lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 14 Dec 2006 20:14:10 +0200 (EET)
From: Juha-Matti Laurio <>
To: Alexander Sotirov <>
Subject: Re: The newest Word flaw is due to malformed data
 structure handling

And without any reasonable technical details it is very difficult to give a title field for the vulnerability.
Several advisories using titles like Word Unspecified Code Execution Vulnerability or Word Code Execution Vulnerability #2, #3 are not the trend we want.
Related to the newest Word issue US-CERT assigned a good title:
Microsoft Word malformed pointer vulnerability

- Juha-Matti

Alexander Sotirov <> wrote: 
> Juha-Matti Laurio wrote:
> > Related to the newest MS Word 0-day
> >
> > 
> > US-CERT Vulnerability Note VU#166700 released today lists the following
> > new technical detail:
> > 
> > "Microsoft Word fails to properly handle malformed data structures
> > allowing memory corruption to occur."
> >
> I appreciate your efforts to keep the community informed, but these kinds of
> "technical details" are completely useless. It's not your fault, this has been a
> long-standing problem with the information from coming from the likes of CERT
> and MSRC.
> Almost all Office vulnerabilities (and security issues in file parsers in
> general) are a result of "malfromed data structures allowing memory corruption
> to occur". Repeating this statement for every Word bug doesn't tell us anything new.
> Descriptions of vulnerabilities, especially ones that are found in the wild,
> should include enough information to allow researchers to uniquely identify the
> new vulnerability and differentiate it from all other bugs, both known ones and
> 0days. Without that level of detail, you end up with this:
> Alex

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists