oss-sec mailing list archives

Re: double-free vulnerability in OpenSSH server 9.1

From: Matthias Schmidt <oss-sec () xosc org>
Date: Thu, 2 Feb 2023 21:47:04 +0100

Hi,

* Georgi Guninski wrote:

Nice find :)
This is very complicated codepath, did a human found it "manually"
or some analysis program found it?
The warez are so large, they are hard for me manually.


According to djm@ [1] it was found manually and the first bug reported on
the Fediverse.

Cheers
        
        Matthias

[1] https://cybervillains.com/@djm/109795488319439723

Current thread:

double-free vulnerability in OpenSSH server 9.1 Qualys Security Advisory (Feb 02)
- Re: double-free vulnerability in OpenSSH server 9.1 Georgi Guninski (Feb 02)
  - Re: double-free vulnerability in OpenSSH server 9.1 Matthias Schmidt (Feb 02)
  - Re: double-free vulnerability in OpenSSH server 9.1 Qualys Security Advisory (Feb 02)
- Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Qualys Security Advisory (Feb 13)
  - Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Qualys Security Advisory (Feb 21)
    - Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Demi Marie Obenour (Feb 22)
    - Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Qualys Security Advisory (Feb 23)
  - Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Georgi Guninski (Mar 06)
    - Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Qualys Security Advisory (Mar 09)