[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170620132204.GA6240@openwall.com>
Date: Tue, 20 Jun 2017 15:22:04 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Qualys Security Advisory <qsa@...lys.com>
Subject: Re: Qualys Security Advisory - The Stack Clash
On Mon, Jun 19, 2017 at 10:39:33PM +0200, Solar Designer wrote:
> Since we were making this public in pieces like that, I have to say: no,
> there's nothing else left to publish as part of this series of Qualys'
> findings. Everything Qualys brought to distros so far is now public.
I have to correct the above statement as I totally forgot about the
exploits. While all issues Qualys brought to distros so far are now
public, Qualys' own exploits for them are not public yet. IIRC, Qualys
selectively sent the exploits to affected vendors, but that included
sending the Linux-specific exploits to the linux-distros sub-list.
Qualys, I suggest that, like you did with the Sudo exploit, you publish
your Stack Clash exploits in here as soon as third-party exploits of
comparable functionality appear, or next Tuesday, whichever is earlier.
Please confirm that you intend to do so in a reply to this message, so
that everyone in here knows what to expect.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
