Security

A friend of mine, Rich Cannings, spotted my name in a Sun security advisory so I guess this means my Pack200 crashes are fixed: http://scar...

Now that new packages are out for lcms and OpenJDK, I'll publish my LittleCMS exploit. It's harmless in that if it actually works on...

Today, vendor updates should be flowing for vulnerabilities in LittleCMS, sometimes known just as "lcms" or "liblcms". L...

I just released some technical details on why and how "seccomp" is vulnerable to the Linux kernel syscall filtering problems that ...

I recently came up with a little API abuse of the clone() system call. Not earth shattering, but definitely fun. Essentially, you can send ...

The new sandboxing support mentioned in the vsftpd-2.1.0 announcement post is actually a ptrace() based sandbox. It is experimental and th...

I just released vsftpd-2.1.0, with full details being available on the vsftpd web page: http://vsftpd.beasts.org/ It fixes a bunch of bugs a...