Re: Re: CVE request for Calibre

["Jason A. Donenfeld" <Jason () zx2c4 com>]

Just do clarify: Issues 1 through 7.1 (8 issues) were released with the
current version that has been out for quite some time now. These require a
CVE. Issues 8 through 14 are ones introduced only during development and
were not released, and do not need a CVE.

On Fri, Nov 4, 2011 at 16:51, Steven M. Christey
<coley () rcf-smtp mitre org>wrote:

> All,
>
> I haven't followed the Calibre saga too closely, barring glancing through
> the bug report comments.
>
> If bugs are introduced into a development version but also fixed within
> that same version, then unless there's some strong evidence that the dev
> version is extensively used or distributed to the public, then (in general)
> it would not get a CVE.  (The Linux kernel is a special case depending on
> what versions you consider to be "development.")
>
> - Steve