| |||||||||||||
An odd vulnerability report for LibreOfficeAn odd vulnerability report for LibreOfficePosted Oct 6, 2011 9:19 UTC (Thu) by epa (subscriber, #39769)In reply to: An odd vulnerability report for LibreOffice by jake Parent article: An odd vulnerability report for LibreOffice
We do not consider a crash of a client application such as openoffice.org to be a security issue.Maybe it is a security issue, maybe not; but it is certainly a bug. I've been disappointed by this attitude from Red Hat in other cases too. If something crashes, it may not be the most important thing to fix, but there is no way it could be described as NOTABUG.
(Log in to post comments)
An odd vulnerability report for LibreOffice Posted Oct 6, 2011 11:38 UTC (Thu) by rwmj (subscriber, #5474) [Link]
The "NOTABUG" designation does cause some consternation, because it sounds like we're saying it's "not a bug", which of course it is.
Nevertheless, the resolution here is correct. The component is set to Security Response, and it is not a *security* bug. And you can see that an explanation was given in comment 14. This is all correct according to the rules:
What should probably have happened is the bug was cloned to the LibreOffice component, and fixed there. It appears that wasn't done, but although I'm not certain about the timeline, it looks like since it was already fixed in LO, there was no need to clone the bug and just close it straight afterwards.
So there you go, my strictly technical "by the book" explanation for this
An odd vulnerability report for LibreOffice Posted Oct 6, 2011 14:04 UTC (Thu) by epa (subscriber, #39769) [Link] The 'rules' document you mentioned defines NOTABUG as follows:The problem described is not a bug. An explaination of why this resolution has been chosen should be supplied. Comment 14 in the bug report simply says that this is not a security issue. My point is that while it may not be a security issue, it is a bug, and that therefore the NOTABUG resolution, as defined in the explanation document you gave, is not appropriate. It is defined as meaning "The problem described is not a bug", which is not at all the same as "It is a bug, but not the particular kind of bug appropriate to this component in Bugzilla". Still, as you say, it looks like the bug was dealt with in this case because it was already fixed upstream; it's just the Bugzilla entry which is misleading. It would be good for Bugzilla to have a MISFILED resolution for reports filed against the wrong component or whatever. That would provide a way to close them without making a claim that "this is not a bug" or "we will not fix it".
An odd vulnerability report for LibreOffice Posted Oct 7, 2011 18:32 UTC (Fri) by daglwn (subscriber, #65432) [Link]
Or just change the component it's assigned to. Why is that so hard?
An odd vulnerability report for LibreOffice Posted Oct 7, 2011 18:46 UTC (Fri) by intgr (subscriber, #39733) [Link]
> It would be good for Bugzilla to have a MISFILED resolution
Sounds like pointless bureaucracy. How about just reassigning the bug to the right component instead?
|
|||||||||||||