-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > https://bugzilla.redhat.com/show_bug.cgi?id=1060630#c5 > > * Fri Jan 05 2001 Preston Brown <pbr...@redhat.com> > - security patch for tmpfile creation from Olaf Kirch <o...@lst.de> > > followed the next month by a fix to that patch: > > * Mon Feb 12 2001 Tim Waugh <twa...@redhat.com> > - Fix tmpfile security patch so that it actually _works_ (bug #27155).
Does anyone have information indicating that two CVE-2001-#### IDs are needed to cover the discoveries by Olaf Kirch and Tim Waugh 13 years ago? This would be the case if, for example, there was a January 2001 a2ps package that fixed part of the problem with temporary files. Admittedly, the practical value of two CVE-2001-#### IDs at present may be extremely small. The information does not seem to be in a2ps.git because data before 2004 is unavailable, e.g., http://pkgs.fedoraproject.org/cgit/a2ps.git/log/?ofs=100 Also: https://bugzilla.redhat.com/show_bug.cgi?id=27155 You are not authorized to access bug #27155. If (as we would expect) nobody is interested in checking that, we will assign one CVE-2001-#### ID. Finally, the earlier abstraction question is no longer relevant because Jakub Wilk is apparently not the original discoverer of any part of the problem. Specifically, this question: The original report notes there are calls to tempname_ensure(). If any of those are found to be vulnerable, would they use the same CVE number, or require a different one? would only apply to a situation in which the spyname problem was a new discovery in 2014. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS8PuRAAoJEKllVAevmvmsavAH/35erOpFeVh3fjUXXGdlJBVN XzXwdKV6e+joCBJ2hYQ8+os5c19zFNdYcoAz8ay4DKdD9wEHUUiDjZDAhG1rWmDW ji3I8Bbi3aMmZwaKqJwv3GYWVAOr6QzTuvKJoPVl835jF7Od1FUWeEaMPPqZmI9s mwPp4eC4CjlVz8ldCgZdU+tiUZojJjl5wFBn/lnYsdfLisJ5mCi1YScMt3p5zZVE FkXNu5MhFLEtfeQF2BUe3HLsk/UtNEq8T0cMsaNdIbckkFGKxiNiRfK8QGBHGRIp KuFEoEufFAT0BNRMvHix4MFbYT+a2SKuC5lbrRa7jbyMWh9meRxze/s9UePtEno= =cx5F -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
