[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[Libevent-users] Re: Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]

To: libevent-users@xxxxxxxxxxxxx
Subject: [Libevent-users] Re: Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]
From: Nick Mathewson <nickm@xxxxxxxxxxxxx>
Date: Mon, 5 Jan 2015 10:36:30 -0500
Delivered-to: archiver@xxxxxxxx
Delivered-to: libevent-users-outgoing@xxxxxxxx
Delivered-to: libevent-users@xxxxxxxx
Delivery-date: Mon, 05 Jan 2015 10:36:34 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:content-type; bh=g+Z//c5quJ3//BEjZyc8ZsUo6EkoCVKi9zPrhEu98uE=; b=jSQu3z24wUnad9hJ+6k1li6MoPNBs0x/zlLGH8aIattAsuQnMYC5PIqWqciEDM6D2a 1z4K1Ogor1k4MYjHjEXtigC1cVbMHEq1PB0ACwSlsvdb/s0/s9ulvrfhPIrFBErYCIAh KQjb7+SI47WokINQEVo1p8Bl6k0HSJOP4DJjpkX5tCJxZNrDmc8Ii5M5k+9uJUCTz0kH SdmbEJv4mmsN6yXxqx69DZb/UfqbUFSrY5ROCBkmOfgB4J1A4voS2gHQJt4hK6DH6Ho6 DClBUYC8TG3MQQ6AavbuN+NFu0N4vlS2pcvnqJk7LpIvgmC6cNygxg2YWZDTnpjbo9d3 Qk5Q==
In-reply-to: <CAKDKvuxyj1Q0Na+YkiAhu-48p3Q8wcc=6xf1Lkrc9ueEAsdjtw@xxxxxxxxxxxxxx>
References: <CAKDKvuxyj1Q0Na+YkiAhu-48p3Q8wcc=6xf1Lkrc9ueEAsdjtw@xxxxxxxxxxxxxx>
Reply-to: libevent-users@xxxxxxxxxxxxx
Sender: owner-libevent-users@xxxxxxxxxxxxx

On Mon, Jan 5, 2015 at 10:27 AM, Nick Mathewson <nickm@xxxxxxxxxxxxx> wrote:

Incidentally, at least one programmer I respect tells me he's pretty
sure that the heap overflow issue can't occur on modern systems in
practice, and only the infinite-loop issue is relevant.  I'll let him
explain his reasoning here if he wants to.  Personally, I prefer a
"better safe than sorry" approach.

yrs,
-- 
Nick
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxx with
unsubscribe libevent-users    in the body.

Follow-Ups:
- Re: [Libevent-users] Re: Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]
  - From: Mark Ellzey

References:
- [Libevent-users] Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]
  - From: Nick Mathewson

Prev by Author: [Libevent-users] [ANN] Libevent 1.4.15-stable is released
Next by Author: Re: [Libevent-users] [ANN] Libevent 2.0.22-stable is released
Previous by thread: [Libevent-users] Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]
Next by thread: Re: [Libevent-users] Re: Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]
Index(es):
- Author
- Thread