Date: Thu, 4 Dec 2014 13:30:33 -0500 (EST) From: cve-assign@...re.org To: oss-security@...ts.openwall.com cc: cve-assign@...re.org Subject: Re: CVE request: missing checks for small-sized files in hivex -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > It was reported that hivex , a library that can read and write > hive files (undocumented binary files that Windows uses to store the > Windows Registry on disk), did not properly handle small-sized hive > files. An attacker able to supply a hive file of a small size to an > application using the hivex library could use this flaw to read, and > possibly write, up to 4095 bytes beyond the end of the allocated > buffer, potentially resulting in arbitrary code execution with the > with the privileges of the user running that application. Use CVE-2014-9273. - --- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEVAwUBVICnuallVAevmvmsAQJmtQgAvdc858QDSe7VoTfgyMo/qZa/9sVMs0UF aKFwc+aZfVrRQDX71kGudujqZE2V/CorB6R0NUYQ6icC9ho41wlEp9tuMLcsnwB1 wslzcbRZht16Zg0wWmQnhyY9ZFrPfYLW2gBrWf3wERrpDbLGleS43/B0O87qI35m rr7EUSSbkr/P81PcvsVe8mqblpkm9jK0IDUuB8SC141btnCOTL1Wgn/H1/kVgGSZ QOjk/E2OPF3olNo23yWpADi7U4GW3KLypJ08vpCwR/hsvD2vJ0oSTFpLm/K515Lb tD3D53+boUNlOLN7rnIWYoCMNu72iwLPRh6vJO9WklSx0W1hCl6MKw== =+uEe -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.