Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap

From	Magnus Holmgren <holmgren@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.security
Subject	Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap
Date	2019-02-24 20:40 +0100
Message-ID	<xv7MZ-m0-3@gated-at.bofh.it> (permalink)
References	<x82CJ-7hv-1@gated-at.bofh.it> <wY8T8-8nJ-5@gated-at.bofh.it> <xaENz-4tj-1@gated-at.bofh.it> <wY8T8-8nJ-5@gated-at.bofh.it> <xaENz-4tj-1@gated-at.bofh.it>
Organization	Debian

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

söndag 30 december 2018 kl. 09:38:57 CET skrev  Salvatore Bonaccorso:
> There is an alternative approach wich was raised by Magnus in the
> respective bug: https://bugs.debian.org/914632#12 (and see followup
> from Moritz).

So, is it OK to upload this (assuming there's no code out there that actually 
uses SET_RSHPATH or SET_SSHPATH)?

(By no longer defining RSHPATH, rshpath doesn't get set by the following code 
and tcp_aopen() will return NIL without doing anything.

#ifdef RSHPATH			/* rsh path defined yet? */
  if (!rshpath) rshpath = cpystr (RSHPATH);
#endif

)

-- 
Magnus Holmgren        holmgren@debian.org
Debian Developer

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-23 04:30 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-24 22:50 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-26 09:50 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-25 12:30 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 05:30 +0100
      Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 15:30 +0100
      Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-28 19:30 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Ola Lundqvist <ola@inguza.com> - 2018-12-28 21:50 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-29 16:30 +0100
    RE: RFC: proposed fix for CVE-2018-19518 in uw-imap COSTEY Anthony <a.costey@caenlamer.fr> - 2018-12-29 17:10 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Salvatore Bonaccorso <carnil@debian.org> - 2018-12-30 09:40 +0100
      Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap Magnus Holmgren <holmgren@debian.org> - 2019-02-24 20:40 +0100

csiph-web