Date: Wed, 24 Sep 2014 16:05:51 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Cc: chet.ramey@...e.edu Subject: CVE-2014-6271: remote code execution through bash Stephane Chazelas discovered a vulnerability in bash, related to how environment variables are processed: trailing code in function definitions was executed, independent of the variable name. In many common configurations, this vulnerability is exploitable over the network. Chet Ramey, the GNU bash upstream maintainer, will soon release official upstream patches.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.