oss-sec mailing list archives
Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552)
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Mon, 10 Sep 2012 13:51:42 -0400 (EDT)
Hi Florian, thank you for the clarification.
On 09/07/2012 07:21 PM, Kurt Seifried wrote:2) Issue #2 (mentioned here only for completeness, but I am not of the opinion this should receive a CVE identifier. See argumentation below [but open to glibc upstream / others to disprove it]).I will hold off on issuing a CVE for this then. Anyone want to weigh in? It looks as if the alloca issue was introduced at the same time as the malloc-related overflow: http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5358d026c74 So perhaps one CVE is enough for glibc bugs 14552 and 14547 because the problems are similar and affect the same versions.
Should the alloca() issue get CVE identifier, then I would rather use two CVE identifiers. Though those issues might affect same glibc versions, one is integer overflow, leading to heap-based buffer overflow, while the alloca() one would be stack-based buffer overflow. So to clearly identify, it would be better if the second one would be allocated too (if Steve won't mind). Kurt, could you allocate yet one then? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
-- Florian Weimer / Red Hat Product Security Team
Current thread:
- CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Jan Lieskovsky (Sep 07)
- Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Kurt Seifried (Sep 07)
- Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Jeff Law (Sep 07)
- Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Florian Weimer (Sep 10)
- Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Jan Lieskovsky (Sep 10)
- Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Kurt Seifried (Sep 13)
- Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552) Kurt Seifried (Sep 07)