[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87ehhmtez6.fsf@mid.deneb.enyo.de>
Date: Tue, 15 Jan 2013 20:37:17 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com, Salvatore Bonaccorso <carnil@...ian.org>, team@...urity.debian.org
Subject: Re: CVE request: Digest::SHA double free when using load subroutine
* Kurt Seifried:
> I'm not clear, how would an attacker exploit this? They'd need to be
> able to specify the file that gets hashed, and the file would have to
> be not present and would thus trigger the crash? Are there any real
> world examples of an affected application? (web based?)
My hunch is that this is just a bug, not a security issue.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
