3 ms·

I'd love to see a citation on this, as I asked for previously. Repeating the comment I replied to isn't a citation.

• jerf 10y ago
  That is somewhere around asking for a citation if the sky is sometimes cloudy. https://web.nvd.nist.gov/view/vuln/search-results?query=use-after-free&search_type=all&cves=on https://web.nvd.nist.gov/view/vuln/search-results?query=use-... Before getting too excited and claiming that it's only 1.3% of all CVEs or something, remember that it's 1.3% of all vulnerabilities. (Especially with the explosion of dynamic web languages, a lot of CVEs aren't really C/C++-related.) There's a power law to these things, so by the power law metric, it's not that far behind "buffer overflow" (6,500 entries), and ahead of the well-known "format string" (577), which is also certainly "one of" the most common C issues.
  • jjnoakes 10y ago
    I'm looking specifically for remote code execution vulnerabilities, which is what the original comment was discussing, and which is a subset of what you posted. And no, this is not like asking for citations for the sky sometimes being cloudy because the original comment didn't say "use-after-free sometimes leads to remote code exploit". This is like asking for citations for a claim like "whenever the skies are cloudy it is due to acid rain more than any other reason". And a claim like that should be accompanied with some citations. Let's have an honest discussion here, or don't bother, please.