oss-sec mailing list archives
Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL)
From: Alessandro Ghedini <alessandro () ghedini me>
Date: Tue, 19 May 2015 12:16:45 +0200
On Tue, May 19, 2015 at 09:05:59AM +0200, Tomas Hoger wrote:
On Tue, 5 May 2015 09:19:20 +0100 Pedro Ribeiro wrote:tl;dr heap and integer overflows in ICU, many packages affected, unknown if these can be exploited or not - everyone names vulns nowadays, so I name these I-C-U-FAIL....#1 Vulnerability: Heap overflow CVE-2014-8146...#2 Vulnerability: Integer overflow CVE-2014-8147Apparently a typo was made when fixing these issues in Ubuntu and subsequently in Debian when ids with year 2015 were used instead of 2014.
Note that as far as Debian is concerned, the only place where incorrect IDs were used is the bug report you linked (which has now been fixed). The changelog of the upload to Debian unstable had the correct IDs, and we haven't released a DSA yet (the information on our security tracker is also correct). Cheers
Attachment:
signature.asc
Description: Digital signature
Current thread:
- [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL Pedro Ribeiro (May 05)
- CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) Tomas Hoger (May 19)
- Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) Alessandro Ghedini (May 19)
- Re: CVE reject request CVE-2015-8146/8147 Marc Deslauriers (May 19)
- Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) cve-assign (May 19)
- CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) Tomas Hoger (May 19)