Dumping Yahoo authentication secrets with an out-of-bounds read

Re:Dumping Yahoo authentication secrets with an out-of-bound... by smaili on Friday May 19, 2017 @09:25PM (#14380532)

For those wondering, this issue (referred to as YB2 or Yahoobleed #2 by the author) has already been fixed by Yahoo:

> Yahoo! fixed YB2 at the same time as YB1, by retiring ImageMagick.

[ Parent | on HN ]

Re:Dumping Yahoo authentication secrets with an out-of-bound... by scarybeast on Friday May 19, 2017 @11:14PM (#14380863)

FWIW, I've been very impressed with how Yahoo! handled this disclosure.

[ Parent | on HN ]

Re:Dumping Yahoo authentication secrets with an out-of-bound... by tyingq on Saturday May 20, 2017 @09:44AM (#14382331)

Ouch. I have a site the generates images with ImageMagick based on user input. Guess I'm off to look for details.

[ Parent | on HN ]