[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1302875648.2013.6.camel@oban>
Date: Fri, 15 Apr 2011 15:54:08 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE request for Thunar (format string errors)
Two format string errors were recently fixed in Thunar (file manager for
Xfce).
The first one is
http://git.xfce.org/xfce/thunar/commit/?id=1d4dfafda30df071d7c1e0b370f0613cbc92ba74 (bug at https://bugzilla.xfce.org/show_bug.cgi?id=7128) fixed in Thunar 1.2.1) and triggers when creating file from templates and calling it with a format string.
The second is
http://git.xfce.org/xfce/thunar/commit/?id=03dd312e157d4fa8a11d5fa402706ae5b05806fa and is triggered when copy/pasting a file named from a format string. There's no released version including the fix right now.
I've triggered the (second) bug using file named %s or %n but didn't
really manage to exploit it (it crashes just fine).
I'm not so sure it really needs a CVE so it's a request for discussion
as well :)
As a side note, I do use -Wformat -Wformat-security
-Werror=format-security (thanks to hardening-includes) for my Debian
builds, but as those function are wrappers of wrappers of wrappers to
printf() and stuff like that, -Wformat-security won't help. Is there a
way to work around that?
Regards,
--
Yves-Alexis
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
