Slashdot Mirror

← Back to Domains

Domain: oberhumer.com

Stories and comments across the archive that link to oberhumer.com.

Stories · 2

  1. Are the Hard-to-Exploit Bugs In LZO Compression Algorithm Just Hype?

    It · Security · · posted by timothy · from the you'll-never-feel-it dept. · 65 comments
    NotInHere (3654617) writes In 1996, Markus F. X. J. Oberhumer wrote an implementation of the Lempel–Ziv compression, which is used in various places like the Linux kernel, libav, openVPN, and the Curiosity rover. As security researchers have found out, the code contained integer overflow and buffer overrun vulnerabilities, in the part of the code that was responsible for processing uncompressed parts of the data. Those vulnerabilities are, however, very hard to exploit, and their scope is dependent on the actual implementation. According to Oberhumer, the problem only affects 32-bit systems. "I personally do not know about any client program that actually is affected", Oberhumer sais, calling the news about the possible security issue a media hype.

  2. Stuxnet/Flame/Duqu Uses GPL Code

    Yro · Opensource · · posted by Unknown · from the state-sponsored-piracy dept. · 221 comments
    David Gerard writes "It seems the authors of Stuxnet/Duqu/Flame used the LZO library, which is straight-up GPL. And so, someone has asked the U.S. government to release the code under the GPL. (Other code uses various permissive licenses. As works of the U.S. federal government, the rest is of course public domain.) Perhaps the author could enlist the SFLC to send a copyright notice to the U.S. government..."