Date: Tue, 20 Jun 2017 15:22:04 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Cc: Qualys Security Advisory <qsa@...lys.com> Subject: Re: Qualys Security Advisory - The Stack Clash On Mon, Jun 19, 2017 at 10:39:33PM +0200, Solar Designer wrote: > Since we were making this public in pieces like that, I have to say: no, > there's nothing else left to publish as part of this series of Qualys' > findings. Everything Qualys brought to distros so far is now public. I have to correct the above statement as I totally forgot about the exploits. While all issues Qualys brought to distros so far are now public, Qualys' own exploits for them are not public yet. IIRC, Qualys selectively sent the exploits to affected vendors, but that included sending the Linux-specific exploits to the linux-distros sub-list. Qualys, I suggest that, like you did with the Sudo exploit, you publish your Stack Clash exploits in here as soon as third-party exploits of comparable functionality appear, or next Tuesday, whichever is earlier. Please confirm that you intend to do so in a reply to this message, so that everyone in here knows what to expect. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.