Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less

[Raphael Geissert <geissert () debian org>]

On 17 November 2014 16:17, Robert Święcki <robert () swiecki net> wrote:
[...]
> I know that this sounds awfully impractical (at least for the time
> being, because the landscape here is changing pretty rapidly), but
> some would say that the best advice they can give to "average users"
> now is to watch "untrusted" movies with web browsers which are
> employing well-reviewed and tested sandboxing technologies and their
> media decoders are well tested (also: fuzzed). I guess "regular" media
> players will follow with this approach in some time.

It all comes down to code, whether out of the browser, in it, written
in javascript, or a pure C implementation. So I disagree.

Just to give an example of an in-browser crash, the other day I opened
a 4-years old pdf of a random company and it made chromium's pdf
plugin crash.
No problem opening it with pdf.js under firefox or poppler.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net