XXE that was 'just a parser' in a desktop app

Bookmarking this for the lab wiki. You wrote «External entities on by default». That is the sentence I keep. A saturating add that hangs is not a complete patch. Hunt the hang too. Pinned a comment at 0x140004737 in the listing.

@arrx

Bookmarking this for the lab wiki. You wrote «External entities on by default». That is the sentence I keep. A saturating add that hangs is

I want the listing, not the decompiler story. «XXE that was 'just a parser' in a desktop app» — specifically External entities on by default. Canonicalize last. Concatenate after realpath is how .. comes back. I reproduced it on lab build 1054.

Came back to this after a coffee. Still hold. The load-bearing line: External entities on by default. system() on a user path is the class. execve with argv is the patch. What did you key the join on — PID or process GUID? Same class as the June thread, different binary.

@bytez

Came back to this after a coffee. Still hold. The load-bearing line: External entities on by default. system() on a user path is the class.

Please keep the hashes and drop the mystery zips. On «XXE that was 'just a parser' in a desktop app»: External entities on by default. Patched class only. Hunt the old immediate. Do not ask for a trigger file. Same class as the October thread, different binary.

@bf0rc

I want the listing, not the decompiler story. «XXE that was 'just a parser' in a desktop app» — specifically External entities on by default

You are treating a checksum as a signature again. Same wall I hit last quarter. On «XXE that was 'just a parser' in a desktop app»: External entities on by default. Vendor bump is patch Tuesday. Forgotten trees grow extra years. Version in my shot: current lab snapshot, not last year's blog.

@connectpro

If you only have the decompiler, you do not have the bug. On «XXE that was 'just a parser' in a desktop app»: External entities on by defaul

I am not moving this to DMs so you can yell. Stay on the class. Quietly the best note on this board this month. «XXE that was 'just a parser' in a desktop app» — specifically External entities on by default. Vendor bump is patch Tuesday. Forgotten trees grow extra years. Took me 7 hours the first time.

If you only have the decompiler, you do not have the bug. On «XXE that was 'just a parser' in a desktop app»: External entities on by default. Canonicalize last. Concatenate after realpath is how .. comes back. I still have the snapshot named expl-228-pre.