oss-sec mailing list archives
Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip
From: Solar Designer <solar () openwall com>
Date: Thu, 8 Feb 2018 22:23:10 +0100
On Thu, Feb 08, 2018 at 08:19:20AM +0100, SEC Consult Vulnerability Lab wrote:
2018-01-17: Informing distros () vs openwall org about the upcoming advisory. 2018-02-01: Received CVE numbers. 2018-02-07: Publication of the advisory
Thanks for including the timeline. So this is a violation of the distros list policy on maximum embargo time. Per list policy the reporter must have made the issue public in at most 14 days, and per the tasks the distros had volunteered for Gentoo (primary) and Amazon (backup) should have been posting reminders for this to happen. Instead, other distros posted such reminders (thanks!) when it was already too late. As list admin, I apologize for allowing this delay. Yet I am not going to watch the watchers all the time, which would be quite pointless (if I were to do that, I could as well be taking care of all the tasks myself, without asking the distros to volunteer for any). Gentoo have already acknowledged the omission, and are taking measures. I haven't heard from Amazon on this yet. Alexander
Current thread:
- SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip SEC Consult Vulnerability Lab (Feb 08)
- Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip Solar Designer (Feb 08)
- Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip Leo Famulari (Feb 12)