CVE-2016-4973

Debian Bug report logs - #848704
CVE-2016-4973

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2016-4973

Date: Mon, 19 Dec 2016 18:48:06 +0100

Source: gcc-mingw-w64
Severity: important
Tags: security

This has been assigned CVE-2016-4973:
https://bugzilla.redhat.com/show_bug.cgi?id=1324759

Cheers,
        Moritz

Message #10 received at 848704@bugs.debian.org (full text, mbox, reply):

From: Stephen Kitt <skitt@debian.org>

To: Moritz Mühlenhoff <jmm@debian.org>, 848704@bugs.debian.org

Subject: Re: Bug#848704: CVE-2016-4973

Date: Mon, 19 Dec 2016 19:01:41 +0100

[Message part 1 (text/plain, inline)]

Hi Moritz,

On Mon, 19 Dec 2016 18:48:06 +0100, Moritz Mühlenhoff <jmm@debian.org> wrote:
> This has been assigned CVE-2016-4973:
> https://bugzilla.redhat.com/show_bug.cgi?id=1324759

This doesn't really seem to be going anywhere, is it really worth spending
time on? GCC upstream disagrees that it's an issue. I'd already tried the
patch attached to the bug linked above, and it doesn't work.

(Note that I work for Red Hat.)

Regards,

Stephen

[Message part 2 (application/pgp-signature, inline)]

Message #15 received at 848704@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Stephen Kitt <skitt@debian.org>

Cc: 848704@bugs.debian.org

Subject: Re: Bug#848704: CVE-2016-4973

Date: Mon, 26 Dec 2016 11:31:57 +0100

On Mon, Dec 19, 2016 at 07:01:41PM +0100, Stephen Kitt wrote:
> Hi Moritz,
> 
> On Mon, 19 Dec 2016 18:48:06 +0100, Moritz Mühlenhoff <jmm@debian.org> wrote:
> > This has been assigned CVE-2016-4973:
> > https://bugzilla.redhat.com/show_bug.cgi?id=1324759
> 
> This doesn't really seem to be going anywhere, is it really worth spending
> time on? GCC upstream disagrees that it's an issue. I'd already tried the
> patch attached to the bug linked above, and it doesn't work.

I mostly filed it for completeness to have the status tracked in the BTS.

From my point of view it's not a vulnerability and should not have a
CVE ID assigned, it's ultimately just a missing security hardening
feature.

I'm fine with simply closing it, but it's your maintainer's call.

Cheers,
        Moritz

Message #20 received at 848704-done@bugs.debian.org (full text, mbox, reply):

From: Stephen Kitt <skitt@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 848704-done@bugs.debian.org

Subject: Re: Bug#848704: CVE-2016-4973

Date: Sun, 21 Jan 2018 23:18:53 +0100

[Message part 1 (text/plain, inline)]

On Mon, 26 Dec 2016 11:31:57 +0100, Moritz Mühlenhoff <jmm@inutil.org> wrote:
> On Mon, Dec 19, 2016 at 07:01:41PM +0100, Stephen Kitt wrote:
> > On Mon, 19 Dec 2016 18:48:06 +0100, Moritz Mühlenhoff <jmm@debian.org>
> > wrote:  
> > > This has been assigned CVE-2016-4973:
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1324759  
> > 
> > This doesn't really seem to be going anywhere, is it really worth spending
> > time on? GCC upstream disagrees that it's an issue. I'd already tried the
> > patch attached to the bug linked above, and it doesn't work.  
> 
> I mostly filed it for completeness to have the status tracked in the BTS.
> 
> From my point of view it's not a vulnerability and should not have a
> CVE ID assigned, it's ultimately just a missing security hardening
> feature.
> 
> I'm fine with simply closing it, but it's your maintainer's call.

Circling back to this, I agree, and nothing ever came of the various bugs
opened elsewhere in relation to this CVE (except in newlib which isn’t
particularly relevant here). It would be nice if SSP was supported properly,
but it’s not a security issue as far as I’m concerned. So I’m closing the
bug.

Regards,

Stephen

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.