Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Curious Case of Convexity Confusion

projectzero.google | blog | #vulnerability-research | #project-zero | #skia | #graphics

Summary

Some time ago, I noticed a tweet about an externally reported vulnerability in Skia graphics library (used by Chrome, Firefox and Android, among others). The vulnerability caught my attention for several reasons:
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Drawing Outside the Box: Precision Issues in Graphic Libraries
By Mark Brand and Ivan Fratric, Google Project Zero
blog · projectzero.google
Owning Internet Printing - A Case Study in Modern Software Exploitation
A Google Project Zero case study demonstrating a complete exploit chain against the CUPS internet printing service.
blog · projectzero.google
In-Console-Able
A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.
blog · projectzero.google
A Tale of Two Exploits
A Google Project Zero deep dive into the exploitation techniques used against a Flash Player scripting vulnerability.
blog · projectzero.google
Taming the wild copy: Parallel Thread Corruption
A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.
blog · projectzero.google
A Token’s Tale
A Google Project Zero post explaining why demonstrating exploitability with a working proof of concept matters in vulnerability research.
back