lcamtuf's old blog
- Posts
- 51 from 8 Jun 2010 to 21 Oct 2022
- Posting
- quiet since 2022
- Kind
- personal blog
- Feed
- https://lcamtuf.blogspot.com/feeds/posts/default
2022 1
2021 1
2017 1
2016 3
2015 6
2014 14
- afl-fuzz: nobody expects CDATA sections in XML
- afl-fuzz: crash exploration mode
- Pulling JPEGs out of thin air
- PSA: don't run 'strings' on untrusted files (CVE-2014-8485)
- Two more browser memory disclosure bugs (CVE-2014-1580 and #19611cz)
- Fuzzing random programs without execve()
- Bash bug: the other two RCEs, or how we chipped away at the original fix (CVE-2014-6277 and '78)
- Bash bug: apply Florian's patch now (CVE-2014-6277 and CVE-2014-6278)
- Quick notes about the bash bug, its impact, and the fixes so far
- CVE-2014-1564: Uninitialized memory with truncated images in Firefox
- Binary fuzzing strategies: what works, what doesn't
- A bit more about american fuzzy lop
- Boolean algebra with CSS (when you can only set colors)
- Messing around with <a download>
2013 2
2012 4
2011 11
- Notes about the post-XSS world
- X-Frame-Options, or solving the wrong problem
- CSS :visited may be a bit overrated
- "The Tangled Web" is out
- An origin is forever
- The subtle / deadly problem with CSP
- Using View > Encoding can kill you (in a manner of speaking)
- A note on an MHTML vulnerability
- The other reason to beware ExternalInterface.call()
- Warning: OBJECT and EMBED are inherently unsafe
- Announcing cross_fuzz, a potential 0-day in circulation, and more