Hello, I recently completed salvaging of src:ucf[1]. As part of code cleanup I discovered a variable inherited from the environment which is then passed to eval[2]. Unintended code execution is trivial to demonstrate. To my mind, this is a coding oversight. As the patch in #1089015 shows, the fix is simple and obvious. But I want to be sure that nobody is using inheritance of this variable as an undocumented 'feature' before merging the suggested patch. The Security Team have already been consulted and are content for this to be handled through stable-pu. For completeness, unstable and testing are no longer affected as virtually all uses of eval have been removed. Thanks Mark [1] https://bugs.debian.org/1086847 [2] https://bugs.debian.org/1089015
Attachment:
signature.asc
Description: PGP signature