bugtraq - Re: [ GLSA 200503-12 ] Hashcash: Format string vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050407051930.22885.qmail@www.securityfocus.com>
Date: 7 Apr 2005 05:19:30 -0000
From: Adam Back <adam@...herspace.org>
To: bugtraq@...urityfocus.com
Subject: Re: [ GLSA 200503-12 ] Hashcash: Format string vulnerability


In-Reply-To: <87r7irrzne.fsf@...nrude.uhoreg.ca>

Hi

Two notes:

- the format string security bug is now fixed in hashcash-1.17

- Hubert is correct that the bug was not in hashcash-1.13, it was introduced in hashcash 1.14

Cheers

Adam

>Just to note, version 1.13 of hashcash (incidentally, the version that's
>in Debian testing) doesn't seem to be vulnerable, as it doesn't contain
>the buggy line that Travis found.  I'm not sure exactly when the bug was
>introduced.