[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20191210102523.GB4424@fedorawork>
Date: Tue, 10 Dec 2019 11:25:23 +0100
From: Riccardo Schirone <rschiron@...hat.com>
To: oss-security@...ts.openwall.com
Cc: VMware Security Response Center <security@...are.com>
Subject: Re: CVE-2019-5544 openslp 1.2.1, 2.0.0 heap overflow
vulnerability
On 12/06, VMware Security Response Center wrote:
> openslp has a heap overflow vulnerability that when exploited may result
> in memory corruption and a crash of slpd or in remote code execution.
>
> CVE-2019-5544 has been assigned to this issue.
>
> Below you may find:
> - a copy of the affected code with comments indicating the problem.
> - patches for openslp versions 1.2.1 and 2.0.0
Are those fixes commited anywhere? I could not find them on GitHub.
>
> VMware would like to thank the 360Vulcan team working with the 2019
> Tianfu Cup Pwn Contest for reporting this issue to us.
>
> VMware Security Response Center
>
>
Thanks,
--
Riccardo Schirone
Red Hat -- Product Security
Email: rschiron@...hat.com
PGP-Key ID: CF96E110
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
