On Mon, Jan 14, 2019 at 7:35 AM, Dave Love
<loveshack(a)fedoraproject.org> wrote:
I ask because three CVEs have triggered automated bug reports
against
libxsmm <
https://apps.fedoraproject.org/packages/libxsmm/bugs>. I
don't
understand why the CVEs were issued, since a problem with unrealistic
input to a (rather rarely used) development tool doesn't strike me as
a
security problem.
Wow, of course "heap-based buffer overflow" and "resource exhaustion"
are worth CVEs. If the developers don't intend to fix these issues, you
should retire the package.
Michael