[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4FA5BF4F.7080505@redhat.com>
Date: Sat, 05 May 2012 18:01:19 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request for links2
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/11/2012 06:10 PM, Nico Golde wrote:
> Hi, * Kurt Seifried <kseifried@...hat.com> [2012-04-10 21:56]:
>> On 04/09/2012 08:43 PM, Nico Golde wrote:
> [...]
>>> I discovered some out of memory accesses in links2 graphics
>>> mode that could be potentially used to run exploits. I fixed
>>> them in links-2.6. For Debian Squeeze, I am sending this patch
>>> that backports the fixes to links-2.3pre1. Apply the patch and
>>> distribute patched packages links and links2 through
>>> security.debian.org.
>>>
>>>
>>> [...] This patch fixes:
>>>
>>> Buffer overflow when pasting too long text from clipboard to
>>> dialog boxes (not remotely exploitable)
>>
>> Can this result in code execution?
>
> I am not sure about this one. For out of memory write in dip.c, my
> guess is yes, it is basically possible to write past an allocated
> buffer. Even though I can't tell you what data would reside in that
> area.
Is it exploitable for anything beyond a crash?
> For the xbm decoder, the problem has basically been that
> xbm_decode() did not indicate an error when decoding xbm images and
> thus the callers would continue to operate on the parsed structures
> even though the image is faulty.
Is it exploitable for anything beyond a crash?
> Cheers Nico
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPpb9PAAoJEBYNRVNeJnmTyuwQAKyzVtBNiPAklnKdc1qBSF2b
tLqqA9iFSggrSR9BrscTWism8GMVtkNAemNbhGSWOvm0iKEBLi8cul3EsAjZvaIQ
vJPHOT+8fAFgrjxaNkmhUlGpNCh0mjqPNQwrZ9t9GPyvqMxaVVch4z+zXhF4627H
P+BmUJnLha86s3Lmk6dsaoMXo49Afg+pf1waeBECXSTlM5yU0LiYPlEEYaLO9lmr
FC6i5nNGD4SzIZtQPdBca8rmQ2EW30GzWT/vTXv23V7ZdGqVw5UQCdnHTSmPiZVc
MCwi1zBsx5HeqnjPWJPEUH+CezlN0/uGiWUAd+5BZZOnqi5NWzbcJnsIkR+B5Pln
DHVxz2yH33lH2JtDQwWpphn8drD8XGGJrBYicqlHXoqhgVQZixnun6ils7MfEsCL
iK1D+8FabAKVNiJAxfJYFtsSjtCGIXlk9atzcKy7GQfkDniLoyqaRMuNmWNTPD0V
PR4ZssNWunYnNKKO8uGY0AaLjXzU3QW/hKH8dgghf6N3+Xb08x9BR7IeeFenlC8m
MppwCIOuyWsKn6l0DajkgeeDvycQJyFCVsnnhbLGbT/I7GcJJ5bm2/Jc3CoMO+c5
sPt1LaiRFYxKnHnGyGqOzGO3lkm/jodcHeLCijYl8V8xIEaUymfkrfsgKCWetR1Z
+Uh/FC82SB4YSTAwDSS7
=+gp8
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
