Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 14 Jun 2016 23:31:18 -0400
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-5317: GNOME nautilus: crash occurs when
 generating a thumbnail for a crafted TIFF image

On Wed, 15 Jun 2016 at 02:38:54 +0000, 张开翔 wrote:
> Product: nautilus
> Affected Versions: <= GNOME nautilus 3.18.5, <=libtiff.so 4.0.6
...
> Vendor URL: https://www.gnome.org/

Is there something about this vulnerability that makes it a Nautilus
vulnerability? From the stack trace you quoted, this looks like a
generic libtiff vulnerability that would affect any user of libtiff
equally, with Nautilus' role in this vulnerability merely being a
convenient user of libtiff that's easy to point at potentially
untrusted files?

    S

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.