Category Archives: security

potrace: multiple (three) NULL pointer dereference in bm_readbody_bmp (bitmap_io.c)

Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted images (bmp) revealed, through a fuzz testing, the presence of three NULL pointer access. The complete ASan output: ASAN:SIGSEGV ================================================================= ==13806==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 … Continue reading

Posted in advisories, security | Leave a comment

potrace: divide-by-zero in bm_new (bitmap.h)

Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted image (bmp) revealed, through a fuzz testing, the presence of a division by zero. The complete ASan output: # potrace $FILE.bmp ASAN:DEADLYSIGNAL ================================================================= ==25102==ERROR: AddressSanitizer: FPE on … Continue reading

Posted in advisories, security | Leave a comment

potrace: multiple(six) heap-based buffer overflow in bm_readbody_bmp (bitmap_io.c)

Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted images (bmp) revealed, through a fuzz testing, the presence of SIX heap-based buffer overflow. To avoid to make the post much long, I splitted the ASan output … Continue reading

Posted in advisories, security | Leave a comment

WiRouterKeyRec: signed integer overflow in agpf_get_serial (agpf.c)

Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config shows the presence of a signed integer overflow in agpf_check_agpf. The complete UBSan output: # WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore … Continue reading

Posted in advisories, security | Leave a comment

WiRouterKeyRec: signed shift in agpf_check_agpf (agpf.c)

Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config shows the presence of a signed shift in agpf_check_agpf The complete UBSan output: # WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore Fresta … Continue reading

Posted in advisories, security | Leave a comment

libav: heap-based buffer overflow in ff_audio_resample (resample.c)

Description: Libav is an open source set of tools for audio and video processing. A crafted file can cause an overflow in the heap. This bug was discovered the last year, but I didn’t have time to do anything else. … Continue reading

Posted in advisories, security | 2 Comments

WiRouterKeyRec: divide-by-zero in agpf_get_serial (agpf.c)

Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config causes a divide-by-zero in agpf_get_serial. The complete ASan output: WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore Fresta http://www.salvatorefresta.net ASAN:DEADLYSIGNAL ================================================================= ==27225==ERROR: AddressSanitizer: … Continue reading

Posted in advisories, security | Leave a comment

logrotate: heap-based buffer overflow in readConfigFile (config.c)

Description: logrotate allows for the automatic rotation compression, removal and mailing of log files. Logrotate can be set to handle a log file daily, weekly, monthly or when the log file gets to a certain size. A crafted config causes … Continue reading

Posted in advisories, security | Leave a comment

syslog-ng: NULL pointer dereference in report_syntax_error (cfg-parser.c)

Description: syslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, message queues, databases (SQL and NoSQL alike) and more. A crafted config crashes the process because of a NULL pointer access. … Continue reading

Posted in advisories, security | Leave a comment

desktop-file-utils: desktop-file-validate: heap-based buffer overflow in validate.c

Description: desktop-file-utils is command line set of utilities to work with desktop menu entries A fuzz against desktop-file-utils binary revealed that there was an heap overflow. The complete ASan output: # desktop-file-validate crafted.desktop ================================================================= ==29796==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000e843 … Continue reading

Posted in advisories, security | Leave a comment