guidovranken

30 ms·

121.
Mbed TLS 2.4.2, 2.1.7, 1.3.19 out; remote DoS, mem corruption (CVE-2017-2784)(tls.mbed.org)
1 points by guidovranken 10y ago|0 comments
122.
by guidovranken 10y ago
There are not code cleanliness issues. These are all public API functions. Whether any of these bugs can be triggered remotely depends on the application and which API functions it chooses to expose to untrusted data (or how it deals with t
123.
New vulnerabilities found in ARM mbed TLS(guidovranken.wordpress.com)
36 points by guidovranken 10y ago|6 comments
124.
by guidovranken 10y ago
I've spent a lot of time reading C sources. Standouts are nginx, mbed TLS, Amazon s2n. Clean coding styles, consistent in checking function return values (very important! significant source of vulnerabilities in C software), comments w
125.
by guidovranken 10y ago
I've written this article on CVE-2017-3730: https://guidovranken.wordpress.com/2017/01/26/cve-2017-3730-... It includes proofs of concept and touches upon the fact that client vulnerabilities can affect
126.
by guidovranken 10y ago
From the outset I've always expected that a backdoor was present in Whatsapp. In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting th
127.
by guidovranken 10y ago
Over the years I've communicated many security bug reports privately to project maintainers and security teams of projects such as OpenSSL, Tor, Python, MITRE. Very pleasant experiences, very kind and thankful and helpful people, so I
128.
OpenSSL remote client memory corruption(guidovranken.wordpress.com)
2 points by guidovranken 10y ago|0 comments
129.
New OpenSSL double-free and invalid free vulnerabilities in X509 parsing(github.com)
3 points by guidovranken 10y ago|0 comments