[Bug 2024284] Re: SEGV vulnerability in command-line parser

2024-03-11 Thread Ubuntu Foundations Team Bug Bot
The attachment "Fix memory initialization using calloc() in place of malloc()" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team. [This is an automated message

[Bug 2024284] Re: SEGV vulnerability in command-line parser

2024-03-11 Thread Mark Esler
Apologize for not responding earlier! This slipped through my emails. > I know Canonical is also Root CNA, why are you redirecting to another CNA? Canonical is a CNA, not a Root CNA. I don't see how an _unprivileged_ attacker could leverage this bug to be a vulnerability. A clear proof of