Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Bob Friesenhahn
Re: feedback requested regarding deprecation of TLS 1.0/1.1
oss-sec mailing list archives From: Bob Friesenhahn <bobjfriesenhahn () gmail com> Date: Tue, 6 Aug 2024 17:23:24 -0500 On 8/6/24 11:34, Stuart Henderson wrote: On 2024/08/06 17:12, Marco Moock wrote: As a user, this is acceptable for me, but I know there are still machines outside that only offer such old versions. Some of them can't be upgraded easily because the vendor doesn't provide any new versions. BTW, mainstream web browsers disabled pre-1.2 TLS by default around 2020.
Re: sandboxing,of upstream programs by distros
oss-sec mailing list archives From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sun, 22 Oct 2023 11:26:25 -0500 (CDT) On Sun, 22 Oct 2023, Demi Marie Obenour wrote: Unfortunately, most Linux IPC mechanisms are not very secure since they rely on historical Unix privilege models to control access. If one can bypass access control on IPC, one can easily get root by sending malicious commands to systemd, so I don't think this is something to worry about.
Re: sandboxing,of upstream programs by distros
oss-sec mailing list archives From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sun, 22 Oct 2023 09:19:59 -0500 (CDT) On Sat, 21 Oct 2023, Demi Marie Obenour wrote: For Rocky Linux Security SIG, the only relevant thing mentioned so far was possibly offering an OpenBSD pledge()-alike that other packages could use.
Re: illumos (or at least danmcd) membership in the distros list
oss-sec mailing list archives From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Thu, 14 Sep 2023 08:36:17 -0500 (CDT) On Wed, 13 Sep 2023, Dan McDonald wrote: I'm requesting membership (for danmcd () mnx io <mailto:danmcd () mnx io> ) on the "distros" mailing list on behalf of illumos ( https://illumos.org ). We would join non-Linux participants such as those from Oracle Solaris, FreeBSD, NetBSD, and pkgsrc.
Re: Stack overflow in imagemagick coders/tiff.c
oss-sec mailing list archives From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Wed, 14 Jun 2023 07:52:05 -0500 (CDT) On Wed, 14 Jun 2023, Salvatore Bonaccorso wrote: It seems suspicious that (after looking at the code) this is obviously a heap overflow (of the 'tile_pixels' allocation) rather than a stack overflow. Whenever something is mischaracterized, it becomes suspect.
Explore App does not show and sync tracks
Dear Garmin developers, I own Garmin devices since GPS II 30 years ago and I updated them every two years. I had many Maps, MapSource, BaseCamp, ... and I'd rate me an experienced Garmin user. Today, my new GPSMap 52s arrived. I updated the firmware, map and satellite data. And I was very keen on the new Bluetooth Sync option between my Android Samsung S20 with Explore and my 52s. Pairing worked fine. Connect and Explore Mobile got installed. Both connect to my device.
/home/loser is with permissions 755, default umask 0022
oss-sec mailing list archives By Date By Thread Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Thu, 8 Oct 2020 08:29:39 -0500 (CDT) On Thu, 8 Oct 2020, Seth Arnold wrote: On Wed, Oct 07, 2020 at 04:09:59PM -0500, Bob Friesenhahn wrote: Ubuntu Linux (a Debian derivative) has changed the default.
/home/loser is with permissions 755, default umask 0022
oss-sec mailing list archives By Date By Thread Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Wed, 7 Oct 2020 16:09:59 -0500 (CDT) On Wed, 7 Oct 2020, Georgi Guninski wrote: https://lists.debian.org/debian-security/2020/10/msg00000.html === /home/loser is with permissions 755, default umask 0022 on multiuser machines this sucks much.
Mitigating malicious packages in gnu/linux
oss-sec mailing list archives By Date By Thread Re: Mitigating malicious packages in gnu/linux From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Wed, 20 Nov 2019 15:08:58 -0600 (CST) On Wed, 20 Nov 2019, Jeremy Stanley wrote: On 2019-11-20 13:28:04 -0600 (-0600), Bob Friesenhahn wrote: [...] Modern GNU/Linux systems have far too much executing code to reasonably secure. Paring down the amount of executing code helps quite a lot with improving security.
Mitigating malicious packages in gnu/linux
oss-sec mailing list archives Re: Mitigating malicious packages in gnu/linux From: Bob Friesenhahn Date: Wed, 20 Nov 2019 13:28:04 -0600 (CST) The ideas I have seen posted on this topic thus far are about assuring correct provenance and that installed binaries are based on what the maintainer/developer intended.
-dSAFER escape via .buildfont1
oss-sec mailing list archives By Date By Thread Re: ghostscript CVE-2019-10216: -dSAFER escape via .buildfont1 From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Mon, 12 Aug 2019 09:46:55 -0500 (CDT) Is it known if this issue also impacts the PDF reader? I see that the involved code is Resource/Init/gs_type1.ps which is presumably related to Postscript Type 1 fonts, which might be included in a PDF file.
Privileged File Access from Desktop Applications
oss-sec mailing list archives By Date By Thread Re: Privileged File Access from Desktop Applications From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Thu, 11 Jul 2019 10:57:15 -0500 (CDT) On Thu, 11 Jul 2019, Perry E. Metzger wrote: It seems like a bad idea.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Tue, 25 Jun 2019 09:51:02 -0500 (CDT) On Tue, 25 Jun 2019, Matthew Fernandez wrote: I’m probably telling you things you already know and it sounds like you don’t consider such issues worth addressing, but I just wanted to point out that these are not theoretical.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Tue, 25 Jun 2019 08:41:08 -0500 (CDT) On Mon, 24 Jun 2019, Alex Gaynor wrote: - Not having sooooo many vulnerabilities. While there's some dispute over just what % of the bugs that OSS-Fuzz and syzbot turn up are exploitable, there's no doubt that they find a _lot_ of them.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Mon, 24 Jun 2019 11:44:31 -0500 (CDT) On Mon, 24 Jun 2019, Alexander Potapenko wrote: Most oss-fuzz issue detections are not CVE worthy. For example, a one-byte read "heap overflow" is not likely to cause any actual harm but oss-fuzz would classify it as "heap overflow".
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Mon, 24 Jun 2019 11:42:17 -0500 (CDT) On Mon, 24 Jun 2019, Stuart D. Gathman wrote: Question: is fuzzing useful for languages like Java/python? Obviously, you eventually reach a native code module in both cases, but fuzzing the entire virtual machine is cumbersome.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Mon, 24 Jun 2019 10:42:40 -0500 (CDT) On Mon, 24 Jun 2019, Dmitry Vyukov wrote: So what are community thoughts on automatic CVE assignment? That would definitely get some attention to these bugs by vendors (because that's open CVEs in their products then).
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sun, 16 Jun 2019 12:08:20 -0500 (CDT) On Sun, 16 Jun 2019, Solar Designer wrote: Some people have interpreted this as implying there are ">100 security bugs OSS-Fuzz found and publicly disclosed [...], and which still have not been fixed" specifically in ImageMagick.
GraphicsMagick 1.3.32 security fixes, plus one of special mention
oss-sec mailing list archives By Date By Thread GraphicsMagick 1.3.32 security fixes, plus one of special mention From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sat, 15 Jun 2019 15:17:22 -0500 (CDT) GraphicsMagick 1.3.32 is now released, fixing another 52 additional issues detected by oss-fuzz. Of special mention is a bug reported to us by "Battle Furry" via our security mail alias.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sat, 15 Jun 2019 14:41:28 -0500 (CDT) On Sat, 15 Jun 2019, Alex Gaynor wrote: I think you're quite right that the central challenge here is the mismatch between how Linux distributions operate and what their claims/people's expectations are.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sat, 15 Jun 2019 11:21:41 -0500 (CDT) On Sat, 15 Jun 2019, Alex Gaynor wrote: Today I'd like to highlight what I see as a tremendous issue: very few of these security bugs ever has a CVE issued for it.
Re: Multiple telnet.c overflows
Re: Multiple telnet.c overflows Hacker Fantastic (Dec 12)
Crashes and memory safety bugs in dcraw
Re: Re: Crashes and memory safety bugs in dcraw Bob Friesenhahn (Nov 23)
1Policy operator gives access to .forceput CVE-2018-18284
oss-sec mailing list archives Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Wed, 17 Oct 2018 08:30:43 -0500 (CDT) On Wed, 17 Oct 2018, Rich Felker wrote: Even with the easy to exploit stuff compiled out (which upstream do not support), I haven't been bothering to get CVE's for all the memory corruption or UaF I've been reporting, because nobody can keep up with these operator leaks anyway.
bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)
Should we disable PS coders in policy.xml by default?
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?,
Should we disable PS coders in policy.xml by default?
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?
Should we disable PS coders in policy.xml by default?
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?
Should we disable PS coders in policy.xml by default?
Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?
GraphicsMagick 1.3.27 is available
From: Bob Friesenhahn Date: Sun, 10 Dec 2017 11:32:31 -0600 (CST) [ This release announcement is forwarded to the oss-security list due the many security issues found in 1.3.26 and fixed by 1.3.27. Much thanks to the security researchers and OS package maintainers who notified us about problems and sometimes provided useful analysis and GraphicsMagick 1.3.27 (the 61st release, and the 28th in this cycle) is now available.
Race condition between UDP bind(2) and connect(2) delivers wrong datagrams
oss-sec mailing list archives Re: Race condition between UDP bind(2) and connect(2) delivers wrong datagrams From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Wed, 8 Nov 2017 13:13:20 -0600 (CST) On Wed, 8 Nov 2017, Eric Blake wrote: This issue is not that case because Darwin[1], DragonFly[2], FreeBSD[3], GNU/Hurd (though by importing Linux man pages), Linux[4], NetBSD[5], and OpenBSD[6] all document behavior compatible with POSIX[7].
LibTIFF 4.0.8 memory leaks
CVE-2017-16231: PCRE 8.41 match() stack overflow; CVE-2017-16232: LibTIFF 4.0.8 memory leaks
Linux kernel CVEs not mentioned on oss-security
Re: Linux kernel CVEs not mentioned on oss-security
Linux kernel CVEs not mentioned on oss-security
oss-sec mailing list archives Re: Linux kernel CVEs not mentioned on oss-security From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Tue, 26 Sep 2017 14:40:44 -0500 (CDT) On Tue, 26 Sep 2017, Kurt Seifried wrote: On Tue, Sep 26, 2017 at 11:31 AM, Bob Friesenhahn < It is incredibly difficult for most non-commercial upstreams to do this since they have limited manpower, they are not informed of all the applicable CVEs, and the CVE information received is essentially hearsay, received...
A bunch of duplicate CVEs requested for?? bho..
Re: A bunch of duplicate CVEs requested for?? bho.. Agostino Sarubbo (Aug 29)
Re: Cve issue discussion
Re: Cve issue discussion Glenn Randers-Pehrson (Aug 07)
two vulns in uClibc-0.9.33.2
Re: two vulns in uClibc-0.9.33.2 Bob Friesenhahn (Jun 16)
Is not memory allocation failure a bug?
Re: Is not memory allocation failure a bug? Glenn Randers-Pehrson (Jun 08)
use of uninitialized memory in RLE decoder
Re: Re: ImageMagick: CVE-2017-9098: use of uninitialized memory in RLE decoder
use of uninitialized memory in RLE decoder
Re: Re: ImageMagick: CVE-2017-9098: use of uninitialized memory in RLE decoder
use of uninitialized memory in RLE decoder
oss-sec mailing list archives Re: Re: ImageMagick: CVE-2017-9098: use of uninitialized memory in RLE decoder From: Bob Friesenhahn <bfriesen () simple dallas tx us> Date: Sat, 20 May 2017 13:21:52 -0500 (CDT) On Sat, 20 May 2017, Leo Famulari wrote: Chris Evans' report (copied in the email you replied to) says this: GraphicsMagick vs. ImageMagick, again.
remote DoS via CPU exhaustion in anon FTP server glob expansion
remote DoS via CPU exhaustion in anon FTP server glob expansion
GraphicsMagick heap out of bounds write issue
I would like to ammend this report in that the situation is a read beyond an allocated heap buffer rather than a write beyond the end of an allocated heap buffer as was originally reported. The application may crash but should not be otherwise compromised.
GraphicsMagick heap out of bounds write issue
From: Bob Friesenhahn Date: Fri, 24 Feb 2017 08:23:21 -0600 (CST) I would like to ammend this report in that the situation is a read beyond an allocated heap buffer rather than a write beyond the end of an allocated heap buffer as was originally reported. The application may crash but should not be otherwise compromised.
GraphicsMagick heap out of bounds write issue
From: Bob Friesenhahn Date: Thu, 23 Feb 2017 21:18:17 -0600 (CST) GraphicsMagick versions up to 1.3.25 encounter a write beyond an allocated heap buffer when reading CMYKA TIFF files which claim to This is the tiffinfo description of the problematic TIFF file: TIFF Directory at offset 0x808 (2056) Image Width: 34 Image Length: 48 Bits/Sample: 8 Sample Format: unsigned integer Compression Scheme: None Photometric Interpretation: separated Extra Samples: 1 Orientation: row 0 top, col 0 lhs...
MITRE is adding data intake to its CVE ID process
oss-sec mailing list archives Re: MITRE is adding data intake to its CVE ID process From: Bob Friesenhahn <bfriesen () simple dallas tx us>Date: Sat, 11 Feb 2017 09:20:55 -0600 (CST) On Sat, 11 Feb 2017, Moritz Muehlenhoff wrote: Having CVEs assigned is of lesser importance, this was never primarily why we posted security vulnerabilities here.
memory allocation failure in MagickRealloc (memory.c)
From: Bob Friesenhahn Date: Thu, 1 Dec 2016 21:20:13 -0600 (CST) If suitable for a CVE please assign one. Thanks. Description: Graphicsmagick is an Image Processing System. This is an old memory failure, discovered time ago. The maintainer, Mr. Bob Friesenhahn was able to reproduce the issue; I’m quoting his feedback about: The problem is that the embedded JPEG data claims to have dimensions 59395×56833 and this is only learned after we are in the JPEG reader.
Libtiff 4.0.7 release fixes many security issues
From: Bob Friesenhahn Date: Tue, 22 Nov 2016 08:40:15 -0600 (CST) It is perhaps not broadly known that libtiff 4.0.7 was released on November 20th, and it addresses a great many security issues. The release notes may be read at The release notes are based on information which was available when the bug was reported or the commit made. If there was a CVE number, it was made note of. If there was a vendor issue number, that was made note of.
heap buffer overflow/read outside of array
Re: CVE Request: libtiff: heap buffer overflow/read outside of array
oss-sec: GraphicsMagick CVE Request
From: Bob Friesenhahn Date: Fri, 7 Oct 2016 08:35:33 -0500 (CDT) Two security issues have been discovered in the WPG format reader in GraphicsMagick 1.3.25 (and earlier): 1. In a build with QuantumDepth=8 (the default), there is no check that the provided colormap is not larger than 256 entries, resulting in potential heap overflow. This problem does not occur with larger QuantumDepth values. 2. The assertion: ReferenceBlob: Assertion `blob != (BlobInfo *) NULL' failed.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Bob
Contact Bob, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack