This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: tree freezing...
On Tue, 20 Nov 2012, Jeff Law wrote:
> There's the long standing DOS CVE issue in the RPC code that I wanted to post
> last week (but didn't have the time) and an unbound alloca in ncsd that needs
> to be wrapped up, but those are both long standing problems and can wait.
There are more likely security issues as well, but I don't know if anyone
is working on them. At least bugs 1291 (regex integer overflows) and
14547 (strcoll / strxfrm integer and alloca overflows) are likely of
security relevance.
--
Joseph S. Myers
joseph@codesourcery.com