All files from this thread

File Name	File Size		Posted by	Date
patch.null.pointer.txt.bin	430 bytes	open | download	Igor Sysoev	10/26/2009	Read message

A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.
The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+.


--
Igor Sysoev
http://sysoev.ru/en/

On Monday 26 October 2009 19:46:58 Igor Sysoev wrote:
> A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.
> The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+.

Hello Igor,

Can you confirm that it's related to this vulnerability?

http://www.securityfocus.com/bid/36839

Thanks !

--
Pior Bastida
pior@pbastida.net

On Fri, Oct 30, 2009 at 05:22:41PM +0100, Pior Bastida wrote:

> On Monday 26 October 2009 19:46:58 Igor Sysoev wrote:
> > A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.
> > The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+.
>
> Hello Igor,
>
> Can you confirm that it's related to this vulnerability?
>
> http://www.securityfocus.com/bid/36839

Yes. However, it's not a buffer overflow as stated there.
The published exploit causes always a null pointer dereference only
and you can not execute arbitrary code as stated there.


--
Igor Sysoev
http://sysoev.ru/en/

On Friday 30 October 2009 17:32:48 Igor Sysoev wrote:
> On Fri, Oct 30, 2009 at 05:22:41PM +0100, Pior Bastida wrote:
> > On Monday 26 October 2009 19:46:58 Igor Sysoev wrote:
> > > A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.
> > > The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+,
> > > 0.5.38+.
> >
> > Hello Igor,
> >
> > Can you confirm that it's related to this vulnerability?
> >
> > http://www.securityfocus.com/bid/36839
>
> Yes. However, it's not a buffer overflow as stated there.
> The published exploit causes always a null pointer dereference only
> and you can not execute arbitrary code as stated there.

Thank you !

--
Pior Bastida
pior@pbastida.net