Re: CVE-2015-9059 (Accepted picocom 1.7-1+deb7u1 (source amd64) into oldstable)
On 2017-06-02 09:21, Chris Lamb wrote:
> It's the "same" patch but I also needed to backport split.[ch]. Some
> of the run_cmd callsites were also different in the 1.7 version so it's
> not identical.
Just to be sure, we talk about the same patch...
I meant the one I added Tue, 30 May 2017 to the bug report:
https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=863671;filename=fix-command-injection-vulnerability;msg=14
It also contains split.[ch] and changed run_cmd calls.
Are there more differences?
Reply to: