Bug#948989: ksh: CVE-2019-14868

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#948989: ksh: CVE-2019-14868
Date	2020-01-15 18:00 +0100
Message-ID	<zoUbo-4LB-5@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: ksh
Version: 2020.0.0-2
Severity: grave
Tags: security upstream
Justification: user security hole

Hi,

The following vulnerability was published for ksh.

CVE-2019-14868[0]:
|environment variables on startup are interpreted as arithmetic
|expression leading to code injection

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-14868
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14868
[1] https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#948989: ksh: CVE-2019-14868 Salvatore Bonaccorso <carnil@debian.org> - 2020-01-15 18:00 +0100
  Bug#948989: marked as done (ksh: CVE-2019-14868) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-01-15 19:10 +0100

csiph-web