Open Information Security Foundation

10/03/2024

05:56 AM Suricata Security #7229: detect: write to read-only memory in transforms

Clarification, "The output buffer is around 3 megabytes large" _at the time of the crash_, i.e. offset into the buffe... Simen Lybekk

10/02/2024

02:43 PM Suricata Security #7229: detect: write to read-only memory in transforms

Philippe Antoine wrote in #note-2:
> could you try this PR ?
Sorry, I haven't been able to reproduce this since b... Simen Lybekk

08/28/2024

09:33 AM Suricata Security #7229 (Closed): detect: write to read-only memory in transforms

We've managed to trigger a segfault that seems very similar to Bug #4403 by creating a rule containing ... Simen Lybekk

08/27/2024

06:26 PM Suricata Bug #6920: FR, FM and Global stats gone after 7.0.4

I'm pretty sure this can be resolved now yes, we haven't seen this since upgrading to 7.0.5. Simen Lybekk

04/05/2024

10:35 AM Suricata Bug #6921 (Closed): jsonbuilder: serializes Rust f64 NaNs to an invalid literal

Flagging as a bug, although could be argued that it's not.
The JSON builder has two methods for handling floats:
... Simen Lybekk

10:24 AM Suricata Bug #6920 (Closed): FR, FM and Global stats gone after 7.0.4

During roll-out of 7.0.4 we experienced that non-worker stats namespaces like flow recycler, flow manager and Global ... Simen Lybekk

09/01/2023

03:15 PM Suricata Security #6279: Crash in SMTP parser during parsing of email

Jason Ish wrote in #note-6:
> Can this pcap end up in public tests?
Sure, that's fine Simen Lybekk

08/30/2023

04:01 PM Suricata Security #6279: Crash in SMTP parser during parsing of email

Jason Ish wrote in #note-4:
> I am able to reproduce, but not in the context of any filestore configuration. Instead... Simen Lybekk

08/23/2023

10:44 AM Suricata Security #6279 (Closed): Crash in SMTP parser during parsing of email

During testing of Suricata 7.0, we've noticed that Suricata occationally exits due to issues with SMTP traffic.
- ... Simen Lybekk

12/14/2018

09:21 AM Suricata Bug #2745 (Closed): Invalid detect-engine config could lead to segfault

Certain invalid YAML configs for the legacy detect-engine config node can cause a segfault. The following config node... Simen Lybekk