lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 07 Mar 2005 15:04:21 -0500
From: Hubert Chan <hubert@...reg.ca>
To: Thierry Carrez <koon@...too.org>
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: Re: [ GLSA 200503-12 ] Hashcash: Format string vulnerability

>>>>> "Thierry" == Thierry Carrez <koon@...too.org> writes:

[...]

Thierry> Affected packages
Thierry> =================

Thierry>     -------------------------------------------------------------------
Thierry>      Package            /  Vulnerable  /                    Unaffected
Thierry>     -------------------------------------------------------------------
Thierry>   1  net-misc/hashcash      < 1.16-r1                       >= 1.16-r1

Just to note, version 1.13 of hashcash (incidentally, the version that's
in Debian testing) doesn't seem to be vulnerable, as it doesn't contain
the buggy line that Travis found.  I'm not sure exactly when the bug was
introduced.

-- 
Hubert Chan <hubert@...reg.ca> - http://www.uhoreg.ca/
PGP/GnuPG key: 1024D/124B61FA
Fingerprint: 96C5 012F 5F74 A5F7 1FF7  5291 AF29 C719 124B 61FA
Key available at wwwkeys.pgp.net.   Encrypted e-mail preferred.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists