full-disclosure - Re: On the iPhone PDF and kernel exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C5C2A59.8000005@eternal-todo.com>
Date: Fri, 06 Aug 2010 17:29:29 +0200
From: Jose Miguel Esparza <jesparza@...rnal-todo.com>
To: Robert S'wie;cki <robert@...ecki.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: On the iPhone PDF and kernel exploit

Robert S'wie;cki escribió:
>
> <cite>"At the moment there's no available patch so it's recommended
> some type of mitigation and to be careful with the visited
> links"....</cite>
>
> The fix seems to be here:
> http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f14e56148fd991965424d9bd1cdbc
> (http://www.kb.cert.org/vuls/id/275247)
>
> I wonder if this was in any way inspired by my previous bugreport in
> June (the same piece of code, slightly different attack vector).
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2497
> http://savannah.nongnu.org/bugs/index.php?30083
>
> Maybe, maybe not..
>   

I'll update my post, because the day I published it there was no clues 
about this vuln...

Thanks!

-- 
Jose Miguel Esparza
http://eternal-todo.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/