Bug#1035875: Arbitrary code execution vulnerability in versions < 2.3

Hi, I requested a CVE at cveform.mitre.org so we can start a discussion with upstream on clear grounds, and possibly involve other distros :) From https://github.com/mtrojnar/osslsigncode/compare/2.2...2.3 there are a lot of commits that fixes memory issues, e.g. fix double free in msi_dir

Bug#1035875: Arbitrary code execution vulnerability in versions < 2.3

Hi, On Wed, May 10, 2023 at 02:18:53PM +0200, Lee Garrett wrote: > Package: osslsigncode > Version: 2.1-1 > Severity: grave > Tags: security > X-Debbugs-Cc: secur...@debian.org, deb...@rocketjump.eu, Debian Security Team > > > It was reported through IRC that the current stable version of ossls

Bug#1035875: Arbitrary code execution vulnerability in versions < 2.3

Package: osslsigncode Version: 2.1-1 Severity: grave Tags: security X-Debbugs-Cc: secur...@debian.org, deb...@rocketjump.eu, Debian Security Team It was reported through IRC that the current stable version of osslsigncode contains an unpatched security vulnerability: https://github.com/mtrojnar