Re: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g

[Stefan Cornelius <scorneli () redhat com>]

On Mon, 06 Jul 2015 13:16:00 +0200
a.furieri () lqt it wrote:

> On Mon, 6 Jul 2015 12:49:45 +0200, Stefan Cornelius wrote:
> >
>
> Hi Stefan,
>
> if I understand well your tests are based on the obsolete FreeXL
> 1.0.0g that is not the most recent version available.
>
> version 1.0.1 was released on 2015-03-22, and is exactly intended to
> fix several critcal bugs dentified by American Fuzzy Lop when parsing
> purposely malformed input files.

Yes, that's correct, the analysis of the first part of my last email is
based on 1.0.0g. That was intentional, as I've tried to provide
additional information to this old vulnerability so that a CVE may be
assigned.
 
> it could be surely usefull to learn if after switching to the more
> recent version you still continue to confirm your issues.
> and if the answer is eventually yes, sensing a copy of the input
> files causing malfunctions will surely help to debug the code.

The integer overflow, a new vulnerability described in the second part
of my last email, still affects the latest version. I'll provide you
with a reproducer in a private email within the next couple of minutes.

Thanks,
-- 
Stefan Cornelius / Red Hat Product Security