Re: Re: Remote crash in MaraDNS 2.0.13 and git master

[Salvatore Bonaccorso <carnil () debian org>]

Hi MITRE CVE assigning team,

On Mon, Nov 14, 2016 at 01:36:58PM -0500, cve-assign () mitre org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > remote crash bug in MaraDNS 2.0.13 js_readuint16
>
> Use CVE-2016-9300.
>
>
> > remote crash bug in MaraDNS 2.0.13 js_substr
>
> Use CVE-2016-9301.
>
>
> > remote crash bug in MaraDNS 2.0.13 process_query -> this in fact
> > looks like stack smashing, since it crashes on htons in an unrelated
> > place
>
> Use CVE-2016-9302.

According to the analysis of Sam Trenholme in
https://bugs.debian.org/844121#32, and confirmed by Ondrej, afaics,
those above would not be vulnerabilities in MaraDNS. Can you please
reject those three CVEs?

Regards,
Salvatore