Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]

[Mark J Cox <mjc () redhat com>]

> > Based on the above -^ I would vote for separate CVE identifier for expat
> > flaw
> > (and its embedded copies in dozen of packages):
> >
> > https://bugs.gentoo.org/show_bug.cgi?id=280615#c8
> > https://bugs.gentoo.org/show_bug.cgi?id=280615#c10
>
> As far as we understand, the expat flaw in question is in no way related
> to CVE-2009-2625, or other recent XML parser flaws. Therefore our take
> is that it should have a distinct CVE entry.

So use CVE-2009-3720 for this

Mark