News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in ImageMagick. Parent comment

Re:Remote code execution vulnerability in ImageMagick by peterwwillis on Tuesday May 03, 2016 @05:10PM (#11624267)
I'm sure there's buffer overflows in ImageMagick - probably lots of them - but yeah, you definitely don't need them. ImageMagick has been so buggy for so long, i'm pretty sure an accidentally corrupted image of a kitten sitting on a dog's head would gain root, dump your database and mail it to full-disclosure.
[ Parent | on HN ]
Re:Remote code execution vulnerability in ImageMagick by RachelF on Tuesday May 03, 2016 @06:13PM (#11624673)
Perhaps a silly question, but if address space layout randomization (ASLR) is enabled, should it no protect against buffer overflows?
[ Parent | on HN ]
Re:Remote code execution vulnerability in ImageMagick by peterwwillis on Tuesday May 03, 2016 @06:28PM (#11624757)
It protects against trivial ones, but advanced buffer overflows can work around ASLR and other protections.
[ Parent | on HN ]