[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50F63CB7.3060601@redhat.com>
Date: Tue, 15 Jan 2013 22:37:59 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Florian Weimer <fw@...eb.enyo.de>,
Salvatore Bonaccorso <carnil@...ian.org>, team@...urity.debian.org
Subject: Re: CVE request: Digest::SHA double free when using
load subroutine
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/15/2013 12:37 PM, Florian Weimer wrote:
> * Kurt Seifried:
>
>> I'm not clear, how would an attacker exploit this? They'd need to
>> be able to specify the file that gets hashed, and the file would
>> have to be not present and would thus trigger the crash? Are
>> there any real world examples of an affected application? (web
>> based?)
>
> My hunch is that this is just a bug, not a security issue.
I'll leave it for now, if anyone comes up with a security impact/etc.
let us know! (I bet this never happens, ah well =).
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQ9jy3AAoJEBYNRVNeJnmT9pcP/j4OWfbjMveABoGn6vyvE1xs
ozwg0zhaYOMrZi2Um2Yq5+JZfTJfYFk6TB1oEpVemVWus5coKmRvoppVW8gkIyrs
k459a8XI6OyqQYxn7oE7FWnrFPguiI6Xdi8Vn6/olHgqBAUEPaVfGsmJhNtTtZy+
Aa4LhfnMTKlVjLIbkTvuCN0qQXHErrx+4xR25dktr/5b3giSshxZ27wRDNe8oQpz
6UqE2e118tq2g2BWEufLawqBBXrGkY5NIkJIBCeJVVF5tYl1O4RIY4vDz1BbVBMp
gdNlPDm2Lhe7OoHqr02PPwICReI6AGTnNCqV+xIcGSG3UznCPEz6ui+dWz8v4EiS
SqeFUaOub/DK3PHaIWkn4L3tHEI/AWrLVp9wnKYwWPalMwtlC4p1bdG/mUbV1ZFn
vbkrE13AHhwawr4TDBOSEW6BD5LnHRom0YV4FqS5lpfbgHeGhpXx6Kq0mPFEMJcU
tb6eVD83AKPv+TYxjJ+eGld629MJOyw0r+AX/JGw/aGIgYd3vrxBEoBFyvRYLQqk
famGZtecyau1ffZ9uWwcOQgu62Dd3UkyawTHU3sSX50OjukUQwOhbiB0qApq/+fQ
wICYdWSfmIx6j4upaGh/pW1zvQ4OgL6wAOyy0BSX43DZZMhfTJlBAv8EwM8I7VAg
3Qdpekqr6sugZUJzi8Kj
=4j+p
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
