Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Greg KH <greg () kroah com>
Date: Wed, 27 Feb 2013 12:08:13 -0800

On Wed, Feb 27, 2013 at 07:26:39PM +0100, Petr Matousek wrote:
On Wed, Feb 27, 2013 at 10:05:20AM -0800, Greg KH wrote:
On Wed, Feb 27, 2013 at 05:13:06PM +0100, Petr Matousek wrote:
On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
For starters, security () kernel org submissions should be posted to
oss-security or any other security related public mailing list when
the
patch is being committed.

That's not going to happen, and you know that, to do so would be
totally
irresponsible of us and directly harm your users.  That's what
vendor-sec (or whatever it is called now) is for.

linux-distros [1] is vendor-sec replacement for Linux related issues.

  [1] http://oss-security.openwall.org/wiki/mailing-lists/distros

Greg, FYI. The linux-distros mailing list has strict rules about the
maximum embargo period. It is ~14 days. I hope that ~14 days are
acceptable as a grace period for you when the commit goes public. At the
end of the embargo period the info is always sent to oss-sec with CVE id
assigned. 

That's fine with me.

thanks,

greg k-h


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]