oss-sec mailing list archives
Re: CVE request: Digest::SHA double free when using load subroutine
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 15 Jan 2013 22:37:59 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/15/2013 12:37 PM, Florian Weimer wrote:
* Kurt Seifried:I'm not clear, how would an attacker exploit this? They'd need to be able to specify the file that gets hashed, and the file would have to be not present and would thus trigger the crash? Are there any real world examples of an affected application? (web based?)My hunch is that this is just a bug, not a security issue.
I'll leave it for now, if anyone comes up with a security impact/etc. let us know! (I bet this never happens, ah well =). - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQ9jy3AAoJEBYNRVNeJnmT9pcP/j4OWfbjMveABoGn6vyvE1xs ozwg0zhaYOMrZi2Um2Yq5+JZfTJfYFk6TB1oEpVemVWus5coKmRvoppVW8gkIyrs k459a8XI6OyqQYxn7oE7FWnrFPguiI6Xdi8Vn6/olHgqBAUEPaVfGsmJhNtTtZy+ Aa4LhfnMTKlVjLIbkTvuCN0qQXHErrx+4xR25dktr/5b3giSshxZ27wRDNe8oQpz 6UqE2e118tq2g2BWEufLawqBBXrGkY5NIkJIBCeJVVF5tYl1O4RIY4vDz1BbVBMp gdNlPDm2Lhe7OoHqr02PPwICReI6AGTnNCqV+xIcGSG3UznCPEz6ui+dWz8v4EiS SqeFUaOub/DK3PHaIWkn4L3tHEI/AWrLVp9wnKYwWPalMwtlC4p1bdG/mUbV1ZFn vbkrE13AHhwawr4TDBOSEW6BD5LnHRom0YV4FqS5lpfbgHeGhpXx6Kq0mPFEMJcU tb6eVD83AKPv+TYxjJ+eGld629MJOyw0r+AX/JGw/aGIgYd3vrxBEoBFyvRYLQqk famGZtecyau1ffZ9uWwcOQgu62Dd3UkyawTHU3sSX50OjukUQwOhbiB0qApq/+fQ wICYdWSfmIx6j4upaGh/pW1zvQ4OgL6wAOyy0BSX43DZZMhfTJlBAv8EwM8I7VAg 3Qdpekqr6sugZUJzi8Kj =4j+p -----END PGP SIGNATURE-----
Current thread:
- CVE request: Digest::SHA double free when using load subroutine Salvatore Bonaccorso (Jan 15)
- Re: CVE request: Digest::SHA double free when using load subroutine Kurt Seifried (Jan 15)
- Re: CVE request: Digest::SHA double free when using load subroutine Florian Weimer (Jan 15)
- Re: CVE request: Digest::SHA double free when using load subroutine Kurt Seifried (Jan 15)
- Re: CVE request: Digest::SHA double free when using load subroutine Salvatore Bonaccorso (Jan 15)
- Re: CVE request: Digest::SHA double free when using load subroutine Mark Shelor (Jan 17)
- Re: CVE request: Digest::SHA double free when using load subroutine Florian Weimer (Jan 15)
- Re: CVE request: Digest::SHA double free when using load subroutine Kurt Seifried (Jan 15)