Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Nov 2010 18:04:10 -0700
From: Kurt Seifried <>
Subject: Re: CVE Request: gif2png: command-line buffer overflow problem

> How could this possibly be exploited?  If you can trick a user into
> running gif2png [exploit payload], then that user has already lost.

It was reported that some CGI scripts/etc use it automatically so by
using a long file name it may be possible.

Personally I'm not worried but Debian/Fedora have fixed it as a
security issue so if that is the case a CVE would be nice for tracking

> See also:
> make `perl -e 'print "A"x10000'`
> -Dan

Kurt Seifried
tel: 1-703-879-3176

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.