oss-security - Re: CVE Request -- HTMLDOC

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Sun, 26 Jul 2009 09:24:30 +0200
From: Alex Legler <a3li@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- HTMLDOC

On Sa, 2009-07-25 at 15:31 +0200, Nico Golde wrote:
> Did you check:
> htmllib.cxx:          if (sscanf(line, "%*s%*s%*s%*s%f%*s%*s%s", &width, glyph) != 2)
> ps-pdf.cxx:   if (sscanf(line, "%*s%*s%*s%*s%d%*s%*s%s", &width, glyph) != 2)
> as well?
> Looks like a similar issue to me.
> 

Indeed it is the same issue. I could cause an overflow with a crafted
AFM font file.

I have added these two to the upstream bug report.

Regards,
Alex

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.