Re: c-ares buffer overflow

[Touko Korpela <touko.korpela@iki.fi>]

On Thu, May 24, 2012 at 03:11:33PM +0300, Touko Korpela wrote:
> https://raw.github.com/bagder/c-ares/cares-1_8_0/RELEASE-NOTES
> /usr/share/doc/libc-ares2/changelog.gz
> 
> c-ares version 1.8 fixes buffer overflow and other memory issues
> Should this be added to tracker and check if CVE number is allocated?

Upstream homepage is http://c-ares.haxx.se/
Here is what Daniel Stenberg said about this when I asked about it:
(I didn't join their closed mailing list just to send one message)

> Are those memory safety bugs (buffer overrun, memcpy issue) security
> issue?
> If so, send information to oss-security mailing list and ask for CVE
> number
> http://oss-security.openwall.org/wiki/mailing-lists/oss-security
>

And I would prefer if you sent it to the list!

The answer to your question is that no, we haven't considered any fixed
problem to be that important. You're welcome to investigate and help us
double-check this.