Hello Simson, > Please issue a statement retracting your "security vulnerability" > CV2-2007-2056. > > Your alleged vulnerability in aimage is not a bug because the > function getlock() is never called. You are correct. I sincerely appologize for not catching this. This function is not called in versions 2.2.0 or 2.2.8. This correction has been made on our website along with some others. For more information, see: http://www.vsecurity.com/bulletins/advisories/2007/afflib-toctou.txt http://www.vsecurity.com/bulletins/advisories/2007/afflib-overflows.txt http://www.vsecurity.com/bulletins/advisories/2007/afflib-shellinject.txt http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt We are currently aware of no other exploitable flaws in AFFLIB. thank you for validating our claims, tim
