Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 25 Sep 2014 06:07:46 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: bash security update (CVE-2014-6271)

Hi,

There are updated bash packages in Owl-current built for i686 and x86_64,
fixing a critical vulnerability.  Here's the CHANGES-current entry:

2014/09/25	Package: bash
SECURITY FIX	Severity: none to high, remote, active
Updated to 3.1 patchlevel 18.  This fixes a vulnerability with function
imports, which could in many setups be exploited remotely.
References:
http://www.openwall.com/lists/oss-security/2014/09/24/10
http://www.openwall.com/lists/oss-security/2014/09/24/11
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271

These binary packages from Owl-current are also usable as-is on Owl
3.0-stable.

Please note that Owl-current is undergoing some invasive updates now, so
there are some inconsistencies between its source tree and the currently
available binary packages (for some other packages, not for bash), most
of which haven't been rebuilt yet.  We'll take care of producing proper
binary builds with all of these other updates shortly.

Also, please note that the Owl 3.0-stable branch is about to be EOL'ed,
in favor of the 3.1-stable branch forked from Owl-current just prior to
the invasive changes mentioned above.

Please excuse the mess.

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ