On 3 February 2016 at 06:19, Yuanjie Huang <[email protected]> wrote:
> From: Yuanjie Huang <[email protected]> > > According to http://seclists.org/oss-sec/2016/q1/153 > > CVE-2015-8777 > > LD_POINTER_GUARD was an environment variable which controls > security-related behavior, but was not ignored for privileged binaries > (in AT_SECURE mode). This might allow local attackers (who can supply > the environment variable) to bypass intended security restriction. > Ref: https://sourceware.org/bugzilla/show_bug.cgi?id=18928 > > CVE-2015-8779 > > A stack overflow (unbounded alloca) in the catopen function can cause > applications which pass long strings to the catopen function to crash > or, potentially execute arbitrary code. > Ref: https://sourceware.org/bugzilla/show_bug.cgi?id=17905 > We're trying to annotate patches that fix CVEs now, so can you add eg CVE: CVE-2015-8777 tag alongside the signed-off-by and upstream-status? Cheers, Ross
-- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
