gjasny
A: CVE-2022-3602 was originally assessed by the OpenSSL project as CRITICAL as
it is an arbitrary 4-byte stack buffer overflow, and such vulnerabilities may
lead to remote code execution (RCE).
During the week of prenotification, several organisations performed testing
and gave us feedback on the issue, looking at the technical details of the
overflow and stack layout on common architectures and platforms.
Firstly, we had reports that on certain Linux distributions the stack layout
was such that the 4 bytes overwrote an adjacent buffer that was yet to be used
and therefore there was no crash or ability to cause remote code execution.
Secondly, many modern platforms implement stack overflow protections which
would mitigate against the risk of remote code execution and usually lead to a
crash instead.
However as OpenSSL is distributed as source code we have no way of knowing how
every platform and compiler combination has arranged the buffers on the stack
and therefore remote code execution may still be possible on some platforms.
Our security policy states that a vulnerability might be described as CRITICAL
if “remote code execution is considered likely in common situations”. We no
longer felt that this rating applied to CVE-2022-3602 and therefore it was
downgraded on 1st November 2022 before being released to HIGH.I used a script to toggle the SPDIF output stream of my Soundblaster Live to get track marks on the Mini Disc player recording the output.
When I did the same for some homebrew formula I got a response a few hours later.
For me homebrew has a much more responsive community and due to their use of Github also a lower bar for contributions. Both might add to homebrew popularity.
Their website lists some CO2 compensation projects.
See: https://cmake.org/cmake/help/v3.7/manual/cmake-toolchains.7....
I prefer software that uses mature 3rd party libs over NIH driven rewrites. Please also keep in mind that CMake is available for many platforms sone with fading user base like AIX, HPUX, or Solaris. Using a well tested event library like libuv helps to keep those supported.
IMHO it's the best available CMake book available right now. I especially liked the recommendations at the end of every chapter.
Using TLS1.3 with OpenSSL
See: https://github.com/powerline/fonts/blob/master/README.rst
A zsh theme with those characters in use: https://gist.github.com/agnoster/3712874