oss-sec mailing list archives
Re: Re: libass ass_outline.c signed integer overflow
From: Salvatore Bonaccorso <carnil () debian org>
Date: Fri, 20 Nov 2020 07:33:21 +0100
Hi Ian, On Thu, Nov 19, 2020 at 06:15:28PM -0800, Ian Zimmerman wrote:
On 2020-11-19 11:54, David A. Wheeler wrote:I read through the issue discussion. As best as I can tell, no one filed for a CVE, so there was no CVE. Did I misunderstand something? If my understanding is correct, that is *NOT* a failure of the CVE process.As it often happens to me, what I wrote was too brief to be clear to everyone. The longer version would be something like: This is an example of a situation where no one filed for a CVE because of perceived hurdles in the process, even if the facts didn't justify the perception. Now of course Moritz tells us there is in fact a CVE and indeed I can locate the issue in Debian's security tracker. I guess it has been judged not serious enough to need fixing in buster. I disagree but clearly that is up to the maintainers.
What the no-dsa tag means: The issue will not warrant a dedicated security upload with an advisory, but issues marked so called 'no-dsa' can still be fixed as well in buster, via the regular point releases (for instance the next one happing on 5th of december). This though still requires someone to have spare resources and prepare an actual upload to be included. Hope this helps, Regards, Salvatore
Current thread:
- Re: libass ass_outline.c signed integer overflow Ian Zimmerman (Nov 18)
- Re: libass ass_outline.c signed integer overflow David A. Wheeler (Nov 19)
- Re: libass ass_outline.c signed integer overflow Moritz Mühlenhoff (Nov 19)
- Re: libass ass_outline.c signed integer overflow Ian Zimmerman (Nov 19)
- Re: Re: libass ass_outline.c signed integer overflow Salvatore Bonaccorso (Nov 19)
- Re: libass ass_outline.c signed integer overflow David A. Wheeler (Nov 19)