[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20160615033118.GA10094@perpetual.pseudorandom.co.uk>
Date: Tue, 14 Jun 2016 23:31:18 -0400
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-5317: GNOME nautilus: crash occurs when
generating a thumbnail for a crafted TIFF image
On Wed, 15 Jun 2016 at 02:38:54 +0000, 张开翔 wrote:
> Product: nautilus
> Affected Versions: <= GNOME nautilus 3.18.5, <=libtiff.so 4.0.6
...
> Vendor URL: https://www.gnome.org/
Is there something about this vulnerability that makes it a Nautilus
vulnerability? From the stack trace you quoted, this looks like a
generic libtiff vulnerability that would affect any user of libtiff
equally, with Nautilus' role in this vulnerability merely being a
convenient user of libtiff that's easy to point at potentially
untrusted files?
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
