Re: Buffer overflow in /bin/su from UNIX v4

[Solar Designer <solar () openwall com>]

On Sat, Mar 21, 2026 at 01:13:47PM -0400, kf503bla () duck com wrote:
> why assign cve to something irrelvent?

I guess because (ir)relevance isn't among criteria for (not) assigning a
CVE, and because there may be value in having a non-ambiguous way to
refer to historical vulnerabilities for illustration of how the current
ones fit in historical context.

That said, I'm sure there are other cases of historical vulnerabilities
that never got CVEs.  Some were known prior to the CVE program start, so
would need CVEs from before 1999.  I think there's some value in that,
but it would be a change.  CVEs were not assigned for pre-1999 findings
so far.

The 2025 in this CVE is almost certainly wrong, but I understand that no
one had the resources to figure out the year it was first discovered.

Alexander