[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <513800080.2059602.1416501500596.JavaMail.zimbra@redhat.com>
Date: Thu, 20 Nov 2014 11:38:20 -0500 (EST)
From: Francisco Alonso <falonsoe@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-7817 glibc: command execution in wordexp() with WRDE_NOCMD
specified
Hello,
It was discovered that the wordexp() function could ignore the WRDE_NOCMD flag under certain input conditions resulting in the execution
of a shell for command substitution when the applicaiton did not request it.
Bug report:
https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2014-7817
Git commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1157689
https://sourceware.org/ml/libc-alpha/2014-11/msg00519.html
Francisco Alonso / Red Hat Product Security
PGP: 0xA026440E 0825 020C 7A5A 4F86 9038 B1C8 5562 688F A026 440E
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
