[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5149763B.3080500@redhat.com>
Date: Wed, 20 Mar 2013 02:41:31 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Re: Untrusted startup file inclusion in Chicken Scheme
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/19/2013 01:12 PM, Peter Bex wrote:
> Hi all,
>
> I'd like to request a CVE identifier for an untrusted code
> execution problem in Chicken Scheme: The interpreter loads a file
> called ".csirc" from the current directory on startup, without
> checking whether it can be trusted.
>
> Versions 4.8.2 after c6750af99ada7fa4815ee834e4e705bcfac9c137 are
> unaffected, as will 4.8.3 and later. The first stable release to
> include a fix will be 4.9.0.
>
> For the upstream advisory info see
> http://lists.nongnu.org/archive/html/chicken-announce/2013-03/msg00002.html
>
>
and (important!) the errata:
> http://lists.nongnu.org/archive/html/chicken-announce/2013-03/msg00003.html
>
> Cheers, Peter
Please use CVE-2013-1874 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRSXY7AAoJEBYNRVNeJnmTQYkP/2y4/0wOFf0mgDR7ZyDSLupB
VqsjLq99l8KGGsNmXAkQNCBEo+OEJXzHPzOe5gFjgCxy6C+CAvGF/UIEVHfgsiyG
gDgk9Nn6E0u+LOBy6kxPC+oiTLxueV1COY/ax0o/+ZqkbeZ9WRAX3ltvBicBFHhI
vYoMCxXbeuccXVGJHN4vcT9Wyf7+8XI4BQmGqXN8Pp1FyYjdv2ZQM5QrwguiypDQ
EXffol4xmhBiYHPd/LZxF0k687Y/q3SGxajP1y9bIVbYuvclRG7NcP38M+bK/Z/K
bC0tgrWE6W67zzi7XLwBQ4aE2WO94bxgZxq4DBqNx4iOZwaZZiO/RrROFBSSUQlw
aZoPKrhfGm6afPafHqhS4E5VlKB4aSXIaHJ4IQ9sTHdrWacxwe2ed5OFy/tUsrid
DOXz9oh1nlaAyPrNBrqkAp/TVaclYHABQ6kMy2J/6UzA6ZF8ZoEimppnSGngnHYi
4GjrCvbqS17hQogQdKJJ/+rBywihoxfaziQQaZcjs8ZT/YWv4OUTmGU6rh1BBl8Y
2Lu6S0cfBcNs7bG0WBcOFmPzgayy8sjICIXlJSF12uogSnMWYwv5aDb2qMANv3T3
4gnPi8kNfpuXhiSDMtA40eW0w0eBGTjDYIbvqGaZsNZGQMBkpCqxQwwb5Pvx/9ib
OD6/ZArF7QXN4taAMkvi
=wJvU
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
