Re: Third-party patch for CVE-2007-3896, UPDATE NOW
KJK::Hyperion ha scritto:
> The present patch is dramatically under-tested and it has underwent no
> quality assurance procedure whatsoever, so please deploy with the
> greatest care.
Indeed, I just found a gruesome memory leak in it. A silly bug, brown
paperbag-grade shame. If you installed my patch, upgrade RIGHT THIS
MOMENT NOW or slowly die:
<http://spacebunny.xepher.net/hack/shellexecutefiasco/>
For the press guys watching: THIS IS VERY IMPORTANT, more important than
the original patch was. I don't expect "shitty patch actually shitty" to
seriously make the big headlines, but, hey, a heads up: there is a good
reason Microsoft takes a lot of time to put patches out, after all. I
don't do this for the reputation, either: I already made a U-turn on my
feelings about the vulnerability, I'm not too proud to admit my mistakes
(god knows how big the egos can get in FD)
- References:
- URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
- RE: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
- Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
- Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype
- Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
- Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype
- Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) available