oss-security - Untrusted startup file inclusion in Chicken Scheme

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 19 Mar 2013 20:12:22 +0100
From: Peter Bex <Peter.Bex@...all.nl>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Untrusted startup file inclusion in Chicken Scheme

Hi all,

I'd like to request a CVE identifier for an untrusted code execution
problem in Chicken Scheme: The interpreter loads a file called
".csirc" from the current directory on startup, without checking
whether it can be trusted.

Versions 4.8.2 after c6750af99ada7fa4815ee834e4e705bcfac9c137
are unaffected, as will 4.8.3 and later.  The first stable release
to include a fix will be 4.9.0.

For the upstream advisory info see
http://lists.nongnu.org/archive/html/chicken-announce/2013-03/msg00002.html
and (important!) the errata:
http://lists.nongnu.org/archive/html/chicken-announce/2013-03/msg00003.html

Cheers,
Peter
-- 
http://www.more-magic.net

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.