[Full-disclosure] n.runs-SA-2007.027 - Sophos Antivirus UPX parsing Arbitrary CodeExecution Advisory

[Lisa Thalheim]

Hi Sergio,

Sergio Alvarez wrote:

> I ask for apologies for the mistake.
> Unfortunately we can't give more details about the vulnerability because
> the German Law (§202)

I beg to differ. The update to 202c is somewhat cryptic and it's still
unclear what its implications will be, although I know lawyers here (==
in .de) who say that the addition introduced is simply redundant.

But whatever your take on this 202c addition is: It really, really,
_really_ doesn't say anything about publishing information concerning
vulnerabilities.

Regards,
Lisa