On Mon, Jan 14, 2019 at 7:35 AM, Dave Love
<loveshack@xxxxxxxxxxxxxxxxx> wrote:
I ask because three CVEs have triggered automated bug reports against
libxsmm <https://apps.fedoraproject.org/packages/libxsmm/bugs>. I
don't
understand why the CVEs were issued, since a problem with unrealistic
input to a (rather rarely used) development tool doesn't strike me as
a
security problem.
Wow, of course "heap-based buffer overflow" and "resource exhaustion"
are worth CVEs. If the developers don't intend to fix these issues, you
should retire the package.
Michael
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
