Re: CVE-2014-7817 glibc: command execution in wordexp() with WRDE_NOCMD specified

[Vasyl Kaigorodov <vkaigoro () redhat com>]

> > After a lightning review of one of my systems, I found the following use
> > glibc's wordexp: adobe's flash plugin, ardour2, mailx, enca. I've not
> > looked into which input is under a would-be-attacker's control.
> >
> > --mancha
>
> alsa-lib is also affected.

During internal discussions of this we found that alsa-lib is affected - but
with CVE-2014-7817 fix applied it's not.
mailx though is affected even with CVE-2014-7817 applied, I will post
a separate CVE request for this to oss-sec shortly (since
CVE-2014-7817 is public - someone will find out about mailx anyways,
so see no reason keeping this private anymore).

Thanks.
-- 
Vasyl Kaigorodov | Red Hat Product Security
PGP:  0xABB6E828 A7E0 87FF 5AB5 48EB 47D0 2868 217B F9FC ABB6 E828

Attachment: _bin
Description: