diff options
| author | Florian Weimer <fweimer@redhat.com> | 2015-10-02 11:34:13 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2015-10-02 11:34:13 +0200 |
| commit | 676599b36a92f3c201c5682ee7a5caddd9f370a4 (patch) | |
| tree | 6860752c26ccab76ee9db5e60ff465d1edf25feb /NEWS | |
| parent | b0f81637d5bda47be93bac34b68f429a12979321 (diff) | |
| download | glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.zip glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.tar.gz glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.tar.bz2 | |
Harden putpwent, putgrent, putspent, putspent against injection [BZ #18724]
This prevents injection of ':' and '\n' into output functions which
use the NSS files database syntax. Critical fields (user/group names
and file system paths) are checked strictly. For backwards
compatibility, the GECOS field is rewritten instead.
The getent program is adjusted to use the put*ent functions in libc,
instead of local copies. This changes the behavior of getent if user
names start with '-' or '+'.
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 10 |
1 files changed, 5 insertions, 5 deletions
@@ -13,11 +13,11 @@ Version 2.23 15918, 16141, 16296, 16347, 16415, 16517, 16519, 16520, 16521, 16620, 16734, 16973, 16985, 17118, 17243, 17244, 17250, 17441, 17787, 17886, 17887, 17905, 18084, 18086, 18240, 18265, 18370, 18421, 18480, 18525, - 18595, 18610, 18618, 18647, 18661, 18674, 18675, 18681, 18757, 18778, - 18781, 18787, 18789, 18790, 18795, 18796, 18803, 18820, 18823, 18824, - 18825, 18857, 18863, 18870, 18872, 18873, 18875, 18887, 18921, 18951, - 18952, 18956, 18961, 18966, 18967, 18969, 18970, 18977, 18980, 18981, - 18985, 19003, 19016, 19032, 19046. + 18595, 18610, 18618, 18647, 18661, 18674, 18675, 18681, 18724, 18757, + 18778, 18781, 18787, 18789, 18790, 18795, 18796, 18803, 18820, 18823, + 18824, 18825, 18857, 18863, 18870, 18872, 18873, 18875, 18887, 18921, + 18951, 18952, 18956, 18961, 18966, 18967, 18969, 18970, 18977, 18980, + 18981, 18985, 19003, 19016, 19032, 19046. * The obsolete header <regexp.h> has been removed. Programs that require this header must be updated to use <regex.h> instead. |