notbugAs an Amazon Associate I earn from qualifying purchases.
Want a good read? Try FreeBSD Mastery: Jails (IT Mastery Book 15)
Ukraine
NOTE: There is a known problem on production with searching pkg-plist - it returns no results. This problem is not present on stage.freshports.org
non port: shells/bash/files/extrapatch-import-functions
SVNWeb

Number of commits found: 3

Fri, 30 Sep 2016
[ 17:19 ehaupt search for other commits by this committer ] Original commit   Revision:423003
Update to 4.4

Differential Revision:  https://reviews.freebsd.org/D8085
Sun, 28 Sep 2014
[ 16:47 bdrewery search for other commits by this committer ] Original commit   Revision:369467
- Update to patchlevel 27 which changes how functions are exported.
  This should eliminate the recent vulnerabilities, but keep the
  requirement for --import-functions/IMPORTFUNCTIONS option for now.
- Loosen the --import-functions requirement so it is not needed when running
  an interactive shell. It is already disallowed for privileged/setuid mode.
- Show an error on stderr when an imported function is ignored.
Fri, 26 Sep 2014
[ 20:33 bdrewery search for other commits by this committer ] Original commit   Revision:369341
Disable function importing from the environment by default.  This can be
enabled by using --import-functions or enabling the IMPORTFUNCTIONS option.

This removes the risk of further parser bugs leading to code execution, as
well as the risk to setuid scripts and poorly written applications that
do not cleanse their environment [1][2].

Also note that there is an unofficial 4.3.26 floating around that has not yet
been officially released.  r369261 covers the change in 4.3.26.

See also:
  http://seclists.org/oss-sec/2014/q3/747 [1]
  http://seclists.org/oss-sec/2014/q3/746 [2]
  http://seclists.org/oss-sec/2014/q3/755 [3]

Obtained from:	NetBSD (based on) [3]
PR:		193932
Reviewed by:	Eric Vangyzen
With hat:	portmgr

Number of commits found: 3