See how dislocker compares to other vendors in security performance
Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in getdataset() and getnextdatum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.
Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk() and getfvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datumsize smaller than the 36-byte AES-CCM header, causing hexdump() to over-read and crash dislocker.