[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <E3B21524-35E5-470E-811A-E1083454B56E@aevum.de>
Date: Fri, 14 Feb 2025 11:14:28 +0100
From: Nick Wellnhofer <wellnhofer@...um.de>
To: musl@...ts.openwall.com,
danielgutson@...il.com
Cc: oss-security@...ts.openwall.com
Subject: Re: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds
write primitive in iconv()
On Feb 13, 2025, at 23:28, Daniel Gutson <danielgutson@...il.com> wrote:
>
> Curious: is there any info about how this was discovered?
The bug was discovered with basic fuzz testing. As libxml2 maintainer, I found more and more issues in various iconv implementations by accident which is a strong indicator that all this code isn't tested enough. The iconv API is also trivial to fuzz, so it seemed like a nice weekend project.
Nick
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
