Re: [gentoo-security] [GLVP 200403-01] Gentoo Linux Pending Vulnerabilities

[Tobias Weisserth]

Hi Koon,

Am So, den 28.03.2004 schrieb Koon um 12:34:
> Tobias Weisserth wrote:
...

> Package: Linux kernel
> Subject: do_mremap VMA limit local privilege escalation vulnerability
> GLSA = 200403-02

This is still open in Bugzilla ;-)

http://bugs.gentoo.org/show_bug.cgi?id=42024

> Package: libxml2
> Subject: URI Parsing Buffer Overflow Vulnerabilities
> GLSA = 200403-01

This is still open in Bugzilla too ;-)

http://bugs.gentoo.org/show_bug.cgi?id=42735

> For the others, your report should separate between real pending
> vulnerabilities (not corrected in the tree) and those corrected but
> without GLSA issued.

I orientated myself according to the status of the bugzilla entries.
Maybe this wasn't a good idea because obviously some of the fixed issues
remain open entries in bugzilla. You have to agree that this is somehow
confusing, isn't it? ;-) It seems that at least in those two cases you
found, the bugzilla issues haven't been closed although a GLSA has been
issued? Who is going to fix that?

Thanks for your suggestions and hints.

regards,
Tobias


-- 
***************************************************
   ____  _____
  |  _ \| ____| Tobias Weisserth
  | | | |  _|   tobias@weisserth.[de|com|net|org]
 _| |_| | |___  http://www.weisserth.org
(_)____/|_____|
                
Encrypted mail is welcome.
Key and fingerprint: http://imprint.weisserth.org

***************************************************