[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5489F143.7030302@mccme.ru>
Date: Thu, 11 Dec 2014 22:32:19 +0300
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: out-of-bounds memory access flaw
in unrtf
On 2014-12-08 18:36, Hanno Böck wrote:
> Just to keep people updated on this:
Thanks for this.
> Jean-Francois Dockes replied to my bug reports, he's one of the last
> people who did work on unrtf and he's in contact with the maintainer.
> They'll work on fixing all the issues reported. I also pointed them to
> Fabian's patch.
>
> This sounds good, hopefully we'll get a new unrtf release with fixes
> for all the known issues soon
0.21.6 is out and seems to incorporate the fixes from Jean-Francois
Dockes (with reformatting). Expecting to find security mentioned in
ChangeLog or other docs is too much, I guess.
I've fuzzed unrtf with the patch from Fabian Keil a bit and I've found 8
crashes (with different RIP). All of them are fixed in the version by
Jean-Francois Dockes (and hence in the release). If someone wants to
take a look at them I can upload them somewhere.
OTOH unrtf seems to be a recursive program:
$ perl -e 'print "{" x 100000' > test.rtf
$ unrtf-0.21.6/src/unrtf -P unrtf-0.21.6/outputs test.rtf
Segmentation fault
--
Alexander Cherepanov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
