-
Recent Posts
Recent Comments
- strongcourage on Why I stopped fuzzing research
- Bob Friesenhahn on Why I stopped fuzzing research
- #gentoo dev: Why I stopped fuzzing research https://blogs.gentoo.or… | Dr. Roy Schestowitz (罗伊) on Why I stopped fuzzing research
- Ulya on Why I stopped fuzzing research
- ago on Install Gentoo in less than one minute
Archives
- February 2025
- July 2020
- April 2020
- March 2019
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- February 2016
- July 2015
- August 2013
- June 2013
- May 2013
- January 2013
- December 2012
- November 2012
- October 2012
- August 2012
- July 2012
- June 2012
Categories
Meta
Category Archives: security
potrace: multiple (three) NULL pointer dereference in bm_readbody_bmp (bitmap_io.c)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted images (bmp) revealed, through a fuzz testing, the presence of three NULL pointer access. The complete ASan output: ASAN:SIGSEGV ================================================================= ==13806==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 … Continue reading
Posted in advisories, security
Leave a comment
potrace: divide-by-zero in bm_new (bitmap.h)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted image (bmp) revealed, through a fuzz testing, the presence of a division by zero. The complete ASan output: # potrace $FILE.bmp ASAN:DEADLYSIGNAL ================================================================= ==25102==ERROR: AddressSanitizer: FPE on … Continue reading
Posted in advisories, security
Leave a comment
potrace: multiple(six) heap-based buffer overflow in bm_readbody_bmp (bitmap_io.c)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted images (bmp) revealed, through a fuzz testing, the presence of SIX heap-based buffer overflow. To avoid to make the post much long, I splitted the ASan output … Continue reading
Posted in advisories, security
Leave a comment
WiRouterKeyRec: signed integer overflow in agpf_get_serial (agpf.c)
Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config shows the presence of a signed integer overflow in agpf_check_agpf. The complete UBSan output: # WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore … Continue reading
Posted in advisories, security
Leave a comment
WiRouterKeyRec: signed shift in agpf_check_agpf (agpf.c)
Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config shows the presence of a signed shift in agpf_check_agpf The complete UBSan output: # WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore Fresta … Continue reading
Posted in advisories, security
Leave a comment
libav: heap-based buffer overflow in ff_audio_resample (resample.c)
Description: Libav is an open source set of tools for audio and video processing. A crafted file can cause an overflow in the heap. This bug was discovered the last year, but I didn’t have time to do anything else. … Continue reading
Posted in advisories, security
2 Comments
WiRouterKeyRec: divide-by-zero in agpf_get_serial (agpf.c)
Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config causes a divide-by-zero in agpf_get_serial. The complete ASan output: WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore Fresta http://www.salvatorefresta.net ASAN:DEADLYSIGNAL ================================================================= ==27225==ERROR: AddressSanitizer: … Continue reading
Posted in advisories, security
Leave a comment
logrotate: heap-based buffer overflow in readConfigFile (config.c)
Description: logrotate allows for the automatic rotation compression, removal and mailing of log files. Logrotate can be set to handle a log file daily, weekly, monthly or when the log file gets to a certain size. A crafted config causes … Continue reading
Posted in advisories, security
Leave a comment
syslog-ng: NULL pointer dereference in report_syntax_error (cfg-parser.c)
Description: syslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, message queues, databases (SQL and NoSQL alike) and more. A crafted config crashes the process because of a NULL pointer access. … Continue reading
Posted in advisories, security
Leave a comment
desktop-file-utils: desktop-file-validate: heap-based buffer overflow in validate.c
Description: desktop-file-utils is command line set of utilities to work with desktop menu entries A fuzz against desktop-file-utils binary revealed that there was an heap overflow. The complete ASan output: # desktop-file-validate crafted.desktop ================================================================= ==29796==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000e843 … Continue reading
Posted in advisories, security
Leave a comment