4 ms·
What would it mean for the vulnerability to be in the format and not the parser?
by brokensegue 2y ago
What would it mean for the vulnerability to be in the format and not the parser?
- dist-epoch 2y agoMacros in old Microsoft Word documents were quite a popular attack.
- 3eb7988a1663 2y agoI don't know. Something like a Python pickle file where parsing is unavoidable. On a second read, I realized a format problem was unlikely, but the headline just said, "Apache Parquet". My mind might the same conclusion if it said "safetensors" or "PNG".
- jonstewart 2y agoThat data had to be encoded in a certain way which would lead to unavoidable exploitation in every conforming implementation. For example, PDF permits embedded JavaScript and… that has not gone well.