| |||||||||||||
Gnash, Lightspark, and ShumwayGnash, Lightspark, and ShumwayPosted Nov 25, 2012 21:11 UTC (Sun) by kripkenstein (subscriber, #43281)In reply to: Gnash, Lightspark, and Shumway by cmccabe Parent article: Gnash, Lightspark, and Shumway
We are talking about different kinds of vulnerabilities. eval() can cause problems, sure, but eval in a sandbox still can't escape the sandbox. C++ code, on the other hand, can in general affect the outside system.
For a browser itself running Flash (not a website), one type of vulnerability is much more important.
(Log in to post comments)
Gnash, Lightspark, and Shumway Posted Nov 25, 2012 21:25 UTC (Sun) by khim (subscriber, #9252) [Link] We are talking about different kinds of vulnerabilities. eval() can cause problems, sure, but eval in a sandbox still can't escape the sandbox. C++ code, on the other hand, can in general affect the outside system. No, it can not do that. The most you can do is create some kind of logic fault in the program itself - exactly what eval() tends to do. Effects buffer overflows in C++ program and misquoting in eval() in JS tend to be surprisingly similar.
|
|||||||||||||