Groups > linux.debian.bugs.dist > #946931

Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap

From	Magnus Holmgren <holmgren@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.security
Subject	Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap
Date	2019-02-24 20:40 +0100
Message-ID	<xv7MZ-m0-3@gated-at.bofh.it> (permalink)
References	<x82CJ-7hv-1@gated-at.bofh.it> <wY8T8-8nJ-5@gated-at.bofh.it> <xaENz-4tj-1@gated-at.bofh.it> <wY8T8-8nJ-5@gated-at.bofh.it> <xaENz-4tj-1@gated-at.bofh.it>
Organization	Debian

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

söndag 30 december 2018 kl. 09:38:57 CET skrev  Salvatore Bonaccorso:
> There is an alternative approach wich was raised by Magnus in the
> respective bug: https://bugs.debian.org/914632#12 (and see followup
> from Moritz).

So, is it OK to upload this (assuming there's no code out there that actually 
uses SET_RSHPATH or SET_SSHPATH)?

(By no longer defining RSHPATH, rshpath doesn't get set by the following code 
and tcp_aopen() will return NIL without doing anything.

#ifdef RSHPATH			/* rsh path defined yet? */
  if (!rshpath) rshpath = cpystr (RSHPATH);
#endif

)

-- 
Magnus Holmgren        holmgren@debian.org
Debian Developer

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap Magnus Holmgren <holmgren@debian.org> - 2019-02-24 20:40 +0100
  Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap Salvatore Bonaccorso <carnil@debian.org> - 2019-02-26 12:50 +0100

csiph-web