[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20141222080519.7fdd183c@pc>
Date: Mon, 22 Dec 2014 08:05:19 +0100
From: Hanno Böck <hanno@...eck.de>
To: Alexander Cherepanov <cherepan@...me.ru>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request: out-of-bounds memory access flaw in
unrtf
An update here:
unrtf now released 0.21.8 which should contain all the fixes for known
crashers. They also made their project more accessible by using a
public mercurial repository on savannah (they only had an internal
repo before).
I had reported a couple more issues that popped up with address
sanitizer to upstream (it had invalid memory reads even with valid
input files). The latest code didn't expose any more issues within an
hour of running afl.
cu,
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
