Slackwarearm-14.2 ChangeLog (2017-12-20)

Wed Dec 20 08:08:08 UTC 2017

  • patches/packages/ruby-2.2.9-arm-1_slack14.2.txz
    This update fixes a security issue:
    Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile
    use Kernel#open to open a local file. If the localfile argument starts with
    the pipe character “|”, the command following the pipe character is executed.
    The default value of localfile is File.basename(remotefile), so malicious FTP
    servers could cause arbitrary command execution.
    For more information, see:
    (* Security fix *)
  • news/2017/12/20/slackwarearm-14.2-changelog.txt
  • Last modified: 3 years ago
  • by Giuseppe Di Terlizzi