Note from upstream release note:
Note in particular there is a security fix to disallow evaluation of the
initial values of integer variables imported from the environment (they
are instead treated as literal numbers). That could allow local
privilege escalation, under some specific and atypical conditions where
zsh is being invoked in privilege elevation contexts when the
environment has not been properly sanitized, such as when zsh is invoked
by sudo on systems where "env_reset" has been disabled.
This addresses the local crash from CVE-2014-6277. Note that
the fixes applied in 4.3.25_2 (and upstream 4.3.27) already made
this non-exploitable remotely.
This makes 'bashcheck' [1] fully green now. It had a soft warning
before for CVE-2014-6277.
[1] https://github.com/hannob/bashcheck
This should eliminate the recent vulnerabilities, but keep the
requirement for --import-functions/IMPORTFUNCTIONS option for now.
- Loosen the --import-functions requirement so it is not needed when running
an interactive shell. It is already disallowed for privileged/setuid mode.
- Show an error on stderr when an imported function is ignored.
enabled by using --import-functions or enabling the IMPORTFUNCTIONS option.
This removes the risk of further parser bugs leading to code execution, as
well as the risk to setuid scripts and poorly written applications that
do not cleanse their environment [1][2].
Also note that there is an unofficial 4.3.26 floating around that has not yet
been officially released. r369261 covers the change in 4.3.26.
See also:
http://seclists.org/oss-sec/2014/q3/747 [1]
http://seclists.org/oss-sec/2014/q3/746 [2]
http://seclists.org/oss-sec/2014/q3/755 [3]
Obtained from: NetBSD (based on) [3]
PR: 193932
Reviewed by: Eric Vangyzen
With hat: portmgr
minor COMMENT typos and surrounding whitespace fixes. A few Makefiles
where not included as they contain Latin-1 characters that break
the Phabricator workflow. Categories P-S.
CR: D422
Approved by: portmgr (bapt)
The ports infrastructure may insert additional content into the
BUILD_DEPENDS variable which is not supposed to be a run depend.
Approved by: portmgr (bapt)
