In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Afl++ | Afl++_project | 4.05c (including) | 4.05c (including) |
| Aflplusplus | Ubuntu | focal | * |
| Aflplusplus | Ubuntu | kinetic | * |
| Aflplusplus | Ubuntu | lunar | * |
| Aflplusplus | Ubuntu | mantic | * |
| Aflplusplus | Ubuntu | oracular | * |
| Aflplusplus | Ubuntu | plucky | * |
| Aflplusplus | Ubuntu | trusty | * |
| Aflplusplus | Ubuntu | xenial | * |