Multiple vulnerabilities in RPM – and a rant

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Last year in November I decided that it might be a good idea to fuzz the parsers of package management tools in Linux distributions. I quickly found a couple of issues in DPKG and RPM. For DPKG the process went very smooth. I reported them to Debian's security team, eight days later fixes and security advisories were published by both Debian and Ubuntu, the main distributions using DPKG. For RPM…

Read on blog.fuzzing-project.org ↗