[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140925020746.GA29342@openwall.com>
Date: Thu, 25 Sep 2014 06:07:46 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: bash security update (CVE-2014-6271)
Hi,
There are updated bash packages in Owl-current built for i686 and x86_64,
fixing a critical vulnerability. Here's the CHANGES-current entry:
2014/09/25 Package: bash
SECURITY FIX Severity: none to high, remote, active
Updated to 3.1 patchlevel 18. This fixes a vulnerability with function
imports, which could in many setups be exploited remotely.
References:
http://www.openwall.com/lists/oss-security/2014/09/24/10
http://www.openwall.com/lists/oss-security/2014/09/24/11
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
These binary packages from Owl-current are also usable as-is on Owl
3.0-stable.
Please note that Owl-current is undergoing some invasive updates now, so
there are some inconsistencies between its source tree and the currently
available binary packages (for some other packages, not for bash), most
of which haven't been rebuilt yet. We'll take care of producing proper
binary builds with all of these other updates shortly.
Also, please note that the Owl 3.0-stable branch is about to be EOL'ed,
in favor of the 3.1-stable branch forked from Owl-current just prior to
the invasive changes mentioned above.
Please excuse the mess.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
