Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Apr 2013 21:11:26 +0200
From: Peter Bex <>
To: Open Source Security <>
Subject: OS command injection vulnerability in Chicken Scheme


I'd like to request a CVE identifier for a bug in Chicken Scheme which
allows a malicious user to cause shell command execution through
injection of a pipe symbol and possibly other shell meta characters.

This bug is present in all versions of CHICKEN.  It will be fixed
in 4.8.3 and 4.8.2 as per commit 58684f69572453acc6fed7326fa9df39be98760e.
Version 4.9.0 will likely be the first stable release to include this
fix, unless it is decided to backport this fix to the stability release.

The full announcement is here:

By the way, I'm confused as to why the CVEs I've requested so far don't
show up in NVD.  For example,
says the CVE does not exist, but Kurt assigned it in February:

The other CVE numbers in that mail produce a "not found" page as well and
an NVD database search for "chicken" turns up nothing related to
Chicken Scheme.  The page says the database was last updated
April 19th 2013, so that's not the cause either.

Peter Bex

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.