[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120530165602.GD1295@kludge.henri.nerv.fi>
Date: Wed, 30 May 2012 19:56:02 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: Steve Langasek <vorlon@...ian.org>
Subject: Re: CVE id request: Multiple buffer overflow in
unixODBC
On Wed, May 30, 2012 at 10:07:02AM +0200, Tomas Hoger wrote:
> On Tue, 29 May 2012 09:42:42 -0300 Felipe Pena wrote:
>
> > Multiple buffer overflow in unixODBC
> > ===========================
> >
> > The library unixODBC doesn't check properly the input from FILEDSN=,
> > DRIVER= options in the DSN, which causes buffer overflow when passed
> > to the SQLDriverConnect() function.
>
> Reports like this - covering bugs in parsing of the configuration
> parameters (i.e. generally trusted input) - should include some
> reasoning why these should be considered security. Nothing obvious not
> intended to break PHP safe_mode comes to mind.
>
> --
> Tomas Hoger / Red Hat Security Response Team
Debian-report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675058
Maintainer is also asking why this is security related issue. Can I get short description thanks.
- Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
