Re: Re: CVE Request - roundcubemail

[Jan Lieskovsky <jlieskov () redhat com>]

On Tue, 2008-12-16 at 20:31 -0500, Steven M. Christey wrote:
> On Sat, 13 Dec 2008, Florian Weimer wrote:
>
> > * Ingrid wrote:
> >
> > > Therefore, I agree with Raphael that the issue has not been found yet.
>
> The general issue of /e in preg_replace is covered by CWE-624 Executable
> Regular Expression Error (http://cwe.mitre.org/data/definitions/624.html)
> which has a couple other CVE examples.
>
> I bet there's a chunk of these in various applications.  I believe Perl
> has similar functionality.


> Use CVE-2008-5619 for the issue.
>
> Note there's a separate DoS issue, CVE-2008-5620.

Steve, thanks for pointing this out!

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team