BugTraq
Back to list
|
Post reply
Re: [ GLSA 200503-12 ] Hashcash: Format string vulnerability
Mar 07 2005 08:04PM
Hubert Chan (hubert uhoreg ca)
>>>>> "Thierry" == Thierry Carrez <koon (at) gentoo (dot) org [email concealed]> writes:
[...]
Thierry> Affected packages
Thierry> =================
Thierry> -------------------------------------------------------------------
Thierry> Package / Vulnerable / Unaffected
Thierry> -------------------------------------------------------------------
Thierry> 1 net-misc/hashcash < 1.16-r1 >= 1.16-r1
Just to note, version 1.13 of hashcash (incidentally, the version that's
in Debian testing) doesn't seem to be vulnerable, as it doesn't contain
the buggy line that Travis found. I'm not sure exactly when the bug was
introduced.
--
Hubert Chan <hubert (at) uhoreg (dot) ca [email concealed]> - http://www.uhoreg.ca/
PGP/GnuPG key: 1024D/124B61FA
Fingerprint: 96C5 012F 5F74 A5F7 1FF7 5291 AF29 C719 124B 61FA
Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
[...]
Thierry> Affected packages
Thierry> =================
Thierry> -------------------------------------------------------------------
Thierry> Package / Vulnerable / Unaffected
Thierry> -------------------------------------------------------------------
Thierry> 1 net-misc/hashcash < 1.16-r1 >= 1.16-r1
Just to note, version 1.13 of hashcash (incidentally, the version that's
in Debian testing) doesn't seem to be vulnerable, as it doesn't contain
the buggy line that Travis found. I'm not sure exactly when the bug was
introduced.
--
Hubert Chan <hubert (at) uhoreg (dot) ca [email concealed]> - http://www.uhoreg.ca/
PGP/GnuPG key: 1024D/124B61FA
Fingerprint: 96C5 012F 5F74 A5F7 1FF7 5291 AF29 C719 124B 61FA
Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.
[ reply ]