oss-security - Re: LMS-2014-06-16-1: Oberhumer LZO

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <53ADE628.8040403@zytor.com>
Date: Fri, 27 Jun 2014 14:46:16 -0700
From: "H. Peter Anvin" <hpa@...or.com>
To: oss-security@...ts.openwall.com
CC: Yves-Alexis Perez <corsac@...ian.org>
Subject: Re: LMS-2014-06-16-1: Oberhumer LZO

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/26/2014 02:21 PM, Yves-Alexis Perez wrote:
> - syslinux [5] seems to embeds lzo but I'm unsure if the vulnerable
> code is really present, I can't find lzo1x_decompress_safe() code

For the record, I just upgraded Syslinux to LZO 2.07.  The only code
that ends up in the Syslinux build at all changed only in comments and
in #if'd out code.  The only use of LZO is in the Syslinux core, which
uses the assembly LZO implementation, which seems to have been unaffected.

Syslinux does not use LZO on arbitrary data.

	-hpa

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTreYYAAoJEL2gYIVJO6zkF90P/RTyWaLtMMe24o1MfjgHOKsT
bIypKYFGN3y0eU0I0ciMOiyuhLSLN7en/y8M558RjoKStriJ6yfQLiMJF4cxGBPJ
J9GYoX9xT6/luBqefssCPB4uFeD+h/qYOlHxykq81I+c0bWsaunkHBAEmXlSihXe
/Fu2dzDEm2bP7kYKx//t4tS2blU9papnFxMsQfc2NZV/U3xenhbHigOaibl5M4lv
6zpH/J6qT5kB5PdAWJBr9OqU6DrcSdUXYIC5YObUHtdoCiUeTjVJinQPoeghvhlY
VCj3Q/t7/w2E7r5aQ8IHBan58vIK173F6+cOwdLQtfkQZT1Fqm71sXOx81dT/LcQ
FYiofMtCyMar4d0JWKVlXzHy7U5sZ9/WmFJX6l2nyd56TQsCBBFJjml5n9O/KNqb
AEJgsqIaTUTjzobECuQdfS8B/8PwUDcVq1uga3r8HawXeWa4NnBP0nFgLY+gD0b+
HD32+A80vc6YurQMvBVBlPwbFfbhcRsNLksKJdnOcE+hE9CgwsWsvSpS4B7NWsq4
QOSOgPkzjpztHJKV5TLuN9x02Cn1uRMFDL1Dv/v0ql5qlLDF6YrrLb7rQPoveDSx
8nvslwm3aHk1z2YOG9A2YQnI6qV4RCNkh3Y1wPz5jiqq5sadRKxg03xJQASFPHVM
6tSmhFkxfgIE7MFttcxV
=AiFW
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.