[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160314063228.GA12829@steve.org.uk>
Date: Mon, 14 Mar 2016 06:32:28 +0000
From: Steve Kemp <steve@...ve.org.uk>
To: oss-security@...ts.openwall.com
Subject: CVE-Request - GNU Awk.
I reported two DoS bugs against GNU Awk to the debian
bug tracker recently, both of which are denial of service
attacks causing NULL-pointer deferences.
It would be useful to have a CVE identifiers assigned.
The two issues can be demonstrated like so :
echo | gawk '{ print( @olower( "steve" ) ) }'
echo | gawk 'for (i = ) in foo bar baz'
There are potential patches and further diagnostics on
the bug reports themselves which are respectively:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816271
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816277
Steve
--
# Git Based DNS Hosting
https://www.dns-api.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
