Path to this page:
Subject: CVS commit: pkgsrc/shells/mksh
From: Benny Siegert
Date: 2014-10-07 20:51:02
Message id: 20141007185102.D3CE998@cvs.netbsd.org
Log Message:
Security: Update mksh to 50d.
R50d is a required bugfix release:
- [Goodbox] Fix NULL pointer dereference on âunset x; nameref xâ
- [tg] Fix severe regression in field splitting (LP#1378208)
- [tg] Add a warning about not using tainted user input (including from
the environ(7)ment) in arithmetics, until Stéphane writes it up nicely
R50c is a security fix release:
- [tg] Know more rare signals when generating sys_signame[] replacement
- [tg] OpenBSD sync (mostly RCSID only)
- [tg] Document HISTSIZE limit; found by luigi_345 on IRC
- [zacts] Fix link to Debian .mkshrc
- [tg] Cease exporting $RANDOM (Debian #760857)
- [tg] Fix C99 compatibility
- [tg] Work around klibc bug causing a coredump (Debian #763842)
- [tg] Use issetugid(2) as additional check if we are FPRIVILEGED
- [tg] SECURITY: do not permit += from environment
- [tg] Fix more field splitting bugs reported by Stephane Chazelas and
mikeserv; document current status wrt. ambiguous ones as testcases too
Files: