RetroFed Forums
Your home away from modern life.
https://lists.debian.org/debian-security-announce/2026/msg00441.html
Post Reply
AuthorMessage
jj4211 lemmy.world jj4211@lemmy.world
Joined: 2023-06-16
#52 · (edited) Quote Reply

142 critical vulnerabilities checks inside denial of service only

Probably not even that.

For example:
https://nvd.nist.gov/vuln/detail/cve-2026-43073

The short of it is they declared the name of a function to be a vulnerability, because some developers were confused by the name and used it when they shouldn't.

A fine critique of things, but the CVE is considered closed by merely renaming the function, and downstream misuses were considered separate issues.

A "vulnerability" fixed by:

-SYM_FUNC_START(__copy_user_nocache)
+SYM_FUNC_START(copy_to_nontemporal)
9
pticrix lemmy.ca pticrix@lemmy.ca
Joined: 2024-07-06
#53 · Quote Reply

Alright alright, you guys are friends now, by the official unofficial internet rules of random interaction, you may kiss now

God dammit.
Let's do this.

This

2
Feathercrown lemmy.world Feathercrown@lemmy.world
Joined: 2023-07-06
#54 · (edited) Quote Reply

Probably not even that. For example: https://nvd.nist.gov/vuln/detail/cve-2026-43073 The short of it is they declared the name of a function to be a vulnerability, because some developers were confused by the name and used it when they shouldn't. A fine critique of things, but the CVE is considered closed by merely renaming the function, and downstream misuses were considered separate issues. A...

lmao that's crazy

I usually encounter it in NPM packages, it's always like "200 critical vulns in your dependencies!" and then 199 of them are "if you pass a regex bomb it takes a long time lol"

6
Post Reply Page 2 of 2   Goto page « First 1, 2
Back to top