[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87a4x7awxe.fsf@josefsson.org>
Date: Tue, 17 Feb 2026 22:21:17 +0100
From: Simon Josefsson <simon@...efsson.org>
To: Sam James <sam@...too.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: zlib security audit by 7asecurity
Great to see audits of widely used code! Gzip next?
Sam James <sam@...too.org> writes:
> * ZLB-01-001 WP2: Heap Buffer Overflow via Legacy gzprintf Implementation (High)
That vulnerability seems to require that zlib was built with
-DNO_vsnprintf -DNO_snprintf, targetting a system lacking 'snprintf'.
Does anyone know of a real-world environment using that configuration?
I don't see the applicability discussed in the report, and before
assigning a severity rating to this problem, I think it is relevant to
understand what environments really are affected.
/Simon
Download attachment "signature.asc" of type "application/pgp-signature" (1252 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
