008-18? They already list CVE-2008-1195, which is associated with the Sun advisory, and that seems like the only issue they're really trying to address.That's the one I mailed you about back when I was assigning the CVE ids ;)
Oh, that was like 300 CVE's ago ;-)
The Mozilla advisory doesn't clarify that CVE-2008-1195 is the Sun CVE id for their java advisory: http://sunsolve.sun.com/search/document.do?assetkey=1-66-233326-1
The CVE itself clarifies this, so I guess that's kind of OK.
This flaw is now fixed in both Java and Firefox (it's debatable who is at fault here, both the browser and the JRE were doing silly things). As you gave me the advice that since the codebases are different, they should get separate ids. We can always yank CVE-2008-1240 if you wish and I'll see about getting upstream to remove it from the advisory.
No, I'll keep them split, given the rationale that it's arguably both their fault. I'll try to clarify that in the description for CVE-2008-1240. - Steve
Current thread:
- firefox 2.0.0.13 Jonathan Smith (Mar 25)
- Re: firefox 2.0.0.13 Josh Bressers (Mar 25)
- Re: firefox 2.0.0.13 Vincent Danen (Mar 25)
- Re: firefox 2.0.0.13 Steven M. Christey (Mar 26)
- Re: firefox 2.0.0.13 Josh Bressers (Mar 27)
- Re: firefox 2.0.0.13 Steven M. Christey (Mar 27)
- Re: firefox 2.0.0.13 Josh Bressers (Mar 25)