[VIM] lbreakout security question
security curmudgeon
jericho at attrition.org
Mon May 16 17:24:31 EDT 2005
Hello,
I work with the Open Security Vulnerability Database (osvdb.org) and am
trying to determine something about the security problems reported in the
lbreakout game. Around Feb 22, 2004 Ulf Harnhammar from Debian found a
local overflow in the HOME environment variable. Debian provided a patch
for their users, but there was no indication if the original package was
updated with a fix.
A couple days ago, the Freshmeat mail list indicated a new version of
lbreakout was available. Checking the details, it said that a security
patch was applied. The changelog credits "U.H." (Ulf Harnhammar I assume)
but shows a date of 05/02/14, about one year after the overflow issue.
Can you confirm if these are the same vulnerability?
Thanks!
Brian
OSVDB.org
references:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-0158
http://www.debian.org/security/2004/dsa-445
More information about the VIM
mailing list