Date: Tue, 19 Mar 2013 20:12:22 +0100 From: Peter Bex <Peter.Bex@...all.nl> To: Open Source Security <oss-security@...ts.openwall.com> Subject: Untrusted startup file inclusion in Chicken Scheme Hi all, I'd like to request a CVE identifier for an untrusted code execution problem in Chicken Scheme: The interpreter loads a file called ".csirc" from the current directory on startup, without checking whether it can be trusted. Versions 4.8.2 after c6750af99ada7fa4815ee834e4e705bcfac9c137 are unaffected, as will 4.8.3 and later. The first stable release to include a fix will be 4.9.0. For the upstream advisory info see http://lists.nongnu.org/archive/html/chicken-announce/2013-03/msg00002.html and (important!) the errata: http://lists.nongnu.org/archive/html/chicken-announce/2013-03/msg00003.html Cheers, Peter -- http://www.more-magic.net
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ