Show pageOld revisionsBacklinksBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== Slackwarearm-current ChangeLog (2014-09-30) ====== ====== Tue Sep 30 17:12:19 UTC 2014 ====== ===== Packages ===== ==== Upgraded ==== * [[slackwarearm.current>a/bash-4.3.027-arm-1.txz]] \\ Another bash update. Here's some information included with the patch: \\ "This patch changes the encoding bash uses for exported functions to avoid \\ clashes with shell variables and to avoid depending only on an environment \\ variable's contents to determine whether or not to interpret it as a shell \\ function." \\ After this update, an environment variable will not go through the parser \\ unless it follows this naming structure: BASH_FUNC_*%% \\ Most scripts never expected to import functions from environment variables, \\ so this change (although not backwards compatible) is not likely to break \\ many existing scripts. It will, however, close off access to the parser as \\ an attack surface in the vast majority of cases. There's already another \\ vulnerability similar to CVE-2014-6271 for which there is not yet a fix, \\ but this hardening patch prevents it (and likely many more similar ones). \\ Thanks to Florian Weimer and Chet Ramey. \\ (* Security fix *) {{tag>slackware changelog slackwarearm-current 2014/09}} news/2014/09/30/slackwarearm-current-changelog.txt Last modified: 8 years agoby Giuseppe Di Terlizzi Log In