full-disclosure - 1 year to fix a critical vuln [WAS: Heap Overflow in Oracle 9iAS .....]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200404081657.i38Gv3Pv016890@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: 1 year to fix a critical vuln [WAS: Heap Overflow in Oracle 9iAS .....] 

On Thu, 08 Apr 2004 16:18:12 -0000, Hugh Mann <hughmann@...mail.com>  said:

> Which company will be first to wait 2 years to fix a vuln?

Already happened.

> Subject:              UnixWare 7.1.2 Open UNIX 8.0.0 UnixWare 7.1.1 UnixWare 
7.1.2 : exploitable buffer overrun in metamail
> Advisory number:      CSSA-2003-SCO.15
> Issue date:           2003 August 15

As far as I can tell, these are the same holes that Alan Cox fixed
in the RedHat distrib version of metamail in June 1998.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040408/2b2d7ccf/attachment.bin