full-disclosure - Very minor heap address disclosure; measuring time to fix for [Firefox] [Internet Explorer] [Safari]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AANLkTinNXLR_U=_UsW07zM9x0fs3oeMFJt-0P=oMTi3y@mail.gmail.com>
Date: Wed, 9 Mar 2011 20:09:20 -0800
From: Chris Evans <scarybeasts@...il.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Very minor heap address disclosure;
 measuring time to fix for [Firefox] [Internet Explorer] [Safari]

Hi,

It's unusual to get both conditions:

- The exact same bug across multiple different codebases.
- Already partially disclosed.

So the rare opportunity will be seized to provide a direct comparison of
response quality and response time. Some might argue that this is a much
better metric than other common metrics such as "bug counting".

It's not serious by any stretch of the imagination, so those looking for
pwnage can stop reading.

Full details,
http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html

Who will handle it best? Results via @scarybeasts

Cheers
Chris

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/