Re: CVE request for Calligra

[Agostino Sarubbo <ago () gentoo org>]

On Saturday 04 August 2012 11:44:33 Jeff Mitchell wrote:
> I don't know what Kurt wants, as he didn't respond to my email.
>
> What information do you want?
Take a look here, an example of CVE description: 
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2677

Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in 
Boost Pool before 3.9 makes it easier for context-dependent attackers to 
perform memory-related attacks such as buffer overflows via a large size 
value, which causes less memory to be allocated than expected.

So, in this case, if you don't provide to any info, what Kurt should write?
 
> What commit code do you want?
Please post the diff between the vulnerable code and the fix so we are sure 
that is a security issue.

-- 
Agostino Sarubbo / ago -at- gentoo.org
Gentoo/AMD64 Arch Security Liaison
GPG: 0x7CD2DC5D

Attachment: signature.asc
Description: This is a digitally signed message part.