FYI: As Alan Coopersmith just said, oss-security is a public mailing list. You would need to have emailed only individual persons and private mailing lists (like [email protected] and Mr Butskoy) related to the development and distribution of the program in question for this to have been coordinated disclosure. The public message to [email protected] would then need to be posted in July, not this month.
Remember that for the next vulnerability you try to do coordinated disclosure for. On Tue, 28 Apr 2026 23:03:58 +0100 MOHAMED AZIZ RAHMOUNI <[email protected]> wrote: > Hello, > > I am reporting a security vulnerability I discovered in traceroute > 2.1.2 during manual code review and dynamic fuzzing. > > Summary: > An out-of-bounds read exists in traceroute/traceroute.c. After > recvmsg() returns, bufp is advanced past the IPv4 header (bufp += > hlen) but n is not decremented accordingly. The subsequent call: > > handle_extensions(pb, bufp + offs, n - offs, step); > > passes a len value that is hlen bytes (20 for IPv4, 40 for IPv6) > larger than the actual data available from bufp + offs. This causes > the MPLS extension parser to read past the received packet boundary > into uninitialized stack memory within buf[1280]. > > The vulnerability is remotely triggerable by any on-path network > device that can send a crafted ICMP Time Exceeded response with MPLS > extensions to a traceroute -e invocation. I have confirmed the issue > with a working proof of concept. > > Proposed fix (single line addition after line 1427): > > bufp += hlen; > n -= hlen; // add this line > > I have attached a full technical report including root cause analysis, > proof of concept code, memory layout analysis, and impact assessment. > > Please confirm receipt of this report. > > Regards, > Security researcher Zyyz > > Mohamed Aziz Rahmouni -- Ellenor et al Bjornsdottir, sysadmin umbrellix.net. This is my laptop, and as such I might be on the go; by the time you get this message I could already be back on my bike. Please consider the environment before you ask an AI to summarize this email or write me a response.
