oss-security - CVE-2024-22857: Heap Based Buffer overflow in zlog library

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <AM0PR05MB6660688A27BDB6F3CD0B6286FD582@AM0PR05MB6660.eurprd05.prod.outlook.com>
Date: Wed, 28 Feb 2024 09:24:29 +0000
From: Ali Raza Mumtaz <raza.mumtaz@...yx.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: Faran Abdullah <faran.abdullah@...yx.com>
Subject: CVE-2024-22857: Heap Based Buffer overflow in zlog library

Hi,

We have found a vulnerability in zlog that is essentially a heap-based buffer overflow leading to denial of service and arbitrary code execution.

We have been trying to contact the maintainer of this project for almost three months and haven't received any response. Additionally, we have reserved a CVE number with MITRE (CVE-2024-22857) and now we intend to publish it.

We have a working PoC that provides code execution, along with a detailed blog regarding this vulnerability (which, of course, remains unpublished).

Regards,
Ali Raza
CONFIDENTIAL: The contents of this email and any attachments are confidential and are intended solely for the addressee. Information is legally privileged. This transmission, sent in trust, is for the sole purpose of delivery to the intended recipient. Do not distribute, email, fax, or transfer to third parties via any mechanism without prior approval of Ebryx. Do not share any information herein with third parties unless cited from public sources.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.