[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 26 Oct 2019 22:44:16 +0000
From: Stiepan <stie@...tonmail.ch>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem?
As someone who used Android & did my studies on how to secure it and what was missing for that, I can say that Androids still dream of electric blowfishes - or rather threefish-512 ;) - and will do so for a while, especially now that the only part that was open seems is no more. By that virtue, it lost the biggest advantage it had versus the better polished iOS. And doing that helps red-scarfed black-hats, who can hack into most of the open-source Android variants, which would not be the case if the latter had access to up to date, well-vetted security infos (unlike that late 2018 fix that made it even more vulnerable), and that extends to linux-distros by the by. Embargoes are bad.
Sure, that made me buy an iPhone, which is good commercially for Apple and I salute their privacy makeup*, but being forced to do so as the collateral victim of a trade war is less cool.
*as in definition 6 of the wordreference entry for that word, "A special examination for a student who has been absent ...".
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Friday, October 25, 2019 11:23 PM, Moritz Mühlenhoff <jmm@...til.org> wrote:
> Android advisories used to contain commit references to AOSP change sets, but
> that's not the case for https://source.android.com/security/bulletin/android-10.
>
> Typically most of these issues are specific to Android, but there are a few which
> per the CVE description are possibly affecting software packaged/used by Linux
> distros as well, one example:
>
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9325:
> "In libvpx, there is a possible out of bounds read due to a missing bounds check.
> This could lead to remote information disclosure with no additional execution
> privileges needed. "
>
> Similar for CVE-2019-9232, CVE-2019-9278, CVE-2019-9325, CVE-2019-9371, CVE-2019-9433,
> CVE-2019-9423 (also libexif and opencv)
>
> Is there anyone from Android/Google on the list, who can comment on this? Can these
> references be added again for the benefit of non-Android distros?
>
> Cheers,
> Moritz
Download attachment "publickey - stie@...tonmail.ch - 0xADF18750.asc" of type "application/pgp-keys" (1809 bytes)
Download attachment "signature.asc" of type "application/pgp-signature" (478 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
