oss-sec mailing list archives
Re: CVE Request: LibreOffice -- several issues
From: cve-assign () mitre org
Date: Wed, 26 Nov 2014 02:46:24 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
https://bugs.freedesktop.org/show_bug.cgi?id=86449 Crash importing malformed .rtf -- potentially exploitable for RCE
Use CVE-2014-9093 for bug 86449. (For reference, http://openwall.com/lists/oss-security/2014/11/19/3 is about finding a series of bugs in version 3.5.4 on Debian stable -- in other words, a version based on a mid-2012 codebase -- and reporting them directly upstream without commenting on 4.2.x or 4.3.x.) For the others, in addition to the http://openwall.com/lists/oss-security/2014/11/19/18 post, "Michael Meeks from officesecurity () lists freedesktop org indicated that they are not interested in CVEs for DoS-only crashers" is also relevant. This has multiple possible interpretations, e.g., "not interested" because their security team won't track the issues using CVEs, or "not interested" because they are not vulnerabilities. The "is a security issue because it takes down all other windows with it" is often relevant to CVE because it represents a default security policy if there is no information from a vendor about their security policy. However, a vendor is free to establish a security policy such as "if you are working with a potentially untrusted file, you MUST NOT have any other windows open in which you are maintaining state about your other editing work." In other words, they can define all DoS-only crashers to be applicable only in unsupported use cases. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUdYFGAAoJEKllVAevmvmsaSUH/3uQpWpaK6vMVpN3BrWaj/uS IqjmfqeeyHpUtrOC+zYmFI+1gMXwj4jQvmWz9RB2LFWLWbsn9gLt5xG+0D8CTX6m VWk9PnNnIbfKToWfEu1m0JsvZNolihIiGMwITx8YeSEF4s1DfwkSZIwCx/WBm1/m yRRSJPmyrYlMKA9985c6FphnTQ/+6IteypvdwdX5gfs0L1OEB0UeDbQCqe+0SY3N rnkSZAPLtUDIjUplAI1UlVeh35dCJ1nWuBG+1yUmzJlaz+QSaMR6iUQWcYbpdNfy tBPr+Fhh1ep8SyrLVhjEGGU+sFKJCEUD0iN0J0AC1iRklYOqKOtI4T8VNh2UCOY= =dyEX -----END PGP SIGNATURE-----
Current thread:
- CVE Request: LibreOffice -- several issues Alexander Cherepanov (Nov 18)
- Re: CVE Request: LibreOffice -- several issues timo . warns (Nov 19)
- Re: CVE Request: LibreOffice -- several issues Alexander Cherepanov (Nov 26)
- Re: CVE Request: LibreOffice -- several issues cve-assign (Nov 25)
- Re: Re: CVE Request: LibreOffice -- several issues Alexander Cherepanov (Nov 26)
- Re: [Officesecurity] [oss-security] Re: CVE Request: LibreOffice -- several issues Caolán McNamara (Nov 26)
- CVE Request: LibreOffice -- several issues Alexander Cherepanov (Nov 26)
- Re: [Officesecurity] [oss-security] CVE Request: LibreOffice -- several issues Rene Engelhard (Nov 27)
- Re: Re: CVE Request: LibreOffice -- several issues Alexander Cherepanov (Nov 26)
- Re: CVE Request: LibreOffice -- several issues timo . warns (Nov 19)