| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <AANLkTimtDP7iZaa4=CWdAPwew_R3wL+dLT8rgOwHbb=c@mail.gmail.com> Date: Fri, 6 Aug 2010 16:47:41 +0200 From: Robert Święcki <robert@...ecki.net> To: jesparza@...rnal-todo.com Cc: full-disclosure@...ts.grok.org.uk Subject: Re: On the iPhone PDF and kernel exploit On Fri, Aug 6, 2010 at 10:14 AM, Jose Miguel Esparza <josemiguel.esparza@...il.com> wrote: > Hi! > > I took a look at the PDF some days ago, looking for the PDF vuln, you > can see my post about it here: > > http://eternal-todo.com/blog/jailbreakme-pdf-exploit > > Anyway, I continue analysing it... <cite>"At the moment there's no available patch so it's recommended some type of mitigation and to be careful with the visited links"....</cite> The fix seems to be here: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f14e56148fd991965424d9bd1cdbc (http://www.kb.cert.org/vuls/id/275247) I wonder if this was in any way inspired by my previous bugreport in June (the same piece of code, slightly different attack vector). https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2497 http://savannah.nongnu.org/bugs/index.php?30083 Maybe, maybe not.. -- Robert Święcki _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists