| Main Archive Page > Month Archives > oss-security archives |
Re: [oss-security] Re: TORCS 1.3.2 xml buffer overflow - CVE-2012-1189
From: Tomas Hoger <thoger_at_nospam>Date: Tue Mar 06 2012 - 20:42:39 GMT
To: oss-security@lists.openwall.com
On Tue, 6 Mar 2012 09:31:10 -0500 Andres Gomez wrote:
> 2012/3/5 Kurt Seifried <kseifried@redhat.com>
>
> > Would you consider tham to be the same code base or a different code
> > base? If the same code base, share the CVE, if different code
> > bases, new CVE for it. Steve: do we have a policy for "Fresh" forks
> > as it were?
>
> Well, Speed Dreams started with TORCS code base, but they have added
> a lot new code, so I would say that right now they have different
> code base, although they still share a big portion of the code (as
> the vulnerable section). Because of that I would consider It needs a
> new CVE number, could you assign one to it? :)
Their code bases may differ significantly in other parts, but it seems
the affected vulnerable code is still identical between the two.
Following are versions shortly before fixes got committed:
http://torcs.cvs.sourceforge.net/viewvc/torcs/torcs/torcs/src/modules/graphic/ssggraph/grsound.cpp?revision=1.31.2.2&view=markup
http://speed-dreams.svn.sourceforge.net/viewvc/speed-dreams/trunk/src/modules/graphic/ssggraph/grsound.cpp?revision=4146&view=markup
In cases like this, same CVE is used for all project that use / embed
the same affected code.
-- Tomas Hoger / Red Hat Security Response Team