external/cde
1
0
Fork 0
mirror of git://git.code.sf.net/p/cdesktopenv/code synced 2025-03-09 15:50:02 +00:00
Code Issues Releases Wiki Activity

Patch vulnerability CVE-2019-14868

Browse source 
Certain environment variables were interpreted as arithmetic
expressions on startup, leading to code injection.

Ref.:
https://bugzilla.redhat.com/show_bug.cgi?id=1757324
c7de8b6412

(cherry picked from commit ee6b001d0611ad2e00b6da2c2b42051995c0a678)
This commit is contained in:
Martijn Dekker 2020-05-21 14:27:51 +02:00
parent c1dae413d2
commit 593a5a8b7f
3 changed files with 57 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -10,6 +10,10 @@ Any uppercase BUG_* names are modernish shell bug IDs.
'<#pattern'. The bug was caused by out-of-sync streams.
Details and discussion: https://github.com/att/ast/issues/61
- Patched code injection vulerability CVE-2019-14868. As a result, you can
no longer use expressions in imported numeric environment variables; only
integer literals are allowed.
2020-05-20:
- Fix BUG_ISSETLOOP. Expansions like ${var+set} remained static when used