mirrors/zsh
1
0
Fork 0
mirror of git://git.code.sf.net/p/zsh/code synced 2025-12-07 18:11:20 +01:00
Code Releases Activity

unposted (discussed offline): update README for integer import vulnerability

Browse source
This commit is contained in:
Peter Stephenson 2014-10-06 17:16:12 +01:00
parent a65fb0677c
commit 43c8bc81cf
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
2014-10-06 Peter Stephenson <p.stephenson@samsung.com>
* unposted (discussed offline): README: update description of
integer import problem.
2014-10-04 Barton E. Schaefer <schaefer@zsh.org>
* 33354: Src/jobs.c, Test/A05execution.ztst: when backgrounding

8
README
View file

@ -10,9 +10,11 @@ There are minor new features as well as bug fixes since 5.0.6.
Note in particular there is a security fix to disallow evaluation of the
initial values of integer variables imported from the environment (they
are instead treated as literal numbers). Although no exploits are
currently known with this issue it is recommended to upgrade as soon as
possible.
are instead treated as literal numbers). That could allow local
privilege escalation, under some specific and atypical conditions where
zsh is being invoked in privilege elevation contexts when the
environment has not been properly sanitized, such as when zsh is invoked
by sudo on systems where "env_reset" has been disabled.
Installing Zsh
--------------