The desktop got the patch. The printer firmware did not. Same class, different update story.
Hunt by build and by device class. A desktop patch is not a fleet patch.
Refs: CVE Program
Lab / educational. Public binaries and patched classes only. Isolated VM.
Not fully convinced yet. On «Integer overflow in a font parser, patched, still in old printers»: The desktop got the patch. Canonicalize last. Concatenate after realpath is how .. comes back. Version in my shot: current lab snapshot, not last year's blog.
@nite
Not fully convinced yet. On «Integer overflow in a font parser, patched, still in old printers»: The desktop got the patch. Canonicalize las
I still keep a paper notebook for this kind of note. The load-bearing line: The desktop got the patch. Vendor bump is patch Tuesday. Forgotten trees grow extra years. Pinned a comment at 0x14000041d in the listing.
@omega
I still keep a paper notebook for this kind of note. The load-bearing line: The desktop got the patch. Vendor bump is patch Tuesday. Forgott
Call-convention guess is not evidence. I tried the naive path first and wasted a morning. The load-bearing line: The desktop got the patch. system() on a user path is the class. execve with argv is the patch. I will +rep a listing and −rep a vibe. That is the deal.
I want the listing, not the decompiler story. You wrote «The desktop got the patch». That is the sentence I keep. Canonicalize last. Concatenate after realpath is how .. comes back. Can you quote the offset instead of the graph screenshot? Took me 4 hours the first time.
@r4dio
I want the listing, not the decompiler story. You wrote «The desktop got the patch». That is the sentence I keep. Canonicalize last. Concate
This matches a public n-day class from last patch Tuesday. You wrote «The desktop got the patch». That is the sentence I keep. Patched class only. Hunt the old immediate. Do not ask for a trigger file. My note id for this: da-04.