[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170523071046.GA4432@openwall.com>
Date: Tue, 23 May 2017 09:10:46 +0200
From: Solar Designer <solar@...nwall.com>
To: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: ImageMagick: CVE-2017-9098: use of uninitialized memory in RLE decoder
On Mon, May 22, 2017 at 05:58:31PM -0500, Bob Friesenhahn wrote:
> On Mon, 22 May 2017, Thomas Deutschmann wrote:
> >Bob, do you have any PoC you can share with ImageMagick project
> >regarding CVE-2017-6335?
> >
> >Your fix was
> >https://sourceforge.net/p/graphicsmagick/code/ci/6156b4c2992d855ece6079653b3b93c3229fc4b8/
> >
> >I asked ImageMagick project about that issue but they don't know without
> >a PoC, see https://github.com/ImageMagick/ImageMagick/issues/391
>
> I have attached the problematic TIFF file. I don't know if binary
> attachments are accepted by this list.
Small binary attachments (total message size of up to 200 KB including
overhead) are accepted, but unfortunately image/tiff was on the
mimeremove list, so your attachment didn't get through. I've just
removed image/tiff from mimeremove. Please resend (if small enough).
As to why have mimeremove at all: many people use MUAs or/and have
signatures that always attach needless files (e.g., a text/html portion
linking to a company logo, which is also included). But I guess use of
image/tiff for those is very unusual, so there was no good reason to
have this MIME type removed.
The current mimeremove is:
application/ms-tnef
text/html
text/x-vcard
image/gif
image/jpeg
image/png
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
