-
Recent Posts
Recent Comments
- strongcourage on Why I stopped fuzzing research
- Bob Friesenhahn on Why I stopped fuzzing research
- #gentoo dev: Why I stopped fuzzing research https://blogs.gentoo.or… | Dr. Roy Schestowitz (罗伊) on Why I stopped fuzzing research
- Ulya on Why I stopped fuzzing research
- ago on Install Gentoo in less than one minute
Archives
- July 2020
- April 2020
- March 2019
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- February 2016
- July 2015
- August 2013
- June 2013
- May 2013
- January 2013
- December 2012
- November 2012
- October 2012
- August 2012
- July 2012
- June 2012
Categories
Meta
Monthly Archives: February 2017
zziplib: out of bounds read in zzip_mem_entry_new (memdisk.c)
Description: zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file. A fuzz on it discovered an out of bounds read. The complete ASan output: # unzzipcat-mem $FILE … Continue reading
Posted in advisories, security
1 Comment
zziplib: NULL pointer dereference in main (unzzipcat-mem.c)
Description: zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file. A fuzz on it discovered an a NULL pointer access. The complete ASan output: # unzzipcat-mem $FILE … Continue reading
Posted in advisories, security
Leave a comment
zziplib: invalid memory read in zzip_mem_entry_extra_block (memdisk.c)
Description: zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file. A fuzz on it discovered an invalid memory read. The complete ASan output: # unzzipcat-mem $FILE ==7950==ERROR: … Continue reading
Posted in advisories, security
1 Comment
zziplib: heap-based buffer overflow in zzip_mem_entry_extra_block (memdisk.c)
Description: zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file. A fuzz on it discovered an heap overflow. The complete ASan output: # unzzipcat-mem $FILE ==7970==ERROR: AddressSanitizer: … Continue reading
Posted in advisories, security
1 Comment
zziplib: heap-based buffer overflow in __zzip_get64 (fetch.c)
Description: zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file. A fuzz on it discovered an heap overflow. The complete ASan output: # unzzipcat-mem $FILE READ of … Continue reading
Posted in advisories, security
1 Comment
zziplib: heap-based buffer overflow in __zzip_get32 (fetch.c)
Description: zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file. A fuzz on it discovered an heap overflow. The complete ASan output: # unzzipcat-mem $FILE ==7574==ERROR: AddressSanitizer: … Continue reading
Posted in advisories, security
1 Comment
pax-utils: dumpelf: out of bounds read in dump_notes (dumpelf.c)
Description: pax-utils is a set of tools that check files for security relevant properties. A fuzz on dumpelf an out of bounds read. It was reported to vapier which fixed the issue immediately. Unfortunately I can’t get a symbolized ASan … Continue reading
Posted in advisories, security
Leave a comment
pax-utils: dumpelf: two invalid memory read in dumpelf.c
Description: pax-utils is a set of tools that check files for security relevant properties. A fuzz on scanelf exposed two invalid memory read. They was reported to vapier which fixed the issue immediately. Unfortunately I can’t get a symbolized ASan … Continue reading
Posted in advisories, security
Leave a comment
pax-utils: dumpelf: multiple divide-by-zero in dumpelf.c
Description: pax-utils is a set of tools that check files for security relevant properties. A fuzz on dumpelf shows multiple divide-by-zero . They was reported to vapier which fixed the issues immediately. Unfortunately I can’t get the ASan stacktrace, so … Continue reading
Posted in advisories, security
Leave a comment
podofo: heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken (PdfTokenizer.cpp)
Description: podofo is a C++ library to work with the PDF file format. A fuzz on it discovered an heap overflow. The upstream project denies me to open a new ticket. So, I’m unable to communicate with them. This will … Continue reading
Posted in advisories, security
1 Comment