oss-sec mailing list archives
Re: Two out of bounds reads in Zstandard / zstd
From: cve-assign () mitre org
Date: Thu, 29 Oct 2015 20:26:28 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
https://blog.fuzzing-project.org/26-Two-out-of-bounds-reads-in-Zstandard-zstd.html
Although this research is enormously helpful to Zstandard development (e.g., see the https://github.com/Cyan4973/zstd/issues/49#issuecomment-150550342 comment), we feel that it may be outside the scope of CVE because Zstandard cannot yet be considered a "product."
https://github.com/Cyan4973/zstd/blob/master/README.md
Zstd has not yet reached "stable" status. Specifically, it doesn't guarantee yet that its current compressed format will remain stable and supported in future versions. ... "Stable Format" is projected sometimes early 2016
you can now safely test zstd
http://fastcompression.blogspot.com/2015/01/zstd-stronger-compression-algorithm.html?showComment=1423604634493#c3703448798429358177
this format is not yet considered stable. The objective is to make it stable by year end. When it will be, the library number will become 1.0.
Also, we think that Zstandard is, for example, not shipped in any well-known Linux distribution. When a piece of code is offered primarily for testing, discoveries of exploitable problems often have low interest among CVE consumers. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWMrghAAoJEL54rhJi8gl5jG8QAKCtCDxmIg6rOIa0STH/Oub5 +WyiNy2Zb5Soo7H1BqfNYlKQw/zqzqWuRwirh2B6smE8UlC4aRhLZOZ0tMcjejc+ xYcb5LAHu/TAutHGBRijc/Y5Uq/0MHTNGpinoeKePhnVimoEiWA80ogg01EbGKKz Opdth3qkIuxGno3eVPfu6aqiGxNSH9eLbP+x9EHKKAUOXni2+MxyzDr4wMfCclow 9MRGGza0wmdKU+WDFZVjTehUX73Y84iE4FXROomujTJpmcK2dE28Oxojv5wMqQQ6 ++z/EjRnr5AJNwD7NPUxO1EItLl2LRHrtFkQSz4XMZ9qE2VVuuL/0BOKPZyAvGrj LKRdOi5yz7tOJvGTqDY4YhoY71qPn0N9OHPEjTzlWcSl4AH3VC+FiDUGaf2hlvqP pZv0OIUxVKAtVXtpYTzH+HFmT7Ipt/hoouQ/uZ8WWQYDNDU2Xt5xvV77kL5RfXI2 7suqCVm7gahbsSeUu6ar3a+OGUeDRAkdgkGqio4Vvq8bGv/nmPdvJ09Ic/HiDfKB qB326B44jSWJHT3WSqZHMhe7z2qB4E8Ig4koImTJIqAjZ6FpIMdNoeTZoYHPYZWi pJL6XMmDZh9nbdGoFjWEmd9aRlNeXa2xJe3voKH4apP2KJoEZvvGwesfreM9824q 9GG9dNISuT0LZvDknrYN =o5EY -----END PGP SIGNATURE-----
Current thread:
- Two out of bounds reads in Zstandard / zstd Hanno Böck (Oct 24)
- Re: Two out of bounds reads in Zstandard / zstd cve-assign (Oct 29)