Date: Thu, 10 Aug 2017 14:53:36 +0200 From: Tobias Mueller <tobiasmue@...me.org> To: oss-security@...ts.openwall.com Subject: CVE-2017-2885 libsoup - stack based buffer overflow with HTTP Chunked Encoding Hi. PSA: Please update libsoup with the patch from https://bugzilla.gnome.org/show_bug.cgi?id=785774 or take one of the new releases 220.127.116.11, 2.58.2 (gnome-3-24), or 2.56.1 (gnome-3-22). The patch fixes a severe bug which affects libsoup acting as either client or server when dealing with chunked encoding. All versions since 2012 are affected. Credits go to Aleksandar Nikolic of Cisco Talos for finding this issue. Cheers, Tobi Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.