3 ms·
"Marlinspike published details about the exploits outside of normal "responsible disclosure"" No deets published, this ^ is a lie.
by not1ofU 5y ago
"Marlinspike published details about the exploits outside of normal "responsible disclosure""
No deets published, this ^ is a lie.
- wglb 5y agoDisagree. He published that it uses old version of FFMPEG. A simple google search leads me to https://www.cvedetails.com/vulnerability-list/vendor_id-3611/Ffmpeg.html https://www.cvedetails.com/vulnerability-list/vendor_id-3611.... And https://security.googleblog.com/2014/01/ffmpeg-and-thousand-fixes.html https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... Not clear what other deets one would need.
- not1ofU 5y agoFair, but you had to search for it, and the results are publised by someone else, but I supposed that's just semantics.
- wglb 5y agoTo be fair, I remember the fuzz project from back when it was done. My point is that I feel that this is enough of a disclosure, since it was such a broken piece of software.