Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 30 Jan 2015 13:25:02 +0300
From: Solar Designer <>
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

On Fri, Jan 30, 2015 at 11:09:01AM +0100, linkbc02 wrote:
> Sorry Alexander, I quoted the wrong one.
> I can confirm, Dovecot, at least, got crashed, I asked also Timo S. that is
> digging about it.
> Screenshot

The screenshot shows you entering lots of 0's when talking the IMAP
protocol.  It does not necessarily indicate any relevance to GHOST.

If you try upgrading glibc and the issue goes away, _that_ would be a
reason to suspect relevance.  OTOH, if the issue persists even with
GHOST-patched glibc, that would be a reason to think it's an unrelated
issue (which most likely it is).  Can you perform this test maybe?
Don't forget to restart Dovecot after the glibc upgrade.

As to use of the mailing list, I'd prefer no screenshots, pastebins,
etc. in here.  Instead, post the information in plain text form right in
here.  And here are some guidelines on better quoting:


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.