[ MDVSA-2010:004 ] bash

[dude67]

_______________________________________________________________________

Package : bash
Date : January 13, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
Enterprise Server 5.0, Multi Network Firewall 2.0
_______________________________________________________________________

Problem Description:

A vulnerability have been discovered in Mandriva bash package, which
could allow a malicious user to hide files from the ls command,
or garble its output by crafting files or directories which contain
special characters or escape sequences (CVE-2010-0002). This update
fixes the issue by disabling the display of control characters
by default.

Additionally, this update fixes the unsafe file creation in bash-doc
sample scripts (CVE-2008-5374).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-5374
http://cve.mitre.org/cgi-bin/cvename.cg ... -2010-0002
https://qa.mandriva.com/56882
_______________________________________________________________________