On 10/09/2014 06:48 AM, Kai Schaetzl wrote: > I noticed this as well but did some homework ;-) > https://bugzilla.redhat.com/show_bug.cgi?id=1147189 > https://access.redhat.com/security/cve/CVE-2014-6277 > > If I understand it correctly they think it's not exploitable anymore. > Still think it should get patched immediately as there is an upstream > patch available and it avoids any more questions and confusion about this > problem. Well, the upstream patch, at least as it is written now, would require them to back out their patches to apply. But regardless if whether or not they fix the segfault issue, that is NOT a security issue or exploitable. It might possibly be a Denial of Service mechanism, I guess. The place to address this is on the bugzilla entry though. We will publish the changes Red Hat rolls into the source and the upstream bugzilla is how to make that happen. https://bugzilla.redhat.com/show_bug.cgi?id=1147189 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 198 bytes Desc: OpenPGP digital signature URL: <http://lists.centos.org/pipermail/centos/attachments/20141009/71cf3cf0/attachment-0004.sig>